1. A Secure Fault-Tolerant Conference- Key Agreement Protocol Wen-Guey Tzeng Source : IEEE Transactions on computers Speaker ： LIN, KENG-CHU

2. Outline Introduction Introduction Model Model Design Principles Design Principles Concrete protocol Concrete protocol Security analysis Security analysis Conclusion Conclusion

3. Introduction What is conference key ? What is conference key ? Types of the conference key protocol Types of the conference key protocol  Key distribution protocol  Key agreement protocol The conference key are either pre-distributed or dynamic distributed. Types of the Adversary Types of the Adversary  Active  Passive

4. Model User : a probabilistic polynomial-time turning machine User : a probabilistic polynomial-time turning machine A public directory A public directory Authenticated broadcast network Authenticated broadcast network Passive adversary and Active adversary Passive adversary and Active adversary

5. Design Principles (1/2) component-based component-based  Easy to upgrade  Easy to apply strong security analysis  Flexible and suitable for use in a large system. The idea of the protocol every member handle a sub-function of a multiparty-computation function. The idea of the protocol every member handle a sub-function of a multiparty-computation function. Component Component  Secure multiparty computation for fi  K i commitment and verfication

6. Design Principles (2/2) Stages of the protocol Stages of the protocol  Secret distribution and commitment  Sub-key computation and verification  Fault detection  Conference key computation

7. A Concrete protocol (1/5) The system has public parameters The system has public parameters  p, q ： large prime number and p = 2q +1  H ： a one-way permutation from Z q to Z q  g ： a generator for the subgroup Each user U i has two parameters: Each user U i has two parameters:  Private parameter x i ： a number in  Public parameter y i ：

8. A Concrete protocol (2/5) Secret distribution and commitment (each participant U i do the following ) Secret distribution and commitment (each participant U i do the following ) a) Randomly select b) Compute a polynomial h i (x) that passes points 1 ≦ j ≦ n c) Compute and broadcast

9. A Concrete protocol (3/5) Sub-key computation and verification ( each participant U i does the following for j ≠ i) Sub-key computation and verification ( each participant U i does the following for j ≠ i) a) On receiving w jl ， 1 ≦ l ≦ n ， and α j ， compute the polynomial that passes 1 ≦ l ≦ n b) Let c) Check whether is the ELGamal signature of if so, broadcast V ij = “ success ” ， otherwise broadcast V ij = “ failure ”

10. A Concrete protocol (4/5) Fault detection ( each participant U i does the following for j ≠ i) Fault detection ( each participant U i does the following for j ≠ i) a) On receive V ji = “ failure ” for some U j ： U j claims that U i itself faulty 。 (1) Output R i ， K i ， S i 。 b) On receive V jm = “ failure ” for some U m ： U j claims that U m faulty (1)wait for U m ’ s fault detection R m ， K m ， S m (2)if U m ’ s fault detection messages are not received, set U m a malicious participant. (3)On receiving R m ， K m ， S m ， check its correctness 。 If it ’ s correct, set U j malicious. c) Restart the protocol by deleting malicious participant

11. A Concrete protocol (5/5) Conference-key computation ： if no faults are detected in the fault detection stage ， each participant U i computes the conference key where the current participant set is Conference-key computation ： if no faults are detected in the fault detection stage ， each participant U i computes the conference key where the current participant set is

12. Security analysis(1/3) Correctness Correctness Fault Tolerance Fault Tolerance Security against passive attackers. Security against passive attackers.

13. Security analysis(2/3) Correctness Theorem (correctness) : if all participants follow the protocol, they compute a common conference key proof ： 1. From the broadcast message of participant U j ， U i can compute the polynomial h j (x) then compute h j (0) = K j 2. By verify the γ j δ j ， U i can check whether K j is correct 。 Since for fixed γ j δ j ， the signed text H(K j ) is unique, all participants compute the same K j 。 Thus, the compute the same key K =(K 1 + K 2 +…+ K n ) mod q 。 Lemma(1) ： any malicious participant U i who tries to cheat honest participants into accepting different K i shall be wxcluded from the participant sets of all honest participant 。 Lemma(2) ： no honest participant excludes any other honest participant from his participant set 。 Correctness Theorem (correctness) : if all participants follow the protocol, they compute a common conference key proof ： 1. From the broadcast message of participant U j ， U i can compute the polynomial h j (x) then compute h j (0) = K j 2. By verify the γ j δ j ， U i can check whether K j is correct 。 Since for fixed γ j δ j ， the signed text H(K j ) is unique, all participants compute the same K j 。 Thus, the compute the same key K =(K 1 + K 2 +…+ K n ) mod q 。 Lemma(1) ： any malicious participant U i who tries to cheat honest participants into accepting different K i shall be wxcluded from the participant sets of all honest participant 。 Lemma(2) ： no honest participant excludes any other honest participant from his participant set 。

14. Security analysis(3/3) Fault tolerance Theorem (Fault tolerance) ： all honest participants have the same participant set and thus compute the same conference key no matter how many participants are malicious proof ： By the two lemmas ， there are two participants in the system ， one is the honest participant and another is the one, though deviating from the protocol, make all honest participants compute the same key. Fault tolerance Theorem (Fault tolerance) ： all honest participants have the same participant set and thus compute the same conference key no matter how many participants are malicious proof ： By the two lemmas ， there are two participants in the system ， one is the honest participant and another is the one, though deviating from the protocol, make all honest participants compute the same key.

15. Conclusion Propose an secure, fault-tolerant, efficient protocol after deleting all malicious users. Propose an secure, fault-tolerant, efficient protocol after deleting all malicious users. The flaw is that the size of messages that each participant sends is proportional to the number of users. The flaw is that the size of messages that each participant sends is proportional to the number of users. The future work is to design a protocol both round and message-efficiency. The future work is to design a protocol both round and message-efficiency.