In this paper, we extend the 2-party key exchange protocol on braid groups to the group key agreement protocol based on the hardness of Ko-Lee problem. We also provide authenticity to the group key agreement protocol

Ho-kyu Lee

Hyang-Sook Lee

Young-ran Lee

HO-KYU LEE

HYANG-SOOK LEE

YOUNG-RAN LEE

Cryptology ePrint Archive

An Authenticated Group Key Agreement Protocol onBraid groupsHO-KYU LEE1, HYANG-SOOK LEE2, YOUNG-RAN LEE3Department of Mathematics, Ewha Womans University, Seoul, Korea1,2,3e-mail : hokyu@dreamwiz.com1, hsl@ewha.ac.kr2, panic@ewha.ac.kr3Abstract. In this paper, we extend the 2-party key exchange protocol on braid groupsto the group key agreement protocol based on the hardness of Ko-Lee problem. We alsoprovide authenticity to the group key agreement protocol.Keywords : braid groups, conjugacy problem, key agrement protocol, authentication1. IntroductionIn 2000, Ko et al. [13] proposed a new public key cryptosystem on braid groupsbased on the hardness of the conjugacy problem. The foundation of this systemis quite different from widely used cryptosystems on number theory, even if thereare some similarities in design. The key exchange scheme on braid groups isbased on the hardness of the Ko-Lee problem which is a Diffie-Hellman versionof the conjugacy problem. There are many group key agreement protocol usingDiffie-Hellman key exchange [2, 3, 7, 14]. The motivation to the common groupshared key is caused by the growing importance of secure group communicationson open network such as distributed simulation, multi-user games, audio/videoconferencing, interactive chat and collaborative applications of all kinds. In thispaper, we propose the group shared key protocol on braid groups based on the12hardness Ko-Lee problem. We also provide the authenticated group key agreementprotocol and show the security properties of the scheme.This paper is organized as follows.In Section 2, we give the background of braid groups and computationally hardproblems regarding the conjugacy. Based on the Ko-Lee assumption, we introducethe 2-party key agreement protocol. In Section 3, we construct the group keyagreement protocol on braid groups based on the hardness Ko-Lee problem andimprove the protocol by authentication. We also prove that the authenticatedprotocol is contributory, perfect forward secret, resistant to known key attacks.2. PreliminariesIn this section, we give the basic definitions of braid groups and discuss some hardproblems on those groups. For more information of braid groups, word problemand conjugacy problem, refer to the papers [1, 4, 5, 8, 9, 10].For each integer n ≥ 2, the n-braid group Bn is the group generated byσ1, σ2, · · · , σn−1 with the relations(i) σiσj = σjσi where | i− j |≥ 2,(ii) σiσi+1σi = σi+1σiσi+1.The integer n is called the braid index and each element of Bn is called ann − braid. An n-braid has the following geometric interpretation: It is a set ofdisjoint n-strands all of which are attached to two horizontal bars at the top andat the bottom such that each strands always heads downward as one walks alongthe strand from the top to the bottom. In this geometric interpretation, eachgenerator σi represents the process of swapping the i-th strand with the next one(with i-th strand going under the (i+1)-th one). Two braids are equivalent if onecan be deformed to the other continuously in the set of braids. Bn is the set ofall equivalence classes of geometric n-braids with a natural group structure. Themultiplication ab of two braids a and b is the braid obtained by positioning a onthe top of b. The identity e is the braid consisting of n straight vertical strandsand the inverse of a is the reflection of a with respect to a horizontal line. So σ−1can be obtained from σ by switching the over-strand and under-strand.3We describe some mathematically hard problems in braid groups. We say thatx and y are conjugate if there is an element a such that y = axa−1. For m < n,Bmcan be considered as a subgroup of Bn generated by σ1, σ2, · · · , σm−1.1. Conjugacy Decision Problem (CDP)Instance : (x, y) ∈ Bn ×Bn such that y = axa−1 for some a ∈ Bn.Objective : Determine whether x and y are conjugate or not.2. Conjugacy Search Problem (CSP)Instance : (x, y) ∈ Bn ×Bn such that y = axa−1 for some a ∈ Bn.Objective : Find b ∈ Bn such that y = bxb−1.3. Generalized