Skip to main content
SpringerLink
Log in

Privacy-Preserving Authenticated Key Exchange for Constrained Devices

  • Conference paper
  • First Online:
Applied Cryptography and Network Security (ACNS 2022)

Part of the book series: Lecture Notes in Computer Science ((LNCS,volume 13269))

Included in the following conference series:

  • 1448 Accesses

Abstract

In this paper we investigate the field of privacy-preserving authenticated key exchange protocols (PPAKE). First we make a cryptographic analysis of a previous PPAKE protocol. We show that most of its security properties, including privacy, are broken, despite the security proofs that are provided. Then we describe a strong security model which captures the security properties of a PPAKE: entity authentication, key indistinguishability, forward secrecy, and privacy. Finally, we present a PPAKE protocol in the symmetric-key setting which is suitable for constrained devices. We formally prove the security of this protocol in our model.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 109.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 139.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    In [5], Avoine et al. describe the message flow of a cryptographic protocol. Consequently, they indicate only the parameters that are necessary on a cryptographic point of view.

  2. 2.

    This is a technical feature of the SAKE and SAKE-AM protocols, which our PPSAKE protocol is based on. In this regard, we refer the reader to [5, Sect. 6].

References

  1. Aghili, S.F., Jolfaei, A.A., Abidin, A.: SAKE\(^+\): strengthened symmetric-key authenticated key exchange with perfect forward secrecy for IoT. Cryptology ePrint Archive, Report 2020/778, 20200714:112142 (2020)

    Google Scholar 

  2. ANSSI. Should Quantum Key Distribution be Used for Secure Communications? (2020)

    Google Scholar 

  3. Arfaoui, G., Bultel, X., Fouque, P.A., Nedelcu, A., Onete, C.: The privacy of the TLS 1.3 protocol. PoPETs 2019(4), 190–210 (2019)

    Google Scholar 

  4. Ashur, T., et al.: A privacy-preserving device tracking system using a low-power wide-area network. In: Capkun, S., et al. (eds.) CANS 2017. LNCS, vol. 11261, pp. 347–369. Springer, Cham (2018). https://doi.org/10.1007/978-3-030-02641-7_16

  5. Avoine, G., Canard, S., Ferreira, L.: Symmetric-key authenticated key exchange (SAKE) with perfect forward secrecy. In: Jarecki, S. (ed.) CT-RSA 2020. LNCS, vol. 12006, pp. 199–224. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-40186-3_10

    Chapter  Google Scholar 

  6. Avoine, G., Coisel, I., Martin, T.: Time measurement threatens privacy-friendly RFID authentication protocols. In: Yalcin, O., Berna, S. (ed.) RFIDSec 2010. LNCS, vol. 6370, pp. 138–157. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-16822-2_13

  7. Avoine, G., Coisel, I., Martin, T.: Untraceability model for RFID. IEEE Trans. Mob. Comput. 13(10), 9 (2014)

    Article  Google Scholar 

  8. Bellare, M., Desai, A., Jokipii, E., Rogaway, P.: A concrete security treatment of symmetric encryption. In: 38th FOCS, pp. 394–403. IEEE Computer Society Press (1997)

    Google Scholar 

  9. Bellare, M., Namprempre, C.: Authenticated encryption: relations among notions and analysis of the generic composition paradigm. J. Cryptol. 21(4), 469–491 (2008)

    Article  MathSciNet  MATH  Google Scholar 

  10. Bellare, M., Rogaway, P.: Entity authentication and key distribution. In: Stinson, D.R. (ed.) CRYPTO 1993. LNCS, vol. 773, pp. 232–249. Springer, Heidelberg (1994). https://doi.org/10.1007/3-540-48329-2_21

    Chapter  Google Scholar 

  11. Bellare, M., Rogaway, P.: The security of triple encryption and a framework for code-based game-playing proofs. In: Vaudenay, S. (ed.) EUROCRYPT 2006. LNCS, vol. 4004, pp. 409–426. Springer, Heidelberg (2006). https://doi.org/10.1007/11761679_25

