1 MQV and HMQV in IEEE P1363 William Whyte, Hugo Krawczyk, Alfred Menezes.

Slides:

Advertisements

Similar presentations

Diffie-Hellman Diffie-Hellman is a public key distribution scheme First public-key type scheme, proposed in 1976.

Advertisements

ISA 662 IKE Key management for IPSEC Prof. Ravi Sandhu.

HMQV: A High-Performance Secure*Diffie-Hellman Protocol

Hash Function Firewalls in Signature Schemes Burt Kaliski, RSA Laboratories IEEE P1363 Working Group Meeting June 2, 2000 (Rev. June 8, 2000)

PAR for P Title: Standard for Pairing based Cryptographic Techniques June 4, 2005 PAR for IEEE P

Key Establishment Schemes Workshop Document October 2001.

SIP Authentication using EC- SRP5 Protocol draft-liu-sipcore-ecc-srp5-00.txt Authors: Fuwen Liu, Minpeng Qi and Min Zuo.

Digital Signatures and Hash Functions. Digital Signatures.

CNS2010handout 10 :: digital signatures1 computer and network security matt barrie.

Cryptography1 CPSC 3730 Cryptography Chapter 10 Key Management.

1 Digital Signatures CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute April 12, 2004.

Secure Hashing and DSS Sultan Almuhammadi ICS 454 Principles of Cryptography.

Csci5233 Computer Security & Integrity 1 Cryptography: Basics (2)

CMSC 414 Computer and Network Security Lecture 6 Jonathan Katz.

Cryptography and Network Security Chapter 10. Chapter 10 – Key Management; Other Public Key Cryptosystems No Singhalese, whether man or woman, would venture.

Cryptography and Network Security Chapter 13

Computer Science Public Key Management Lecture 5.

IDENTITY MANAGEMENT Hoang Huu Hanh (PhD), OST – Hue University hanh-at-hueuni.edu.vn.

Csci5233 Computer Security1 Bishop: Chapter 10 Key Management: Digital Signature.

Information Security and Management 13. Digital Signatures and Authentication Protocols Chih-Hung Wang Fall

Guomin Yang Temasek Laboratories National University of Singapore HOW TO BUILD A SECURE COMMUNICATION CHANNEL.

Chapter 5 Digital Signatures MSc. NGUYEN CAO DAT Dr. TRAN VAN HOAI 1.

Lecture slides prepared for “Computer Security: Principles and Practice”, 2/e, by William Stallings and Lawrie Brown, Chapter 21 “Public-Key Cryptography.

Information Security Principles Assistant Professor Dr. Sana’a Wafa Al-Sayegh 1 st Semester ITGD 2202 University of Palestine.

Lecture 19 Page 1 CS 111 Online Symmetric Cryptosystems C = E(K,P) P = D(K,C) E() and D() are not necessarily the same operations.

Cryptography and Network Security Third Edition by William Stallings Lecture slides by Lawrie Brown.

Key Management and Diffie- Hellman Dr. Monther Aldwairi New York Institute of Technology- Amman Campus 12/3/2009 INCS 741: Cryptography 12/3/20091Dr. Monther.

Cyrtographic Security Identity-based Encryption 1Dennis Kafura – CS5204 – Operating Systems.

Lecture 11: Strong Passwords

Lecture 14 ISAKMP / IKE Internet Security Association and Key Management Protocol / Internet Key Exchange CIS CIS 5357 Network Security.

ECE 454/CS 594 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall.

Key Agreement Guilin Wang School of Computer Science 12 Nov

Cryptography Wei Wu. Internet Threat Model Client Network Not trusted!!

Chapter 21 Public-Key Cryptography and Message Authentication.

Cryptography and Network Security (CS435) Part Eight (Key Management)

Cryptography and Network Security Chapter 10 Fifth Edition by William Stallings Lecture slides by Lawrie Brown.

Cryptography and Network Security Chapter 13 Fifth Edition by William Stallings Lecture slides by Lawrie Brown.

PUBLIC-KEY CRYPTOGRAPH IT 352 : Lecture 2- part3 Najwa AlGhamdi, MSc – 2012 /1433.

IPSEC : KEY MANAGEMENT PRESENTATION BY: SNEHA A MITTAL(121427)

Chapter 3 (B) – Key Management; Other Public Key Cryptosystems.

Cryptography and Network Security Key Management and Other Public Key Cryptosystems.

Cryptographic Hash Functions and Protocol Analysis

ECE509 Cyber Security : Concept, Theory, and Practice Key Management Spring 2014.