Conjugacy Search Problem (GCSP)Instance : (x, y) ∈ Bn ×Bn such that y = axa−1 for some a ∈ Bm,m ≤ n.Objective : Find b ∈ Bm such that y = bxb−1.4. Conjugacy Decomposition Problem (CDP)Instance : (x, y) ∈ Bn ×Bn such that y = axa−1 for some a ∈ Bm,m < n.Objective : Find b1, b2 ∈ Bm such that y = b1xb2.The public key system on braid groups in [13] is based on the generalized con-jugacy search problem. We consider two subgroups LBl and RBr of Bl+r for someappropriate pair of integers (l, r). LBl(resp.RBr) is the subgroup of Bl+r consist-ing of braids made by braiding left l (resp. right r)-strands among l + r strands.LBl is generated by σ1, · · · , σl−1 and RBr is generated by σl+1, · · · , σl+r−1. Forany a ∈ LBl and b ∈ RBr, ab = ba. We choose a sufficiently complicated (l + r)-braid α ∈ Bl+r. Then the following is the one-way function.f : LBl ×Bl+r → Bl+r ×Bl+r, f(a, x) = (axa−1, x).For a given a pair (a, x), it is easy to compute axa−1 but the all the known attacksneed exponential time to compute a from (axa−1, x). This one way function isbased on the difficulty of the generalized conjugacy search problem. The keyagreement scheme is based on the following Ko-Lee problem. The Ko-Lee problemis the Diffie-Hellman type of a generalized conjugacy search problem.5. Ko-Lee Problem (KLP)Instance : The triple (x, y1, y2) of elements in Bl+r such that y1 = axa−1 andy2 = bxb−1 for some hidden a ∈ LBl and b ∈ RBr.4Objective : Find by1b−1(= ay2a−1 = abxa−1b−1). Here, ab = ba for any a ∈ LBland b ∈ RBr.We say that the computational Ko-Lee assumption if no efficient algorithmcan compute the shared key abxb−1a−1. We also say that the decisional Ko-Leeassumption if it is hard to distinguish the shared key abxb−1a−1 from a randomconjugate of x of the form wxw−1. The GCSP and the computational Ko-Leeproblem have no polynomial-time solving algorithm yet. However, it turns out tobe the decisional Ko-Lee assumption is false [12]. Now we introduce the 2-partykey agreement protocol on braid groups [13].Key Agreement Protocol :(i) Preparation step : Suppose A and B want to share a common secret key.An appropriate pair of integers (l, r) and a sufficiently complicated (l + r)-braidα ∈ Bl+r is selected and published.(ii) Key agreement scheme :(a) A chooses a random secret braid r1 ∈ LBl and sends y1 = r1αr1−1 to B.(b) B chooses a random secret braid r2 ∈ RBr and sends y2 = r2αr2−1 to A.(c) A receives y2 and computes the shared key k = r1y2r1−1.(d) B receives y1 and computes the shared key k = r2y1r2−1.Since r1 ∈ LBl and r2 ∈ RBr, r1r2 = r2r1. This implies k = r1y2r1−1 = r2y1r2−1.Therefore A and B obtain the common secret k.The security of this protocol is based on the hardness of Ko-Lee problem. Theshared secret key k must be derived by applying a suitable key derivation functionto the quantity r1r2αr−12 r−11 . For otherwise, an attacker might be able to getpartial information about common secret keys even if KLP is hard.3. Authenticated group key agreement on braid groupsOur interest is to design the authenticated key agreement protocol on braid groups.This protocol requires the following desirable properties.¦ Perfect Forward Secrecy (PFS)¦ Resistance to Known-Key Attacks¦ Key Authentication¦ Key Confirmation and Key Integrity5All of these are necessary to achieve resistance to active adversaries where anadversary additionally subverts the communications by injecting, deleting, alter-ing or replaying messages. We give some definitions and terminology regardingauthenticated key agreement protocol.A key agreement protocol is a key establishment technique whereby a sharedsecret key is derived by two(or more) parties as a function of information con-tributed, or associated with, each of these, such that no party can predeterminethe resulting value. A key agreement protocol is contributory if each party equallycontributes to the key and guarantees its freshness. Let A and B be two honestparties i.e. legitimate who execute the steps of a protocol correctly. A key agree-ment protocol is said to provide implicit key authentication(of B to A) if the partyA is assured that no other party aside from a specially identified second party Bcan possibly learn the value of a particular secret key. A protocol provides keyconfirmation if a party is assured that its peer(or a group thereof) actually haspossession