  12. Blake-Wilson, S., Johnson, D., Menezes, A.: Key agreement protocols and their security analysis. In: Darnell, M. (ed.) Cryptography and Coding 1997. LNCS, vol. 1355, pp. 30–45. Springer, Heidelberg (1997). https://doi.org/10.1007/BFb0024447

    Chapter  MATH  Google Scholar 

  13. Blanchet, B., Smyth, B., Cheval, V., Sylvestre, M.: ProVerif 2.01: automatic cryptographic protocol verifier, user manual and tutorial (2020)

    Google Scholar 

  14. Bloom, B.H.: Space/time trade-offs in hash coding with allowable errors. Commun. ACM 13(7), 422–426 (1970)

    Article  MATH  Google Scholar 

  15. Brzuska, C., Jacobsen, H., Stebila, D.: Safely exporting keys from secure channels. In: Fischlin, M., Coron, J.-S. (eds.) EUROCRYPT 2016. LNCS, vol. 9665, pp. 670–698. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-49890-3_26

    Chapter  Google Scholar 

  16. Canard, S., Coisel, I.: Data synchronization in privacy-preserving RFID authentication schemes. In: Radio Frequency Identification: Security and Privacy Issues - 4th International Workshop, RFIDSec 2008 (2008)

    Google Scholar 

  17. Canard, S., Coisel, I., Etrog, J., Girault, M.: Privacy-preserving RFID systems: model and constructions. Cryptology ePrint Archive, Report 2010/405 (2010)

    Google Scholar 

  18. Dimitriou, T.: Key evolving RFID systems. Ad Hoc Netw. 37(P2), 195–208 (2016)

    Article  MathSciNet  Google Scholar 

  19. Fan, B., Andersen, D.G., Kaminsky, M., Mitzenmacher, M.: Cuckoo filter: practically better than bloom. In: Seneviratne, A., Diot, C., Kurose, J., Chaintreau, A., Rizzo, L. (eds.) Proceedings of the 10th ACM International on Conference on emerging Networking Experiments and Technologies, CoNEXT 2014, pp. 75–88. ACM (2014)

    Google Scholar 

  20. Ferreira, L.: Privacy-preserving authenticated key exchange for constrained devices. Cryptology ePrint Archive, Report 2021/1647 (2021)

    Google Scholar 

  21. Fischlin, M., Günther, F.: Replay attacks on zero round-trip time: the case of the TLS 1.3 handshake candidates. In: 2017 IEEE European Symposium on Security and Privacy (EuroS&P), pp. 60–75. IEEE (2017)

    Google Scholar 

  22. Fouque, P.A., Onete, C., Richard, B.: Achieving better privacy for the 3GPP AKA protocol. PoPETs 2016(4), 255–275 (2016)

    Article  Google Scholar 

  23. Hedbom, H.: A survey on transparency tools for enhancing privacy. In: Matyáš, V., Fischer-Hübner, S., Cvrček, D., Švenda, P. (eds.) Privacy and Identity 2008. IAICT, vol. 298, pp. 67–82. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-03315-5_5

  24. Hermans, J., Pashalidis, A., Vercauteren, F., Preneel, B.: A new RFID privacy model. In: Atluri, V., Diaz, C. (eds.) ESORICS 2011. LNCS, vol. 6879, pp. 568–587. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-23822-2_31

    Chapter  Google Scholar 

  25. Huang, H.F., Yu, P.K., Liu, K.C.: A privacy and authentication protocol for mobile RFID system. In: International Symposium on Independent Computing - ISIC 2014 (2014)

    Google Scholar 

  26. Jager, T., Kohlar, F., Schäge, S., Schwenk, J.: On the security of TLS-DHE in the standard model. In: Safavi-Naini, R., Canetti, R. (eds.) CRYPTO 2012. LNCS, vol. 7417, pp. 273–293. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-32009-5_17