1 Chapter 10: Key Management in Public key cryptosystems Fourth Edition by William Stallings Lecture slides by Lawrie Brown (Modified by Prof. M. Singhal,

Prepared by Dr. Lamiaa Elshenawy

Fall, Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Cryptographic Security Identity-Based Encryption.

Umans Complexity Theory Lectures Lecture 7b: Randomization in Communication Complexity.

Computer and Network Security - Message Digests, Kerberos, PKI –

NTRU Key Exchange based on a posting of Lars Luthman on the Cryptography mailinglist on 05/17/2014 The search for a Post-Quantum Diffie-Hellman replacement.

Key Management Network Systems Security Mort Anvari.

Digital Signature Standard (DSS) US Govt approved signature scheme designed by NIST & NSA in early 90's published as FIPS-186 in 1991 revised in 1993,

Lecture 11 Overview. Digital Signature Properties CS 450/650 Lecture 11: Digital Signatures 2 Unforgeable: Only the signer can produce his/her signature.

Lecture 9 Overview. Digital Signature Properties CS 450/650 Lecture 9: Digital Signatures 2 Unforgeable: Only the signer can produce his/her signature.

Cryptography and Network Security Chapter 10 Fourth Edition by William Stallings Lecture slides by Lawrie Brown.

1 Secure Key Exchange: Diffie-Hellman Exchange Dr. Rocky K. C. Chang 19 February, 2002.

1 Chapter 3-3 Key Distribution. 2 Key Management public-key encryption helps address key distribution problems have two aspects of this: –distribution.

Diffie-Hellman Key Exchange first public-key type scheme proposed by Diffie & Hellman in 1976 along with the exposition of public key concepts – note:

Introduction to Elliptic Curve Cryptography CSCI 5857: Encoding and Encryption.

Information Security and Management 10. Other Public-key Cryptosystems Chih-Hung Wang Fall

Key Management public-key encryption helps address key distribution problems have two aspects of this: – distribution of public keys – use of public-key.

Cryptography and Network Security Chapter 13

Design Problems (Open book)

ICS 454 Principles of Cryptography

Practical Aspects of Modern Cryptography

ICS 454 Principles of Cryptography

Key Management Network Systems Security

Bishop: Chapter 10 Key Management: Digital Signature

Key Exchange, Man-in-the-Middle Attack

Diffie-Hellman Algorithm

Presentation transcript:

1 MQV and HMQV in IEEE P1363 William Whyte, Hugo Krawczyk, Alfred Menezes

2 Background IEEE Std includes MQV –Also approved in X9.63 and by NIST for use in key exchange Since issued, HMQV has been proposed –Addresses perceived weaknesses in MQV –Provides proof of security –Submitted to P1363 for consideration for inclusion in 1363 revision Hugo has provided full specification in standards format Would be as alternative to, not replacement for, MQV Aim of today –Understand differences between protocols –Begin to discuss criteria for including additional techniques Down the road –Techniques will be included in standard as result of WG evote.

3 Technical background (Thanks to Hugo for original slides) –(Any errors in the editing process are Williams) Notation: G= of prime order q; g in supergroup G (eg. EC, Z* p ) Alices PK is A=g a and Bobs is B=g b

4 MQV Exchange ephemeral DH values, X=g x, Y=g y Calculate –d=LSB(X), e=LSB(Y) –where LSB(X)= 2L + X mod 2L for L=|q|/2 (this is the ½ exponentiation) Both compute σ=g (x+da)(y+eb) as σ = (YB e ) x+da = (XA d ) y+eb –Actual computation of σ involves co-factor h=|G|/q σ = (YB e ) x+da = (XA d ) y+eb σ = (σ) h Session key is K=KDF(σ)

5 HMQV Both compute σ=g (x+da)(y+eb) as σ = (YB e ) x+da = (XA d ) y+eb –d=H(X,Bob) e=H(Y,Alice) (here H outputs |q|/2 bits) Session key K=H(σ) Differences with MQV –Definition of d, e: binds ids, randomizes representation –H(σ): integral (and essential) part of the protocol (OW,RO) HMQV = Hashed MQV (note: 2.5 exponentiations)

6 Claimed differences HMQV does not require Proof of Possession for public keys because it binds the identity to the calculation using H HMQV does not require use of co-factor or other test for prime order of ephemeral keys UNLESS ephemeral private keys are more vulnerable to leakage than long-term keys –Cofactor for ECMQV is typically 4; cofactor for DLMQV is large HMQV has proof of security in RO model