Sebery J.Cryptography.An introduction to computer security.1989

2.H ! LEAF : A; [T; r; h1(passwd)]KLEAF , where r is a nonce and T is a timestamp.

3.LEAFCDC ! CDC : A.

{retrieves the record for A,

{chooses a fresh key k,

{uses a private-key encryption to create ffkAgh2(passwdA); h1(passwdA)gk,

{encrypts k using KLEAF for con dentiality.

4.CDC ! LEAF : ffkAgh2(passwdA); h1(passwdA)gk; [k]KLEAF . LEAF now proceeds as follows:

{LEAF retrieves the key k from [k]KLEAF ,

{Extracts fkAgh2(passwdA) and h1(passwdA),

{Veri es whether h1(passwd) = h1(passwdA),

{Aborts A's login attempt if the two passwords are di erent.

5.LEAF ! H : ffkAgh2(passwdA)gr. The host H

{decrypts the message using the key (nonce) r,

{recovers the secret key kA,

{generates a pair of RSA delegation keys (d; e),

{ creates a ticket tickA = hL; A; dikA (a certi cate of d). 6. H ! CDC : A.

7. CDC ! H : hCA; KCAikA

Now A can run a client program C that may wish to establish a secure channel (a secret key) to a server S. It is assumed that the client C has already completed a successful run of the credential initialization protocol.

SPX client-server authentication protocol

Goals: To distribute of a fresh session key k to a client C and the server S for use in a private-key cryptosystem.

Assumptions: The CA of the client C keeps C's public key KC. The client C holds a ticket tickC = hL; C; dikC . The client knows the valid public key of its CA, i.e. KCAC , and the server knows the valid public key of its CA, i.e.

KCAS .

Message Sequence: 1. C ! CDC : S.

CDC retrieves the public-key certi cate of KS.

39211 KEY ESTABLISHMENT PROTOCOLS

2.CDC ! C : hS; KSikCAC . The client C

{recovers the public key KS of S from the certi cate using the public key KCAC ,

{generates a fresh session key k to be shared with S,

{encrypts the session key using the public key KS of the server,

{encrypts the delegation key e using the session key,

3.C ! S : C; [k]KS ; tickC = hL; C; dikC ; fegk.

4.S ! CDC : C.

5.CDC ! S : hC; KCikCAS . The server S

{retrieves the key k from [k]KS using its private key kS,

{recovers e from fegk,

{gets the public key KC from the certi cate hC; KCikCAS ,

{extracts L; C; d from the ticket tickC using the public key KC ,

{ checks whether e and d form a valid pair of delegation keys (i.e. for a random number , ( e)d using the RSA system or alternatively, checking e d 1 (mod '(N))).

6. S ! C : fT + 1gk.

11.3.3 Other Authentication Services

SELANE (SEcure Local Area Network Environment) was developed at the European Institute for System Security (EISS) in Karlsruhe, Germany as an authentication service for distributed systems [18, 216]. Security operations are based on modular exponentiation. In particular, signature scheme is based on on the ElGamal scheme. Trusted authorities called SKIAs (Secure Key Issuing Authorities) supply certi cates that are used by principals to establish a common secret session key. The key can be later used to ensure con dentiality or authentication.

The RHODOS distributed operating system incorporates a number of authentication services that allow us to verify user passwords at the login stage (similar to the Kerberos credential initialization protocol). One-way (unilateral) and two-way (mutual) authentication of principals is also provided [520].

KryptoKnight or network security program (NetSP) is an authentication service designed in IBM. Protocols in KryptoKnight make an extensive use

of collision free hash functions and MACs to provide authentication channels [37, 38, 39].

Some other authentication systems are the SESAME project (a secure European system for applications in a multivendor environment), the Open Software Foundation's (OSF) distributed computing environment [395], and Kuperee [231, 232].

11.4 Key Agreement Protocols

The basic DiÆe-Hellman (DH) key agreement protocol was discussed in Section 11.2. The protocol provides no entity authentication. This problem is partiallyxed in a modi cation of the DH protocol due to ElGamal [164]. It is assumed that there is a trusted authority T A, which keeps authentic (certi ed) public keys of principals. A principal P generates its secret 2 Zp 1 and deposits its public key g mod p with T A, where p is a large enough prime and g is a primitive element g

ElGamal key agreement protocol

Goal: Agreement of A and B on a secret key k.

Assumptions: T A keeps a certi ed public key of B. The modulus p is a large enough prime and a primitive element g 2 Zp . Both integers p and g are public.

Message Sequence: A collects an authentic copy of B's public key (g ) from

T A, generates a random integer 2R Zp 1 and sends 1. A ! B : g mod p.

A calculates the secret key k (g ) mod p and B derives k (g ) mod p.

