In this paper we propose a secure protocol for an authenticated key agreement based on the Diffie-Hellman key agreement, which works in an elliptic curve group We prove that our protocol meets the security attributes under the assumption that the elliptic curve discrete logarithm problem is secure

Constantin Popescu

Hrčak - Portal of scientific journals of Croatia

UDe: 007Original scientific paperASECURE KEY AGREEMENT PROTOCOLConstantin PopescuUniversity of Oradea, Department of Mathematics, Oradea, RomaniaE-mail: cpopescu@math.uoradea.roIn this paper we propose asecure protocol for an authenticated key agreement based on the Diffie-He/lman key agreement, which works in an elliptic curve group We prove that our protocol meets thesecurity attributes under the assumption that the elliptic curve discrete logarithm problem is secure.Keywords: authenticated key agreement, protocol, Diffie-Hellman, elliptic curve.1. INTRODUCTIONIn a key agreement protocol two or more distributed entities need to share some key insecret, and this is called a session key. Numerous Diffie-Hellman-based key agreementprotocols have been proposed over the years [1], [5], [Il], [12]. But many of them havetumed out to be flawed [2], [10]. A number of desirable attributes of the key agreementprotocols have also bean identified [19] and nowadays most protocols are analyzed with suchattributes.The authors [8] proposed a new authenticated key agreement protocol, which is resistantto a smaII subgroup attack and to an unknown key-share attack and has some computationaladvantage with about 2.5 integer multiplications for each entity. However, KaIiski showed in[5] that this protocoldoes not possess tine unknown key-share attribute.In this paper, we propose asecure key agreement protocol. The protocol is based on theDiffie-Hellman key agreement [3], and has the desirable attributes discussed in [19]. We willalso present a multiple key agreement protocol which enables the participants to share two ormore keys in one execution of the protocol. The protocols described in this paper have beendescribed in the setting of the group of points on an elliptic curve defined over a finite field.Suitable choices incIude the multipiicative group of a finite field, subgroups Z*n, where n is acomposite integer, and subgroups of Z*q of prime order q. Elliptic curve groups areadvantageous because they offer the same security as other group s but with smaller key sizesand faster computation times.2. A DESCRIPTION OF THE KEY AGREEMENT PROTOCOLMany researchers have examined eIIiptic curve cryptosystems, which were firstIyproposed by MiIIer [13] and Koblitz [6]. The elliptic curve cryptosystems, which are based onthe elliptic curve logarithm over a finite field, have some advantages over other systems: thekey size can be much smaller than the other schemes since only exponential-tune attacks havebeen known so far, if the curve is carefuIIy chosen [7], and the elliptic curve discrete log-27C. Popescu. Asecure key agreement protocolarithms might be still intractable even if faetoring and the multiplieative group discretelogarithm are broken.In this seetion we will describe the proposed key agreement protoeol which is specifiedby the key generation and the protocol description.2.1. Key GenerationIn order to avoid the Pollard-rho [16] and Pohling-Hellman [l5] algorithms for the ellipticcurve discrete logarithm problem, it is necessary that the number of Fq-rational points on E,denoted #E(F q), be divisible by a sufficiently large prime n. To aV9id the reduction algorithmsof Menezes, Okamoto and Vanstone [9] and Frey and Ruck [4], the curve should be non-supersingular (i.e., p should not divide (q+l-#E(Fq))). To avoid the attack of Samaev [17],Smart [18] on Fq- anomalous curves, the curve should not be Fq-anomalous (i.e., #E(F q) t- q).Firstly, we will choose the elliptic curve domain parameters:1. a field size q. where q is a prime power (in praetice, either q=y. an odd prime, or q=Z"].2. two field elements a. b E Fq. whieh define the equation of the elliptic curve E over Fq(i.e., / = x3 + ax + b in the case p> 3), where 4a3 + 27b2 ;ć O.3. two field elements xp and v, in Fq. which define a finite point P = (xp. Xy) of prime orderin E(F q) (P .;t O. where O denotes the point at infinity).4. the order n of the point P.The operation of the key generation is as follows:1. Selects P of order n in the group E(F q).2. Let Hbe a one-way hash function such as SHA-l [14].3. Selects random integers SA, SB from the interval [I, n- I]. The value SA is a secret key ofthe user A and SB is the secret key of the user B.4. Computes the points YA = -SA. P and YB = -SB. P, which are the public key of a user Aand B respectively.5. Let IDA be an identity information of a user A and IDB• can be the identity informationofa user B.2.2 Protocol DescriptionThe key agreement protocol between A and B is as follows:1. A generates random integers rs, kA (ephemeral keys) from the interval [I, n-I] andcomputes QA. VA. points on E, such thatQA =rA.P, VJ.=-kA.P.Asends the point VA to B.2. B randomly selects integers rs. kB (ephemeral keys) from the interval [1, n-I] andcomputes QB, VB. points on E, such thatQB = rB . p. VB = -kB. P.B eomputes e» = H o.: xv,. XVA• IDB• ID,J and de = rs + eske + eBSB.where xQ,. is28Zbornik radova, Volume 25, Number 1(2001)the x-coordinate of QB, xY, is the x-coordinate of VA and xY, is the x-coordinate ofVB. B sends VB, es. de to A.3. A computes the point UB such that. UB = ds . P + en . VB + eB. YB and checks if es = H(Xu, , Xy" Xy" IDB, ID,J. If it does not hold, then A terminates the execution.Otherwise, A computes "eA = H(xQ,' Xy" Xy" IDA, IDB)dA = rA + eAkA + eAsAwhere xu, is the x-coordinate of UB, xY, is the x-coordinate of VB, XQ, is thex-coordinate of QA and xY, is the x-coordinate of VA. A computes the point KA, suchthatKA = -ku . VB.and sends eA, dA to B.4. B computes the point UA, such that UA = dA . P + eA . VA + eA . YA and checks ifeA = H (x; ' Xy , Xy , IDA, IDB). If it does not hold, then B terminates the execution., , ,Otherwise, B computesKB = -kB. VA.The shared secret is the point K = KA = KB.3. THE MULTIPLE KEY AGREEMENT PROTOCOLIn this section we will present a multiple key agreement, protocol which enables theparticipants to share two or more keys in one execution of the protocol. The key generation isthe same as in Section 2. The multiple key agreement protocol between A and B is as follows:1. A generates random integers rs. kAJ' ... , kA, from the interval [1, n - I] and computes thepoints QA, VA" i = 1,... , n, such thatQA = rA . P, VA,Asends the points VA, i = 1, ..., n to B.2. B randomly selects integers rs. kBJ, ... , kB, from the interval [1, n - I] and computesQB, VB, i = 1, ... , n such thatQB = r»: P, VB, = - kB, . P.B computeses =H( xQ ' xY' ... ' Xy ,xY' ... , Xy ,IDB, ID,J• 61 ./1 AI 14"nds = rs + es L kB, + esSB;=129C. Popescu. Asecure key agreement protocolwli!ere XQ• is the x-coordinate of QB, xv., is the x-coordinate of VB, and xv,; is thex-coordinate of VA i = I, ... , n. B sends VB ' i = I, ... , n, ee. de to A., ,3. A cumputes the point UB, such that UB = dB 'P + eB L::I . VB; + es 'YB and checks ifes = H( XU ' Xv , ... , x, ' Xv , ... , Xv ,IDB, ID.J. Ifit does not hold, then A terminates• 'I 'lO AI A,.the execution. Otherwise, A computeseA =H( xQ ' Xv , ... , x, ' Xv , ... , x, ,IDA, IDB)A AL A" B\ 'IIndA = rA + eA L: kA; + eASA;=1where XQ, is the x-coordinate of QA, xv,' is the x-coordinate of VA;, xV, is thex-coordinate of VB" i = I, ... , n. A computes the points KA; , such thatKA; = -kA; . VB;' i = I, ... , n.and sends eA, dA to B.4. B computes the point UA, such that UA = dA . P + eAL:~=I VA, + eA . YA and checks ifeA = H( XU ' Xv , ... , Xv ' Xv , ... , Xv ,IDA, IDB), where Xu is the x-coordinate of DA,A AI A. B\ B" AXv ' is the x-coordinate of VA, XV ' is the x-coordinate of VB' i = I, ... , n. If it does notA • 'i .hold, then B terminates the execution. Otherwise, B computesKB; =-kB;· VA"~ i=l, ...,n.The shared secret keys are the points K; = KA; = K Bi' i = 1, ..., n.4. SECURITY CONSIDERATIONSWe will prove that our protocol meets the following desirable attributes under theassumption that the elliptic curve discrete logarithm problem is secure.Known-Key Security: If the two entities A and B execute the regular protocol run, thenthey cJearly share their unique session key K as above.(Perfect) Forward Secrecy: During the computatiori of the session key Kfor eachentities, the random integers rs. kA, rs. ke still act on ito An adversary who captured theirprivate keys SA or SB should extract the random integers (ephemeral key) rs. kA, rs. kB from theinformation QA, VA, QB, VB to know the previous or next session key between them. But, thisis the elliptic curve discrete logarithm problem.Key-compromise Impersonation: Now, suppose the long-term private key SA of the userA is discJosed. An adversary who knows this value can cJearly impersonate A. Also, theadversary impersonates B to A knowing B'S long-term private key SB. For the personation tosucceed the adversary must know A'S ephemeral keys rs and kA. Also, in this case, theadversary should extract rs and kA from A'S ephemeral public value, QA. and VA., to generatethe same session key K with A. This also is the elliptic curve discrete logarithm problem.Key CODltrol~The key-control is impossible for a third party. The only possibility of akey-control attack may be brought ou by the participation of the protocol B. But for the party30Zbornik radova, Volume 25, Number 1(2001)B to make the party A generate the session key KB which is a preselected by B, for exampleB should solve the equation KB = -ke . VA• This is the elliptic curve discrete logarithmproblem.Unknown Key-Share: Suppose an adversary C tries to make A believe that the sessionkey is shared with B, while B believes that the session key is shared with C. To launch theunk.nown key-share attack, the adversary C should set its public key to be certified eventhough he does not know its correct private key. For this C makes it by utilizing the publicvalues (points) YA, YB and P. Letft (RI, ... , RJ = 2::=1 uR; where R;'s are points on E andt = (tl" ... ,tJ are integers from the interval [I, n - I]. Then C should set his public key Yc asYc =ft(YA" YB, P). Suppose C got the value Yc certified as its public key and let's suppose thefollowing generalized model for an unk.nown key-share attack: Suppose that Vc =h (YA, YB,P, VB) and Vc's = Jm (YA, YB, P, VAJ, where p = (PI, ..., pJ and m = (ml, ... , mi) are integersfrom the interval [I, n - I]. For C to launch the unknown key-share attack successfully, itshould force A and B to share the same secret session key K = KA = KB through the protocolrun. In practice, through the protocol run, A and B get their session key KA and KBrespectively as in the case with those keys in the following equation:KA = -kA. VB, KB = -kB· Vc·The adversary C does not know SA, SB, kA, kB even though C can control the integer valu estj, Pj, mj. The adversary C can force the equation KA = KB to hold for many valu es of kA andk». Now we can consider the following equation as an identical one for the variables kA and kBkA. VB= kB. V~·We can change this equation as the forrn a .P = O, by unfolding the values VA, Yc, Vc, V~with respect to P. Then we are unable to solve equation tj, Pj, mj, since we do not havesufficient inforrnation on SA, SB, kA, ke.5. CONCLUSIONIn this paper we proposed asecure protocol for authenticated key agreement based on theDiffie-Hellman key agreement, which works in an elliptic curve group.One disadvantage is that each participant has to generate two random numbers from theinterval [1, n-I] in one execution. Another disadvantage is that it requires entities slightlymore modular exponentiations or integer multiplications than other protocols (e.g. theprotocol of Law, Menezes, Qu, Solinasand Vanstone [8] or the protocol of Blake-Wilson,Johnson and Menezes [19]). But, we have proven that our protocol meets the securityattributes (inclusive of the attribute of the unk.nown key-share) under the assumption that theelliptic curve discrete logarithm problem is secure.REFERENCES[I] Bellare, M., P. Rogaway (1994). Entity Authentication and Key Distribution. InAdvances in Cryptalogy CRYPTO'93, pp. 341-358.[2] Burmester, M. (1994). On the risk of opening distributed keys. In Advances inCryptology CRYPTO'94, pp. 308-317.31C. Popescu. Asecure key agreement protocol[3] Diffie, W., M. Hellman (1976). New directions in cryptography. IEEE Trans. Inform.Theory, IT 22, No. 6, pp. 644-654.[4] Frey, G., H. Ruck (1998). Aremark conceming m-divisibility and the discrete logarithmin the divisor class group of curves. Mathematics of Computation, Vol. 67, pp. 353-356.[5] Kaliski, B. (1998). Contribution to ANSI X9Fl and IEEE P1363 working groups.[6] Koblitz, N. (1987). Elliptic curve cryptosystems. Mathematics ofComputation, Vol. 98,pp. 203-209.[7] Koblitz, N (1992). CM-Curves with Good Cryptographic Properties. Proceedings ofCrypto'91.[8] Law, L., A. Menezes, M. Qu, J. Solinas, S. Vanstone (1998). An efficient Protocol forAuthenticated Key Agreement. Technical Report CORR98-05, Department of CO,University ofWaterioo.[9] Menezes, A., T. Okamoto, S. Vanstone (1993). Reducing elliptic curve logarithms tologarithms in a finite field. IEEE Transactions on Information Theory, Vol. 39, pp.1639-1646.[10] Menezes, A., P. van Oorschot, S. Vanstone (1997). Handbook of Applied Cryptography.CRC press.[11] Menezes, A., M. Qu, S. Vanstone (1995). Key Agreement and the need forauthentication. PKS'95, Toronto, Canada.[12] Menezes, A., M. Qn, S. Vanstone (1995). Some new key agreement protocols providingmutual implicit authentication. Workshop on Selected Areas in Cryptography (SAC'95),pp.22-32.[13] Miller, V. (1986). Uses of elliptic curves in cryptography. In Advances in Cryptology,Proceedings of Crypto'85, Lecture Notes in Computer Sciences, Springer-Vcriag, pp.417-426.[14] National Institute of Standards and Technology (1995). Secure Hash Standard (SHS).FIPS Publication 180-1, April 1995.[15] Pohling, S., M. Hellman (1978). An improved algorithm for computing logarithms overGF(p) and its cryptographic significance. IEEE Transactions on Information Theory,Vol. 24, pp. 106-110.[16] Pollard, J. (1978). Monte Carlo methods for index computation mod p. Mathematics ofComputation Vol. 32, pp. 918-924.[17] Semaev, I. (1998). Evaluation of discrete logarithms in a group of p-torsion points of anelliptic curve in characteristic p. Mathematics ofComputation, Vol. 67, pp. 353-356.[18] Smart, N. (1997). The discrete logarithms problem on elliptic curves of trace one.Preprint.[19] Wilson, S., D. Johnson, A. Menezes (1997). Key Agreement Protocols and TheirSecurity Analysis. Sixth IMA International Conference on Cryptography and Coding,Cirencester, England.Received: 17 April 2000Accepted: 15 October 200132Zbornik radova, Volume 25, Number 1(2001)Constantin PopescuPROTOKOL ZA USUGLAŠA VANJE SIGURNOSNIH KLJUČEVASažetakU ovom radu radi se o sigurnosnom protokolu za usuglašavanje sigurnosnih ključeva zasnovanom naDiffie-Hellmanovon ključeva. Diffie-Hellmanov sporazum ključeva radi u grupi eliptičkih krivulja. Uradu se dokazuje da uvedeni protokol zadovoljava sigurnosna svojstva, pod uvjetom da je problemdiskretnih logaritama eliptičkih krivulja siguran. .Ključne riječi: usuglašavanje autentifikacijskih ključeva, protokol, Diffie-Hellman, eliptičke krivulje.33

A SECURE KEY AGREEMENT PROTOCOL

Abstract

Similar works

Full text

Available Versions

Hrčak - Portal of scientific journals of Croatia