Skip to main content
SpringerLink
Log in

Security Model and Analysis of FHMQV, Revisited

  • Conference paper
  • First Online:
Information Security and Cryptology (Inscrypt 2013)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 8567))

Included in the following conference series:

Abstract

HMQV is one of the most efficient (provably secure) authenticated key-exchange protocols based on public-key cryptography, and is widely standardized. In spite of its seemingly conceptual simplicity, the HMQV protocol was actually very delicately designed. The provable security of HMQV is conducted in the Canetti-Krawczyk framework (CK-framework, in short), which is quite complicated and lengthy with many subtleties actually buried there. However, lacking a full recognition of the precise yet subtle interplay between HMQV protocol structure and provable security can cause misunderstanding of the HMQV design, and can cause potential flawed design and analysis of HMQV protocol variants. In this work, we explicitly make clear the interplay between HMQV protocol structure and provable security, showing the delicate design of HMQV. We then re-examine the security model and analysis of a recently proposed HMQV protocol variant, specifically, the FHMQV protocol proposed by Sarr et al. in [25]. We clarify the relationship between the traditional CK-framework and the CK-FHMQV security model proposed for FHMQV, and show that CK-HMQV and CK-FHMQV are incomparable. Finally, we make a careful investigation of the CDH-based analysis of FHMQV in the CK-FHMQV model, which was considered to be one of the salient advantages of FHMQV. We identify that the CDH-based security analysis of FHMQV is actually flawed. The flaws identified in the security proof of FHMQV just stem from lacking a full realization of the precise yet subtle interplay, as clarified in this work, between HMQV protocol structure and provable security.

Shengli Liu—Funded by Natural Science Foundation of China (No. 61170229, 61373153), Innovation Project (No.12ZZ021) of Shanghai Municipal Education Commission.

Kouichi Sakurai—Supported by Grant-in-Aid for Scientific Research KAKENHI-No.23650008 from the Japan Society for the Promotion of Science (JSPS).

Jian Weng—Funded by the National Science Foundation of China under Grant Nos. 61272413, 61133014 and 61272415, the Fok Ying Tung Education Foundation under Grant No. 131066, the Program for New Century Excellent Talents in University under Grant No. NCET-12-0680, and the R&D Foundation of Shenzhen Basic Research Project under Grant No. JC201105170617A.

Yunlei Zhao—Contact author, funded by the National Basic Research Program of China (973 Program) No. 2014CB340600, and National Natural Science Foundation of China Grant No. 61070248, and No. 61272012, Innovation Project (No.12ZZ013) of Shanghai Municipal Education Commission, and Joint Project of SKLOLS. Work partially done during his visiting Sakura-lab of Kyushu Univ. JAPAN with support by Invitation Programs for Foreign-based Researchers provided from NICT, JAPAN.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    Actually, the FHMQV can be viewed as variant of a protocol proposed in [28], where \(d=h(\hat{A},A,\hat{B},B,X,Y)\) and \(e=h(d)\).

  2. 2.

    In a cross-message attack, an adversary \(\fancyscript{A}\) concurrently interacts, as the responder, with \(\hat{A}\) (resp., \(\hat{B}\)) in the name of \(\hat{B}\) (resp., \(\hat{A}\)) in two sessions. After getting \(X\) and \(Y\) respectively as the first-round message in both of the two sessions, it sends \(Y\) (resp., \(X\)) to \(\hat{A}\) (resp., \(\hat{B}\)) as the second-round message in both of the two sessions. For the basic (H)MQV, both of the two players will output the same session-key in the two sessions but with role confusion.

  3. 3.

    For IA-DHKE, this makes sense mainly when the test-session is held by a responder. Consider that the attacker first activates an initiator \(\hat{A}\) to get \(X\), and then suspends this session held by \(\hat{A}\) till finishing the test-session \((\hat{B},\hat{A},Y,X)\) run by \(\hat{B}\). If the session run by \(\hat{A}\) is never completed, the DH-exponent \(x\) can be exposed to adversary (while \(\hat{A}\) cannot be corrupted as the test-session is required to be between two uncorrupted players); but if later this session is completed and thus becomes matching to the test-session, it should be unexposed for the SK-security.