    Chapter  MATH  Google Scholar 

  27. Juels, A.: RFID security and privacy: a research survey. IEEE J. Sel. A. Commun. 24(2), 381–394 (2006)

    Article  MathSciNet  Google Scholar 

  28. Juels, A., Weis, S.A.: Defining strong privacy for RFID. In: Fifth Annual IEEE International Conference on Pervasive Computing and Communications Workshops (PerComW’07), pp. 342–347 (2007)

    Google Scholar 

  29. Malina, L., Srivastava, G., Dzurenda, P., Hajny, J., Ricci, S.: A privacy-enhancing framework for Internet of Things services. In: Liu, J.K., Huang, X. (eds.) NSS 2019. LNCS, vol. 11928, pp. 77–97. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-36938-5_5

  30. Ouafi, K., Phan, R.C.-W.: Traceable privacy of recent provably-secure RFID protocols. In: Bellovin, S.M., Gennaro, R., Keromytis, A., Yung, M. (eds.) ACNS 2008. LNCS, vol. 5037, pp. 479–489. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-68914-0_29

    Chapter  Google Scholar 

  31. Ray, A.K., Bagwari, A.: Study of smart home communication protocol’s and security privacy aspects. In: 7th International Conference on Communication Systems and Network Technologies (CSNT), pp. 240–245 (2017)

    Google Scholar 

  32. Rescorla, E.: The transport layer security (TLS) protocol version 1.3 (2018)

    Google Scholar 

  33. Schäge, S., Schwenk, J., Lauer, S.: Privacy-preserving authenticated key exchange and the case of IKEv2. In: Kiayias, A., Kohlweiss, M., Wallden, P., Zikas, V. (eds.) PKC 2020. LNCS, vol. 12111, pp. 567–596. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-45388-6_20

    Chapter  MATH  Google Scholar 

  34. Shoup, V.: Sequences of games: a tool for taming complexity in security proofs. Cryptology ePrint Archive, Report 2004/332 (2004)

    Google Scholar 

  35. Song, T., Li, R., Mei, B., Yu, J., Xing, X., Cheng, X.: A privacy preserving communication protocol for IoT applications in smart homes. IEEE Internet Things J. 4(6), 1844–1852 (2017)

    Article  Google Scholar 

  36. Vaudenay, S.: On privacy models for RFID. In: Kurosawa, K. (ed.) ASIACRYPT 2007. LNCS, vol. 4833, pp. 68–87. Springer, Heidelberg (2007). https://doi.org/10.1007/978-3-540-76900-2_5

    Chapter  Google Scholar 

  37. You, I., Kwon, S., Choudhary, G., Sharma, V., Seo, J.T.: An enhanced LoRaWAN security protocol for privacy preservation in IoT with a case study on a smart factory-enabled parking system. Sensors 18(6) (2018)

    Google Scholar 

  38. Ziegeldorf, J.H., Morchon, O.G., Wehrle, K.: Privacy in the Internet of Things: threats and challenges. Secur. Commun. Netw. 7(12), 2728–2742 (2014)

    Article  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Orange Labs, Applied Crypto Group, Caen, France

    Loïc Ferreira

Authors
  1. Loïc Ferreira
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Loïc Ferreira .

Editor information

Editors and Affiliations

  1. Stevens Institute of Technology, Hoboken, NJ, USA

    Giuseppe Ateniese

  2. Sapienza University of Rome, Rome, Italy

    Daniele Venturi

Rights and permissions

Reprints and permissions

Copyright information

© 2022 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Ferreira, L. (2022). Privacy-Preserving Authenticated Key Exchange for Constrained Devices. In: Ateniese, G., Venturi, D. (eds) Applied Cryptography and Network Security. ACNS 2022. Lecture Notes in Computer Science, vol 13269. Springer, Cham. https://doi.org/10.1007/978-3-031-09234-3_15

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-09234-3_15

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-09233-6

  • Online ISBN: 978-3-031-09234-3

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation