Improved authenticated multiple-key agreement protocol without using conventional one-way function

Abstract

An authenticated multiple-key agreement protocol enables two entities to authenticate each other and establish multiple common keys in a two-pass interaction, and a protocol without using a conventional hash function simplifies its security assumption on only public hard problem. In 2001, Yen et al. proposed an improved multiple-key agreement protocol to overcome the attacks that break the previous variants. However, the authors show that an impersonator can easily forge message without being detected, and can establish common session keys with the communicating party. To overcome all the weakness, we propose an improved scheme that also achieves better key utilization, compared to the previous variants.

Introduction

In 1998, Harn and Lin [7] noticed that the conventional one-way function is widely employed in many digital signature schemes [2], [3], [4], [5]. In these schemes, the system will become insecure because of the forgery attacks if the conventional one-way function is not used [6], [7], [8], [12]. Furthermore, they also noticed that the security of these conventional one-way hash functions, like MD5 [8], is based on the complexity of analysis of iterated functions but is not on a public hard problem [2], [3], [12] (the discrete logarithm problem is a public hard problem, and can be seen as a one-way function). So, it may seem very difficult to break the security of these conventional one-way functions at the beginning, but it may become insecure to some special attacks later [8]. Therefore, Harn and Lin first proposed the authenticated key agreement protocol without using the conventional one-way function [7]. Moreover, their scheme greatly enhances the efficiency of key agreement by allowing two entities to establish multiple keys instead of one common key in a two-pass interaction [7].

Later, Yen and Joye [9] showed that an attacker could easily forge, with high probability, the signature of the exchanged public keys in the Harn–Lin scheme. From this observation, Yen and Joye proposed their modified version. However, Wu et al. [10] found the same weakness in Yen–Joye’s modified version. Wu et al. finally proposed their solution by exploiting the conventional one-way function. Unfortunately, this solution violates Harn–Lin’s original requirement of no conventional one-way function. Therefore, Yen et al. proposed an improved version without using the one-way function. The scheme adopts the timestamp to detect the replay message and verify the authentic message.

In this paper, we show that an impersonator can easily forge the message without being detected, and can share common session keys with the communicating party. That is, the Yen–Sun–Hwang scheme is not secure, like its previous variants. We, therefore, propose an improved scheme to overcome the weakness. The rest of this article is organized as follows. In Section 2, we briefly review Harn–Lin’s scheme, Yen–Joye’s modified version, Wu et al.’s scheme, and Yen–Sun–Hwang’s scheme. In Section 3, we demonstrate that an impersonator can easily forge valid message and establish common session keys with the communicating party. In Section 4, we propose our improved scheme, examine its security and discuss the key utilization. Finally, Section 5 concludes this article.