基于身份的可认证非对称群组密钥协商协议

非对称群组密钥协商协议(asymmetric group key agreement, AGKA)能使群组内部成员安全地传递信息.随着大规模分布式网络协同计算的发展,参加安全协同计算的成员可能来自于不同领域、不同时区、不同云端及不同类型的网络.现有的AGKA不能满足来自于跨域及异构网络之间群组成员的安全信息交换,且安全性仅局限于抗被动攻击.提出一种基于身份的可认证非对称群组密钥协商协议(identity-based authenticated asymmetric group key agreement, IB-AAGKA),该协议实现一轮非对称群组密钥协商,解决群组成员因时区差异而不能保持多轮在线密钥协商的问题;可实现匿名性与可认证性;支持节点的动态群组密钥更新,实现了群组密钥向前保密与向后保密安全性.在decisional bilinear Diffie-Hellman(DBDH)困难假设下,证明了协议的安全性,并分析了协议的性能.     

Certificateless and identity-based authenticated asymmetric group key agreement

Group key agreement (GKA) is one of the traditional ways to guarantee the subsequent secure group communications. However, conventional GKA protocols face two limitations, i.e., they require two or more rounds to establish secure channels and are sender restricted. Asymmetric group key agreement (AGKA) eliminates above two limitations of GKA. It allows a group of users to establish a public group encryption key and a different secret decryption key of each group member in one round. Any user who knows the group encryption key can encrypt to the group members. This paper studies authenticated AGKA in certificateless and identity-based public key cryptosystems. We formalize the security model of certificateless authenticated asymmetric group key agreement and realize a one-round certificateless authenticated asymmetric group key agreement protocol to resist active attacks in the real world. We also investigate the relation between certificateless authenticated AGKA and identity-based authenticated AGKA. We propose a concrete conversion from certificateless authenticated AGKA to session key escrow-free identity-based authenticated AGKA.     

Authenticated asymmetric group key agreement based on certificateless cryptosystem

A recent primitive known as asymmetric group key agreement (AGKA) allows a group of users to negotiate a common encryption key which is accessible to any entities and corresponds to different decryption keys, each of which is only computable by one group member. This concept makes it easy to construct distributed and one-round group key agreement protocols. However, this existing instantiation depends on public key infrastructure (PKI) associated with certificate management, or it is only secure against passive adversaries. This paper addresses this concern by designing a certificateless authenticated AGKA scheme, which does not require certificates to guarantee the authenticity of public keys yet avoids the inherent escrow problem of identity-based cryptosystems. Using simple binding techniques, the proposed scheme can be raised to the same trust level as that using the traditional PKI. We show that the proposed protocol is secure provided that the underlying k-bilinear Diffie–Hellman exponent problem is hard.     

Provably secure identity-based authenticated key agreement protocols with malicious private key generators

Identity-based authenticated key agreement is a useful cryptographic primitive and has received a lot of attention. The security of an identity-based system relies on a trusted private key generator (PKG) that generates private keys for users. Unfortunately, the assumption of a trusted PKG (or a curious-but-honest PKG) is considered to be too strong in some situations. Therefore, achieving security without such an assumption has been considered in many cryptographic protocols. As a PKG knows the private keys of its users, man-in-the-middle attacks (MIMAs) from a malicious PKG is considered as the strongest attack against a key agreement protocol. Although securing a key agreement process against such attacks is desirable, all existent identity-based key agreement protocols are not secure under such attacks. In this paper, we, for the first time, propose an identity-based authenticated key agreement protocol resisting MIMAs from malicious PKGs that form a tree, which is a commonly used PKG structure for distributing the power of PKGs. Users are registered at a PKG in the tree and each holds a private key generated with all master keys of associated PKGs. This structure is much more efficient, in comparison with other existing schemes such as threshold-based schemes where a user has to register with all PKGs. We present our idea in two protocols. The first protocol is not secure against MIMAs from some kinds of malicious PKGs but holds all other desirable security properties. The second protocol is fully secure against MIMAs. We provide a complete security proof to our protocols.     