or a particular secret key. A contributory key agreement protocol pro-vides key integrity if a party is assured that its particular secret key is a functionof only the individual contributions of all protocol parties. In particular, extrane-ous contribution(s) to the group key cannot be tolerated even if it does not affordthe attacker(s) with any additional knowledge. A key agreement protocol whichprovides implicit key authentication to both participating parties is called an au-thenticated key agreement protocol (A-KA). A protocol is said to have perfectforward secrecy if compromise of long-term keys does not compromise past sessionkeys. A protocol is said to be vulnerable to known-key attack if compromise ofpast session keys allows either a passive adversary to compromise future sessionkeys, or an active adversary to impersonate one of the protocol parties.3.1. Group key agreement protocolIn this subsection we construct the group key agreement(GKA) protocol on braidgroups by extending the 2-party key agreement.The following notation is used in this section.n : number of group membersi, j : index of group members6Mi : i-the group memberBl : l-th braid groupα : sufficiently complicated l-braidxi : long-term secret key of Mi in Bliri : random secret key of Mi in Bliki,j : long-term common secret key shared by Mi and Mj for i 6= jSn : group key shared by all n-membersSn(Mi) : Mi’s view on a group keyWe consider n subgroups Bl1 , Bl2 , · · · , Bln of l-braid group Bl where l = l1 +l2 + · · ·+ ln for some appropriate integers l1, l2, · · · , ln. Each Bli is the subgroup ofBl consisting of braids made by braiding li-strands from the left among l-strandswith the order l1, l2, · · · , ln. Thus each Bli is generated by< σPi−1j=0 lj+1, σPi−1j=0 lj+2, · · · , σPij=0 lj−2, σPij=0 lj−1 >where i = 1, 2, · · · , n and l0 = 0 by convention. For any rm ∈ Blm and rn ∈ Blnwith m 6= n, rmrn = rnrm. Let α ∈ Bl be a sufficiently complicated l-braid.We suppose {Mi|i = 1, · · · , n} is the set of members wishing to share a key. Weconstruct a shared group key by performing the following steps.GKA Protocol on Braid groupsRound i, (i = 1, 2, · · · , n− 1)(i) Mi selects a random ri ∈ Bli .(ii) Mi −→ Mi+1 : {ri · · · r̂j · · · r1αr−11 · · · r̂−1j · · · r−1i | j = 1, 2, · · · , i} andriri−1 · · · r1αr−11 · · · r−1i−1r−1i , where r̂j means that rj does not appear.Round n(i) Mn selects a random rn ∈ Bln .(ii) Mn computes rn · · · r̂i · · · r1αr−11 · · · r̂−1i · · · r−1n for each i = 1, · · · , n− 1.Mn −→ Mi for all i = 1, · · · , n− 1 : rn · · · r̂i · · · r1αr−11 · · · r̂−1i · · · r−1n .Then each participant Mi obtains the shared key by computingSn(Mi) = ri(rn · · · r̂i · · · r1αr−11 · · · r̂−1i · · · r−1n )r−1i= rn · · · ri+1riri−1 · · · r1αr−11 · · · r−1i−1r−1i r−1i+1 · · · r−1n .7Mn also computes the shared keySn(Mn) = rn(rn−1 · · · r1αr−11 · · · r−1n−1)r−1n . ¤Our protocols are based on distributively computing a subset of {SαS−1|S ⊂{r1, · · · rn}}. From rn · · · r̂i · · · r1αr−11 · · · r̂i−1· · · r−1n , each member Mi can easilycomputes the shared key Sn = rn · · · r1αr−11 · · · r−1n .3.2. Authenticated group key agreement protocolIn this subsection, we construct the authenticated group key agreement(A-GKA)protocol on braid groups.A-GKA Protocol on Braid groupsInitialization : Let α be a sufficiently complicated l-braid in Bl and M1, · · · , Mnbe n participants wishing to share a key. Each Mi chooses a secret xi ∈ Bli andcomputes xiαx−1i . Let {(xi, xiαx−1i )|i = 1, · · · , n} be the set of long-term secretand public keys of M ′is. Thus (l1, · · · , ln, α, x1αx−11 , · · · , xnαx−1n ) are the publicvalues of the system.Round i, (i = 1, 2, · · · , n− 1)(i) Mi selects a random ri ∈ Bli .(ii) Mi −→ Mi+1 : {ri · · · r̂j · · · r1αr−11 · · · r̂−1j · · · r−1i | j = 1, 2, · · · , i} andriri−1 · · · r1αr−11 · · · r−1i−1r−1i .Round n(i) Mn selects a random rn ∈ Bln and Mn computes kin = xnxiαx−1i x−1n for eachi = 1, · · · , n− 1.(ii) Mn −→ Mi for all i = 1, · · · , n−1 : σi = kinrn · · · r̂i · · · r1αr−11 · · · r̂−1i · · · r−1n k−1in .When each Mi receives σi, compute kin and Sn(Mi) = rik−1in σikinr−1i . Thereforethe shared key for all Mi isSn(Mi) = rik−1in σikinr−1i= rirn · · · r̂i · · · r1αr−11 · · · r̂−1i · · · r−1n r−1i= rn · · · ri · · · r1αr−11 · · · r−1i · · · r−1n .Also Mn computes the shared keySn(Mn) = rn(rn−1 · · · r1αr−11 · · · r−1n−1)r−1n . ¤8THEOREM 3.1. A-GKA is a contributory authenticated key agreement protocol.Proof. From the construction of the above protocol, it is evident that theprotocol is contributory. Let C be an active adversary who can modify, delay orinject messages. The goal of the adversary is to share a key with either Mi fori ∈ {1, . . . , n− 1} or Mn by masquerading as some Mi.Attack on Mn : Let Sn(Mn) be the key computed by Mn and Sn(Mn) =rncnαc−1n r−1n where cn is possibly known to C and cnrn = rncn. Computingrncnαc−1n r−1n requires C to compute rnαr−1n . But the only expression containingrnαr−1n is σi = kin(cnri)rnαr−1n (cnri)k−1in . Hence it is intractable to compute rnαr−1nwithout the knowledge of kin for any i = 1, · · · , n− 1.Attack on Mi for some i : Let Sn(Mi) be the key computed by Mi and Sn(Mi) =rik−1in ciαc−1i kinr−1i where ci is possibly known to C. First, suppose ci = kinc̄i wherec̄i is polynomially independent of kin and known to C. ThenSn(Mi) = rik−1in (kinc̄iαc̄i−1k−1in )kinr−1i = ric̄iαc̄i−1r−1i .However computing kinc̄iαc̄i−1k−1in is intractable without the knowledge of kin.Therefore it is difficult to compute Sn(Mi). Next, we assume ci is polynomiallyindependent of kin. Then rik−1in ciαci−1kinr−1i is still a function of k−1in and kin,hence computing Sn(Mi) is intractable by C. ¤THEOREM 3.2. A-GKA protocol provides perfect forward security.Proof. Suppose that all long term keys {kin | i = 1, . . . , n−1} are compromised.Then the adversary is able to compute a subset of {SαS−1 | S ⊂ {r1, r2, · · · , rn}}where SαS−1 means rik · · · ri1αr−1i1 · · · r−1ik for S = {ri1 , · · · , rik}. However, by thedirect extension of 2-party key exchange scheme, it is intractable to find the groupkey for the given set {SαS−1 | S ⊂ {r1, r2, · · · , rn}}. ¤THEOREM 3.3. A-GKA is resistant to the known key attacks.Proof. The protocol A-GKA is resistant to passive known-key attacks since thesession keys do not contain any information of long-term keys. Let Sn(Mi) be thesession key computed by each Mi, Sn(Mi) = rikinciαc−1i k−1in r−1i for i = 1, · · · , n−1and Sn(Mn) = rncnαc−1n r−1n where each ci is a quantity possibly known to theadversary C. C also knows a subset of {SαS−1|S ⊂ {r1, · · · , rn}}. Using theseinformation, it is difficult to find kinαk−1in or k−1in αkin. Therefore it is resistant tothe active known-key attacks. ¤9References1. E. Artin, Theory of braids, Annals of Math. 48 (1947), 101-126.2. G. Atenies, M. Steiner, G. Tsudik. Authenticated group key agreement andfriends, ACM Conference on Computer and Communications Security, 1998.3. C. Becker and U. Willie, communication complexity of group key distribution,ACM conference on Computer and Communication Society, 1998.4. J. S. Birman, Braids, links and mapping class groups, Annals of Math. Study,no. 82, Princeton University Press(1974).5. J. S. Birman, K. H. Ko and S. J. Lee, A new approach to the word and conjugacyproblems in the braid groups, Advances in Math. 139 (1998), 322-353.6. D. Boneh and A. Silverberg, Applications of Multi-linear forms to Cryptogra-phy, http://eprint.iacr.org,2002.7. M. Burmester and Y. Desmedt. A Secure and Efficient Conference key Distri-bution System, Advances in Cryptology-Eurocrypto’94, LNCS, Springer Verlag,275-286, 1995.8. W. Diffie and M. Hellman. New direction In Cryptography, IEEE Transactionson Information Theory, IT-22(6):644-654, 1976.9. E. A. Elrifai and H. R. Morton, Algotithms for positive braids, Quart. J. Math.Oxford 45 (1994), no. 2, 479-497.10. D. Epstein, J. Cannon, D. Holt, S. Levy, M. Pasterson and W. Thurston,Word processing in groups, Jones & Bartlett, 1992.11. F. A. Garside, The braid group and other groups, Quart. J. Math. Oxford 20(1969), no. 78, 235-254.12. R. Gennaro and D. Micciancio, cryptanalysis of a pseudorandom generatorbased on braid groups, Euro Crypto’2002, LNCS , pp 1-13, Springer 2002.13. K. Ko, S. Lee, J. Cheon, J. Han, J. kang C. Park. New public key cryptosystemusing braid groups, Crypto’2000, LNCS 1880, pp.166-183, Springer 2000.14. M. Stein, G. Tsudik, M. Waidner. Diffie Hellman Key Distribution Extendedto Group Communication, ACM conference on computer and communication se-curity, 1996.

An Authenticated Group Key Agreement Protocol on Braid groups

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive