A mechanical approach to derive identity-based protocols from Diffie–Hellman-based protocols

Abstract

We describe a mechanical approach to derive identity-based (ID-based) protocols from existing Diffie–Hellman-based ones. As case studies, we present the ID-based versions of the Unified Model protocol, UMP-ID, Blake-Wilson et al. (1997)’s protocol, BJM-ID, and Krawczyk (2005)’s HMQV protocol, HMQV-ID. We describe the calculations required to be modified in existing proofs. We conclude with a comparative security and efficiency of the three proposed ID-based protocols (relative to other similar published protocols) and demonstrate that our proposed ID-based protocols are computationally efficient.

Introduction

Key distribution is one of the most fundamental problems in cryptography, and was revolutionized by the introduction of the key exchange protocol by Diffie and Hellman in [20]. The Diffie–Hellman (DH) protocol illustrated that:

arbitrary two parties even with no prior acquaintance and no secure physical/electronic channels can establish a shared secret key (called a session key) simply by exchanging their public keys over an insecure public network as long as integrity of public keys is guaranteed and the underlying computational problem (known as the computational Diffie–Hellman problem) is hard.

We note that the public keys exchanged in the DH protocol are usually ephemeral (short-term) rather than static (long-term) keys, although this (i.e. Whether the keys are ephemeral or static?) was not in the original protocol specification. Perhaps, this was not an issue at that time. While public key cryptography facilitates key distribution over an insecure communication channel, the integrity of public keys is crucial for security against an active adversary – it is well known that the basic (unauthenticated) DH protocol is susceptible to active man-in-the-middle attacks.

Many of the popular key establishment protocols are based on the DH key exchange and are implicitly authenticated via public key certificates¹ [25], [41]. Examples include the MTI protocol [35], the Unified Model protocol (UMP) [2], [8], the MQV protocol [37], [34], and the HMQV protocol [31]. Throughout the paper, we will use the term “DH-based protocols” to refer to these implicitly authenticated DH-based protocols. A key goal of DH-based protocols is to achieve the same level of efficiency as the basic DH protocol, both in terms of communication and computation, when the possible transmission and verification of public key certificates are excluded from consideration. The design and security of DH-based protocols have been extensively studied over the last decades and are now fairly well-understood. For example, some recent DH-based protocols were proven secure in the extended Canetti-Krawczyk (eCK) model [33], [47], [30].

While public key certificates have been widely used to bind public keys to identities, their management has turned out to be more challenging than was initially anticipated. The quest for a solution to this problem has led to the invention of identity-based (ID-based) cryptography [42]. At the price of key escrow, ID-based cryptography eliminates the need for certificates by allowing parties to use their identity as their public key. Typically, we would already know the identity of our communication peer and, thus, do not need a signed certificate for it. This is of great benefit in simplifying the management of public keys [40]. From an ID-based scheme user’s perspective, an obvious benefit is an absence of certificate transmission and verification.

In the past decade, we have witnessed a surge of interest in ID-based cryptography, particularly the use of elliptic curve pairings to realize cryptographic structures that seemed impossible before. To illustrate how elliptic curve pairings can be used to build novel cryptographic schemes with interesting properties, we refer the reader to the work of Al-Riyami [1]. Published schemes include a number of ID-based key establishment protocols using pairing, which we will refer to simply as “ID-based protocols”. Examples include the protocols of Smart [45], Shim [43], Chen and Kudla [14], Choie et al. [16], Xie [51], McCullagh and Barreto [36], Wang et al. [50], and Wang [49].

The security properties required for key establishment protocols are well studied, and an excellent overview is presented by Blake-Wilson and Menezes [9]. The most basic property is that a passive adversary eavesdropping on the protocol should be unable to obtain the session key. Other desirable properties include:

• It is often reasonable to assume that the adversary will be able to obtain session keys from any session different from the one under attack. A protocol has known key security if it is secure under this assumption. This is generally regarded as a standard requirement for key establishment protocols.

• Sometimes the adversary may be unable to obtain any useful information about a session key, but can deceive the protocol principals about the identity of the peer entity. Such an attack was first described by Diffie et al. [21], and can result in principals giving away information to the wrong party or accepting data as coming from the wrong party.

  As discussed by Boyd and Mathuria [12, Chapter 5.1.2], a malicious adversary $\mathcal{A}$ need not obtain the session key to profit from this attack. Consider the scenario whereby Alice will deliver some information of value (such as e-cash) to Bob. Since Bob believes the session key is shared with $\mathcal{A}\text{,}\mathcal{A}$ can claim this credit deposit as his. Also, $\mathcal{A}$ can exploit such an attack in a number of ways if the established session key is subsequently used to provide encryption or integrity [29]. Consequently, security against unknown key-share attacks is regarded as a standard requirement.

• When the static key of an entity is compromised, the adversary will be able to masquerade as that entity in any future protocol runs. However, the situation will be even worse if the adversary can also use the compromised static key to obtain session keys that were established before the compromise. Protocols that prevent this are said to provide forward secrecy. Since there is usually a computational cost in providing forward secrecy, it is sometimes sacrificed in the interest of efficiency.

  Forward secrecy in the setting of ID-based cryptography is similar as in conventional public key cryptography. However, there is an additional concern since the master key of the key generation center (KGC) is another secret that could become compromised. There could exist a protocol that provides forward secrecy in the usual sense but gives away old session keys if the master key becomes known. We will say that a protocol that retains confidentiality of old session keys even when the master key is known provides KGC forward secrecy (KGC-FS). As the static keys of all users can be easily computed from the master key, it is clear that KGC forward secrecy implies forward secrecy.

• Another problem that may occur when the static key of an entity A is compromised is that the adversary may be able to masquerade not only as A but also to A as another party B. Such a protocol is said to allow key compromise impersonation. Resistance to such attacks is often seen as desirable.

A survey by Boyd and Choo [11] shows that many existing ID-based protocols have been published without a careful security analysis or a systematic comparison with alternatives, highlighting the need for more rigorously tested ID-based protocols. In addition, their survey suggests some interesting similarities between ID-based protocols and various DH-based protocols. They then conjectured that these similarities may well extend to the security properties of these protocols. Later, Wang [48] suggested a way of deriving ID-based protocols from DH-based protocols. However, the unpublished manuscript omit important information about the resultant ID-based protocols’ security, notably the required modifications to the computational assumptions and the calculations in the security proofs.

In this paper, our main contribution is to present a systematic approach to mechanically derive provably-secure ID-based protocols from their DH-based versions. In our approach, we

• first propose ID-based versions of DH-based protocols based on some rules for parameters conversion,

• describe the computational assumptions required to be modified due to the parameters conversion, and

• describe the calculations required to be modified in comparison to the original proof.

To demonstrate that our approach is independent of the underlying security model (i.e. our approach can be applied to protocols proven secure in different security models), we use three popular protocols—the UMP protocol [2], [8], the BJM protocol [8, protocol 4], and the HMQV protocol [31]—as case studies. UMP was proven secure in a restricted model where the adversary is not allowed to reveal session keys [8]. We provide a proof of security for the ID-based version of UMP, which we denote by $\mathrm{UMP}-{\mathrm{ID}}_0$, in the same restricted model. We also show that a slight variant of $\mathrm{UMP}-{\mathrm{ID}}_0$, denoted as UMP-ID, can be proven secure in the model of Bellare and Rogaway (BR) [7] which does not restrict the adversary from revealing session keys. The original BJM protocol does not carry any proof of security but its variant due to Kudla and Paterson [32] was proven secure in a model adapted from the BR model to capture the notion of key compromise impersonation resistance. We prove the security of the ID-based version of BJM, BJM-ID, in the same model as the one used for the BJM variant of Kudla and Paterson. Lastly, the HMQV protocol was proven secure in the model of Canetti and Krawczyk (CK) [13]. As suggested by Choo et al. [18], protocols proven secure in the BR model are not necessarily secure in the CK model but the converse is true; for example, the adversary is allowed to obtain the ephemeral private keys of parties only in the CK model. For the ID-based version of HMQV (HMQV-ID), we provide a proof of forward security in the eCK model [33], which is an extension of the (original) CK model.

The next section presents the mathematical preliminaries and an overview of both the BR and eCK models. In Section 3, we present the mechanics of mapping the protocol parameters and the computational assumptions from DH-based to ID-based protocols. In Sections 4 UMP and its ID-Based versions, 5 BJM protocol and its ID-based version, 6 HMQV protocol and its ID-based version, we present the ID-based versions of UMP, BJM and HMQV, followed by the calculations required to be modified in their existing proofs. We conclude with a comparative security and efficiency of the derived ID-based protocols (relative to other similar published protocols) in Section 7.