基于身份的认证群密钥协商协议

认证群密钥协商(AGKA)协议能为一群用户产生一个共享的会话密钥,使得群用户间能在公共数据网络进行安全通信.现有的大部分基于公钥技术的AGKAY协议分两类:第一类,认证部分是基于PKI/CA,会话密钥协商部分主要用模指数(或点乘)实现;第二类,认证部分是基于身份(ID)的公钥体制,会话密钥协商部分主要是用Weil对或Tate对实现.第一类AGKA协议存在一个较显著问题:公钥管理问题;第二类AGKA协议虽然有效地解决了公钥管理问题,但由于其会话密钥协商部分主要是用双线性对(即Weil对或Tate对)实现,与前者相比,计算量较大.针对这些不足,提出了一个新的AGKA协议,其认证部分是基于身份(ID)的公钥体制,会话密钥协商部分的运算主要用模指数实现;并在ROM,ECDH和BDH假设下证明了该AGKA协议的安全性.该协议与基于PKI/CA的相关AGKA协议相比,克服了后者在密钥管理上的困难;与其它基于身份的AGKA协议相比,在效率上具有一定的优势.     

可信计算环境下基于TPM的认证密钥协商协议

基于身份的认证密钥协商协议存在密钥托管、ID管理、ID唯一性和私钥的安全分发等问题,目前的可信计算技术为此提供了很好的解决方案。利用TPM平台中EK和tpmproof唯一性的特点,结合McCullagh-Barreto认证密钥协商协议思想,提出了一个在可信计算环境下基于TPM的认证密钥协商协议,该协议较好地解决了上述基于身份的密钥协商协议所存在的问题。用CK模型对所提协议进行了安全性分析,结果表明该协议具备已知密钥安全性,完善前向保密性及密钥泄露安全性等CK安全模型下相应的安全属性。     

基于无证书密码学的可认证三方密钥协商协议

为了使密钥协商协议能够抵抗主动攻击,提出了一个可认证的无证书三方密钥协商协议。首先分析现有密钥协商协议的特点,然后以无证书密码学理论为基础设计一个安全的三方密钥协商协议。该协议只需要一轮消息交换就可以建立起安全的三方会话密钥,有效地克服了密钥托管问题,提供完善的前向安全性。通过性能分析表明,该协议具有较高的安全性和运行效率。     

SE-AKA: A secure and efficient group authentication and key agreement protocol for LTE networks

To support Evolved Packet System (EPS) in the Long Term Evolution (LTE) networks, the 3rd Generation Partnership Project (3GPP) has proposed an authentication and key agreement (AKA) protocol, named EPS-AKA, which has become an emerging standard for fourth-generation (4G) wireless communications. However, due to the requirement of backward compatibility, EPS-AKA inevitably inherits some defects of its predecessor UMTS-AKA protocol that cannot resist several frequent attacks, i.e., redirection attack, man-in-the-middle attack, and DoS attack. Meanwhile, there are additional security issues associated with the EPS-AKA protocol, i.e., the lack of privacy-preservation and key forward/backward secrecy (KFS/KBS). In addition, there are new challenges with the emergence of group-based communication scenarios in authentication. In this paper, we propose a secure and efficient AKA protocol, called SE-AKA, which can fit in with all of the group authentication scenarios in the LTE networks. Specifically, SE-AKA uses Elliptic Curve Diffie-Hellman (ECDH) to realize KFS/KBS, and it also adopts an asymmetric key cryptosystem to protect users’ privacy. For group authentication, it simplifies the whole authentication procedure by computing a group temporary key (GTK). Compared with other authentication protocols, SE-AKA cannot only provide strong security including privacy-preservation and KFS/KBS, but also provide a group authentication mechanism which can effectively authenticate group devices. Extensive security analysis and formal verification by using proverif have shown that the proposed SE-AKA is secure against various malicious attacks. In addition, elaborate performance evaluations in terms of communication, computational and storage overhead also demonstrates that SE-AKA is more efficient than those existing protocols.     

一种基于身份的可认证群组密钥协商方案

提出了一种基于身份的可认证群组密钥协商方案ASTR,把日前通信开销最小的方案STR与基于身份的密码技术结合起来,不仅保持了STR在性能方面的优势,而且提供了隐含密钥认证和完善前向保密等安全属性,弥补了STR不能抵抗主动攻击的不足。     

完美前向安全的基于身份认证密钥协商方案

现有的基于身份的一轮认证密钥协商方案没能实现强的完美前向性.采用强不可伪造的签名算法对临时公钥进行签名,提出一种改进的基于身份认证密钥协商方案.首先,对Boneh和Boyen提出的强不可伪造的短签名方案进行改造,提出一种强不可伪造的基于身份签名方案;然后,将新签名方案与Ni等人提出的eCK安全的基于身份一轮认证密钥协商方案相结合,提出新的密钥协商方案.进一步,为了实现新方案的可证明安全性,在对比分析eCK-PFS模型和eCK模型的基础上,融合现有安全模型,定义了基于身份认证密钥协商方案分析的强安全模型ID-eCK-PFS.在ID-eCK-PFS模型下,通过安全性规约,证明了新提出的基于身份认证密钥协商方案实现了强安全性,包括抗密钥泄露伪装、抗临时秘密泄露和完美前向安全性等.     

一类可抵抗恶意攻击的隐私集合交集协议

针对安全两方计算中隐私集合交集计算问题,提出了一种改进的基于Bloom Filter数据结构的隐私集合交集协议。该协议能够保证双方在各自隐私安全的前提下,计算出两者数据集合的交集,其中只有一方能够计算出交集元素,另外一方无法计算得到交集,并且双方都不能获得或推测出对方除交集以外的任何集合元素,确保了参与双方敏感信息的安全保密。所提协议引入了基于身份的密钥协商协议,能够抵抗非法用户的恶意攻击,达到隐私保护和安全防御的目的,抵御了密钥泄露的风险,减少了加解密的运算量,并且具备支持较大规模集合数据的运算能力。     

基于身份加密的可认证密钥协商协议

密钥协商是安全通信的重要环节,通过密钥协商协议可在通信节点之间建立共享会话密钥,以便实现网络中的安全通信。在物联网环境下,文章提出的密钥协商协议是在基于身份的可认证密钥协商基础上的无双线性对的可认证密钥协商协议。该协议主要包括3个部分：初始化、参数提取和密钥协商。与利用双线性对的密钥协商协议相比,该协议不仅提供了相同层次的安全性与可扩展性,且在能量开销、时间开销和计算复杂度方面具有明显的优势。     

基于无证书的两方认证密钥协商协议

两方认证密钥协商协议的设计主要基于传统公钥密码体制和基于身份的公钥密码体制.基于无证书的认证密钥协商方案避免了基于传统公钥证书方案存在的身份管理复杂性,同时也消除了基于身份方案中所固有的密钥托管问题.Park等人在2007年提出了选择身份安全模型下抗选择明文攻击(IND-sID-CPA)的无证书加密方案,在该方案的启发下提出了基于无证书体制的两方认证密钥协商方案,并与其他方案进行了安全性和有效性比较.该方案满足目前已知的绝大多数安全属性要求,特别是完美前向安全性,PKG前向安全性,已知会话相关临时秘密信息安全性以及无密钥托管等安全特性,同时保持了良好的计算效率.     

一个前向安全的基于签密的密钥协商协议*

安全有效地传递信息是计算机安全通信研究领域的主要目标。借鉴Zheng和张串绒将签密技术运用到密钥协商协议中的思想,利用基于身份的签密方案,提出一种具有前向安全性的密钥协商协议。该协议在具有基于身份的公钥密码体制特点的同时,又拥有签密技术的优点。与已有的方案相比,该密钥协商协议除了具有机密性、认证性、还具有前向安全性的特点。     

后量子前向安全的可组合认证密钥交换方案

随着后量子时代的逼近,网络通信安全要求会话密钥具有针对量子计算攻击的前向安全性,而后量子的公钥基础设施尚未建立,采用现有公钥密钥系统与后量子密钥交换相结合的混合密码系统势在必行.以DHKE-like(Diffie-Hellman key exchange-like)协议为基础,结合签密方案,提出一种通用可组合的认证密钥交换(authentication key exchange, AKE)方案——GC-AKE.GC-AKE的基本思路是采用签密方案对DHKE-like中的临时公钥进行签密,实现实体的相互认证和密钥协商.采用签密机制的主要目的是为了实现GC-AKE方案的完美前向安全性,这要求签密机制满足强不可伪造性.提出一种基于椭圆曲线密码的基于身份签密方案,结合基于环上误差学习问题的DHKE-like协议,提出一种GC-AKE方案实例.定义了能模拟完美前向安全性的wAKE-PFS模型.在wAKE-PFS模型下,GC-AKE方案的安全性被规约为求解DDH-like(decision Diffie-Hellman-like)问题,以及破解基于身份签密的选择密文安全性(indistinguishability against chosen ciphertext attacks, IND-CCA)和强不可伪造性(strong existentially unforgeable under adaptive chosen messages attacks, SEUF-CMA).分析表明：GC-AKE方案实例的计算和通信开销都相对较低,同时实现了会话密钥的完美前向安全性及后量子的前向安全性.     

强安全的匿名隐式漫游认证与密钥协商方案

现有两方漫游认证与密钥协商方案没有考虑抵抗临时秘密泄露的安全性,仅在CK模型下可证明安全.基于椭圆曲线密码体制和基于身份密码系统,采用Schnorr签名算法设计了类似HMQV方案的“挑战-应答”签名,进而构造了一种基于隐式认证技术的、具有强安全性和匿名性的两方漫游认证密钥协商方案.随后,扩展了ID-BJM模型,使之能模拟两方漫游认证与密钥协商方案.在扩展的安全模型下,新方案的安全性被规约为多项式时间敌手求解椭圆曲线上的计算Diffie-Hellman问题,实现了eCK安全.对比分析表明：新方案具有更强的安全性,能抵抗临时秘密泄露攻击,需要实现的密码算法更少,计算、通信和存储开销都相对较低.新方案可应用于移动通信网络、物联网或泛在网络中,为资源约束型移动终端提供安全的漫游接入服务.     

Simulatable certificateless two-party authenticated key agreement protocol

Key agreement (KA) allows two or more users to negotiate a secret session key among them over an open network. Authenticated key agreement (AKA) is a KA protocol enhanced to prevent active attacks. AKA can be achieved using a public-key infrastructure (PKI) or identity-based cryptography. However, the former suffers from a heavy certificate management burden while the latter is subject to the so-called key escrow problem. Recently, certificateless cryptography was introduced to mitigate these limitations. In this paper, we first propose a security model for AKA protocols using certificateless cryptography. Following this model, we then propose a simulatable certificateless two-party AKA protocol. Security is proven under the standard computational Diffie-Hellman (CDH) and bilinear Diffie-Hellman (BDH) assumptions. Our protocol is efficient and practical, because it requires only one pairing operation and five multiplications by each party.     

基于身份具有错误容忍的会议密钥分配协议

利用Yang等人的一个基于身份的并且错误容忍的会议密钥分配方案,提出了一种改进的会议密钥分配协议算法,并分析了该协议的正确性和安全性。分析结果表明,该方案不但实现了即使存在恶意参与者的情况下,诚实参与者也能协商出一个共同的会议密钥的目的;而且能够有效地抵抗被动攻击和主动攻击,安全高效,具有很强的实用性。     

A Provable Secure ID-Based Explicit Authenticated Key Agreement Protocol Without Random Oracles

In this paper, we present an identity-based explicit authenticated key agreement protocol that is provably secure without random oracles. The protocol employs a new method to isolate a session key from key confirmation keys so that there is no direct usage of hash functions in the protocol. The protocol is proved secure without random oracles in a variant of Bellare and Rogaway style model, an exception to current proof method in this style model in the ID-based setting. We believe that this key isolation method is novel and can be further studied for constructing more effcient protocols.     

一种轻量级基于证书的认证密钥协商方案

认证密钥协议对于在公共网络上安全通信至关重要,它使通信方能够在恶意攻击者当前安全地设置共享会话密钥.基于证书的密码学(CBC)很好地解决了传统公钥密码体制中的证书撤销问题、基于身份的密码体制中的密钥托管问题和无证书密码体制中安全信道建立困难问题.现有的基于证书认证密钥协商方案大多都采用了昂贵的双线性配对,不适合计算资源有限的移动设备.本文设计了一种轻量级的基于证书的AKA协议,该协议用假名技术实现用户身份匿名.该协议提供了前向保密,抵抗中间人攻击,重放攻击等安全性分析.与以往基于证书的AKA协议相比,该协议在计算效率上具有明显的优势.