The protocol takes a single pass and both A and B can establish the common secret key. A knows that the key can be shared with B only, so the protocol ensures implicit key authentication of B. There is no provision for key con r- mation. A can be sure of key freshness as long as A selected a fresh . On the other side, B derives a key but B does not know with whom it is shared.

The ElGamal protocol can be upgraded to a protocol where both A and B obtain their corresponding certi ed public keys from T A. This protocol involves no exchange of message between A and B at all and is called the DH key predistribution. It provides mutual implicit key authentication. There is no

394 11 KEY ESTABLISHMENT PROTOCOLS

entity authentication or key con rmation as there is no interaction between A and B.

11.4.1 MTI Protocols

Matsumoto, Takashima, and Imai designed a family of key agreement protocols [325]. Their main idea is to use the DH predistribution protocol with two passes.

MTI protocol (version A0)

Goal: Agreement of A and B on a fresh secret key k.

Assumptions: T A keeps certi ed public keys KA g mod p and KB g mod p of A and B, respectively. The modulus p is a large enough prime and a primitive element g 2 Zp . Both integers p and g are public.

Message Sequence: A selects a random integer a 2R Zp 1. 1. A ! B : ga mod p.

B chooses its own random integer b 2R Zp 1. 2. B ! A : gb mod p.

A can compute a common secret key k KBa gb mod p:

B can compute the same key k KAb (ga) mod p:

The protocol provides mutual implicit key authentication and key freshness. There is no provision for entity authentication or key con rmation. Readers interested in other versions of MTI protocols are referred to the original paper [325].

11.4.2 Station to Station Protocol

The station to station (STS) protocol was designed by DiÆe, Van Oorschot, and Wiener [154]. The protocol combines the basic DiÆe-Hellman protocol with certi cates. Recall that a certi cate hmikA denotes message m signed using the secret key of A. Anyone who knows the matching public key KA can read the message m.

STS protocol

Goals: 1. Agreement of A and B on a fresh secret key k. 2. Mutual entity authentication.

3. Explicit key authentication.

Assumptions: T A keeps certi ed public keys KA and KB of A and B, respec-

tively. The modulus p is a large enough prime and g 2 Z is a primitive

p

element. Both integers p and g are public. H denotes a public one-way hash algorithm.

Message Sequence: A collects a certi ed copy of B's public key KB from T A, generates a random integer 2R Zp 1. B collects a certi ed copy of A's

key k.

3.A ! B : fhH(g ; g )ikA gk.

B veri es the hash values in similar way.

The protocol also provides forward secrecy as if the long term keys kA and kB are compromised, then the past session keys are une ected. This is due to the fact that the long-term keys are used for authentication but not for con dentiality.

The protocol can be simpli ed by dropping hashing at the expense of eÆciency [497]. Some other variants are discussed in [154]. In some de nitions of entity authentication, there is an attack that can be prevented by inclusion of the recipient identity in the signature (see [306]).

11.4.3 Protocols with Self-Certi ed Public Keys

Girault [203] suggested a family of key agreement protocols using so-called selfcerti ed public keys. Let a trusted authority T A set up an RSA cryptosystem with the public modulus N = p q (p and q are strong primes). An integer g generates the multiplicative group ZN . T A generates a pair of keys (kT A; KT A).

396 11 KEY ESTABLISHMENT PROTOCOLS

Any principal is assumed to possess its identifying string. For instance, the identifying string IDA is A's name and address. The principal A selects its secret key kA and computes the public key KA g kA mod N. The public integer g kA and IDA are communicated to T A via an authentication channel. T A computes A's public key certi cate

A g kA IDA kT A

Anyone who knows the public key KT A, IDA and A's certi cate A can compute the public key of A as

KA AKT A + IDA (mod N)

Key predistribution with self-certi ed keys

Goal: Agreement of A and B on a secret key k.

Assumptions: T A applies an RSA cryptosystem with public modulus N and a primitive element g 2 ZN . T A keeps public key certi cates A and B of A and B, respectively. Both A and B hold their pairs of keys (kA; KA) and (kB; KB), respectively.

Message Sequence: A and B independently compute the common secret key. A calculates

k BKT A + IDB kA mod N and B computes

k AKT A + IDA kB mod N:

This protocol needs no interaction between principals A and B. It provides mutual implicit key authentication but not key freshness.

Two pass protocol with self-certi ed keys

Goal: Agreement of A and B on a fresh secret key k.

Assumptions: T A applies an RSA cryptosystem with public modulus N and a primitive element g 2 ZN . T A keeps public key certi cates A and B of A and B, respectively. Both A and B hold their pairs of keys (kA; KA) and (kB; KB), respectively.

Message Sequence: A selects at random integer < N.

11.4 Key Agreement Protocols 397

1. A ! B : g mod N.

B chooses its own random integer < N. 2. B ! A : g mod N.

A calculates

+ IDB kA mod N

k (g ) AKT A + IDA kB mod N:

The protocol provides mutual implicit key authentication as well as key freshness.

11.4.4 Identity-Based Protocols

G•unter [225] proposes identity-based protocols in which a trusted authority T A is assumed to set up all the required parameters. All secret elements are generated by T A and communicated to the corresponding principals via con - dentiality channels.

During the setup phase, T A selects a large enough prime modulus p and a generator g of Zp (p and g are public). It chooses a secret key kT A and computes its public key KT A gkT A mod p. For each principal A, T A assigns a unique identity IDA, generates a random integer rA (gcd (rA; p 1) = 1), and calculates A's certi cate A grA mod p. Next T A nds a value kA satisfying the following congruence:

H(IDA) A kT A + rA kA (mod p 1);

where H is a collision-free one-way hash function. The pair ( A; kA) is sent via a con dentiality channel to A. The certi cate A is made public, whereas kA serves as the secret key of A. Further the public key of A is AkA grAkA mod p.

Anyone can reconstruct A's public key from the public information. First note that kA (H(IDA) A kT A)rA1 mod (p 1), which implies that

gH(IDA) KT AA mod p

Identity-based key agreement protocol

Goal: Agreement of A and B on a fresh secret key k.

398 11 KEY ESTABLISHMENT PROTOCOLS

Assumptions: T A publishes the prime modulus p, a generator g of Zp and its public key KT A. Any principal A with identity IDA holds its secret key kA and public certi cate A.

Message Sequence: A starts the protocol. 1. A ! B : IDA; A.

B chooses a random integer . 2. B ! A : IDB; B ;( A) mod p.

A selects its fresh integer . 3. A ! B : ( B) mod p.

A calculates

k ( A)kA ( BkB ) mod p and similarly B computes

k ( AkA ) ( B)kB mod p:

The protocol guarantees mutual implicit key authentication and key freshness. Other variants of the protocols are discussed in [338, 439].

11.5 Conference Key Establishment Protocols

In multiuser cryptography, there are more than two principals who may need to establish a common secret key. Conference key establishment is an umbrella name for these applications. Burmester and Desmedt [70] describe several conference key distribution protocols. Assume that there are n principals P1; : : : ; Pn who wish to establish a common secret key. The principal P1 plays the role of a trusted authority and after an initial interaction with the rest of the principals, creates a fresh key and distributes it among them.

Star based protocol

Goal: Distribution of a (fresh) secret key among n principals P1; : : : ; Pn. Assumptions: There is a public prime modulus p and a generator g of

monly known to all principals. P1 is a trusted authority.

Message Sequence: Each Pi selects a random integer ri 2R Zp 1 and computes zi = gri mod p for i = 1; : : : ; n.

1. P1 ! Pi : z1 for i = 2; : : : ; n.

Each principal computes its secret key ki z1ri mod p and nds k ki 1 mod p; i = 2; : : : ; n.

The next protocol needs no trusted principal.

Broadcast protocol

Goal: Agreement on a (fresh) secret key by n principals P1; : : : ; Pn. Assumptions: There is a public prime modulus p and a generator g of Zp agreed

to be used by all principals.

Each principal Pi computes the secret key

k zinri1 xni 1 xni+12 xi 2 mod p:

Note that Pi ! ? means that principal Pi uses a broadcast channel.

Chen and Hwang [93] proposed an identity-based conference key distribution using a broadcast channel. As in the identity based setting, a trusted authority T A generates all secrets for all principals. T A uses the RSA system with modulus N = p1p2p3p4 where pi are distinct strong primes for i = 1; 2; 3;4. It has a pair (e; d) of secret and public keys, respectively. Clearly,

e d 1 (mod lcm(p1 1; p2 1; p3 1; p4 1))

T A publishes K g d mod N where g is a generator of ZN . Further, T A computes a secret key ki for principal Pi according to the congruence:

gki IDi2 mod N

using CRT, where IDi is identity of principal Pi; i = 1; : : : n. The secret key ki is communicated to Pi via a con dentiality channel. One principal from the

400 11 KEY ESTABLISHMENT PROTOCOLS

group plays the role of a chair who generates a fresh conference key. Let this principal be P1.

Identity-based conference key distribution protocol

Goal: Distribution of a (fresh) secret key among n principals.

Assumptions: T A sets up an RSA cryptosystem. The modulus N, the key e, a primitive element g 2 ZN , K g d mod N, and a one-way hashing function H are public. The key d and factorization of N are secret. Each principal Pi has its secret key ki; i = 1; : : : ; n. Anybody knows the identity IDi of principal Pi. P1 is trusted.

greki mod N

and recovers the conference key k p( 1;i) IDi mod N:

Other conference key distribution protocols were also investigated, see [255] and [288].