  4. 4.

    It is clarified in [31] that the provable security of HMQV, in this case, actually does not allow the leakage of all the pre-computable secrecy values; for example, the pre-computable value \(y+eb\) or \(x+da\) is not allowed to be exposed for the provable security of HMQV in the CK-framework.

  5. 5.

    Actually, the FHMQV can be viewed as variant of a protocol proposed in [28], where \(d=h(\hat{A},A,\hat{B},B,X,Y)\) and \(e=h(d)\).

  6. 6.

    The work of [25] also considers a variant of the eCK model proposed in [17]. In this work, we mainly focus on the CK-FHMQV variant.

  7. 7.

    According to our investigation, FHMQV might be proved secure under the stronger GDH assumption, with the underlying security proof, nevertheless, being significantly changed. But our result indicates that the CDH-based security proof of FHMQV, which was claimed in [25] as one of the major security advantages of FHMQV, is indeed flawed.

References

  1. American National Standard (ANSI) X9.42-2001. Public Key Cryptography for the Financial Services Industry: Agreement of Symmetric Keys Using Discrete Logarithm Cryptography

    Google Scholar 

  2. American National Standard (ANSI) X9.42-2001. Public Key Cryptography for the Financial Services Industry: Agreement of Symmetric Keys Using Elliptic Curve Cryptography

    Google Scholar 

  3. Bellare, M., Rogaway, P.: Random oracles are practical: a paradigm for designing efficient protocols. In: ACM Conference on Computer and Communications Security, pp. 62–73 (1993)

    Google Scholar 

  4. Canetti, R.: Security and composition of cryptographic protocols: a tutorial. SIGACT News 37(3,4), 67–92 (2006)

    Article  Google Scholar 

  5. Canetti, R., Krawczyk, H.: Analysis of key-exchange protocols and their use for building secure channels. In: Pfitzmann, B. (ed.) EUROCRYPT 2001. LNCS, vol. 2045, pp. 453–474. Springer, Heidelberg (2001). Available also from Cryptology ePrint Archive, Report No. 2001/040

    Chapter  Google Scholar 

  6. Cremers, C.: Formally and practically relating the CK, CK-HMQV, and eCK security models for authenticated key exchange. Cryptology ePrint Archive, Report 2009/253, 2009. Extended abstract appears in AsiaCCS 2011

    Google Scholar 

  7. Damgård, I.B.: Towards practical public key systems secure against chosen ciphertext attacks. In: Feigenbaum, J. (ed.) CRYPTO 1991. LNCS, vol. 576, pp. 445–456. Springer, Heidelberg (1992)

    Google Scholar 

  8. Dierks, T., Allen, C.: The TLS Protocol, Version 1.0. Request for Comments: 2246, January 1999

    Google Scholar 

  9. Diffie, W., Hellman, M.: New directions in cryptography. IEEE Trans. Inf. Theory 22(6), 644–654 (1976)

    Article  MathSciNet  MATH  Google Scholar 

  10. IEEE 1363–2000: Standard Specifications for Public Key Cryptography

    Google Scholar 

  11. ISO/IEC IS 15946–3. Information Technology - Security Techniques - Cryptographic Techniques Based on Elliptic Curves - Part 3: Key Establishment (2002)

    Google Scholar 

  12. ISO/IEC. Identification Cards Integrated Circuit Cards Programming Interface Part 6: Registration procedures for the authentication protocols for interoperability. Technical report ISO/IEC FDIS 24727–6, International Organization for Standardization, Geneva, Switzerland (2009)

    Google Scholar 

  13. Kaliski, B.: An unknown key-share attack on the MQV key agreement protocol. ACM Trans. Inf. Syst. Secur. (TISSEC) 4(3), 275–288 (2001)

    Article  Google Scholar 

  14. Krawczyk, H.: SIGMA: the ‘SIGn-and-MAc’ approach to authenticated Diffie-Hellman and its use in the IKE protocols. In: Boneh, D. (ed.) CRYPTO 2003. LNCS, vol. 2729, pp. 400–425. Springer, Heidelberg (2003)

    Chapter  Google Scholar 

  15. Kaufman, C.: Internet Key Exchange (IKEv2) Protocol. INTERNET-DRAFT, The Internet Engineering Task Force (2002)

    Google Scholar 

  16. Krawczyk, H.: HMQV: a high-performance secure Diffie-Hellman protocol. In: Shoup, V. (ed.) CRYPTO 2005. LNCS, vol. 3621, pp. 546–566. Springer, Heidelberg (2005)

    Chapter  Google Scholar 

  17. LaMacchia, B.A., Lauter, K., Mityagin, A.: Stronger security of authenticated key exchange. In: Susilo, W., Liu, J.K., Mu, Y. (eds.) ProvSec 2007. LNCS, vol. 4784, pp. 1–16. Springer, Heidelberg (2007)

    Chapter  Google Scholar 

  18. Matsumoto, T., Takashima, Y., Imai, H.: On seeking smart public-key distribution systems. Trans. IECE Jpn. E69(2), 99–106 (1986)

    Google Scholar 

  19. Menezes, A., Qu, M., Vanstone, S.: Some new key agreement protocols providing mutual implicit authentication. In: Second Workshop on Selected Areas in Cryptography (SAC’95) (1995)

    Google Scholar 

  20. Menezes, A., Ustaoglu, B.: On the importance of public-key validation in the MQV and HMQV key agreement protocols. In: Barua, R., Lange, T. (eds.) INDOCRYPT 2006. LNCS, vol. 4329, pp. 133–147. Springer, Heidelberg (2006)

    Chapter  Google Scholar 

  21. NIST Special Publication 800–56 (DRAFT): Recommendation on Key Establishment Schemes. Draft 2, January 2003

    Google Scholar 

  22. NSAs Elliptic Curve Licensing Agreement. Presentation by Mr. John Stasak (Cryptography Office, National Security Agency) to the IETF’s Security Area Advisory Group, November 2004

    Google Scholar 

  23. Okamoto, T., Pointcheval, D.: The gap-problems: a new class of problems for the security of cryptographic schemes. In: Kim, K. (ed.) PKC 2001. LNCS, vol. 1992, pp. 104–118. Springer, Heidelberg (2001)

    Chapter  Google Scholar 

  24. Pointcheval, D., Stern, J.: Security arguments for digital signatures and blind signatures. J. Cryptol. 13, 361–396 (2000)

    Article  MATH  Google Scholar 

  25. Sarr, A.P., Elbaz-Vincent, P., Bajard, J.-C.: A secure and efficient authenticated Diffie–Hellman protocol. In: Martinelli, F., Preneel, B. (eds.) EuroPKI 2009. LNCS, vol. 6391, pp. 83–98. Springer, Heidelberg (2010)

    Chapter  Google Scholar 

  26. SP 800–56 (DRAFT), Special Publication 800–56, Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography, National Institute of Standards and Technology, July 2005

    Google Scholar 

  27. Yao, A.C., Zhao, Y.: On-line Efficient, Deniable and Non-Malleable Key-Exchange Methods, Domestic patent (in Chinese), No. 200710047344.8, August 2007

    Google Scholar 

  28. Yao, A.C., Zhao, Y.: Method and Structure for Self-Sealed Joint Proof-of-Knowledge and Diffie-Hellman Key-Exchange Protocols. PCT Patent. August 2008. This is the PCT version of [27], with [27] serving as the priority reference

    Google Scholar 

  29. Yao, A.C., Zhao, Y.: Deniable internet key exchange. In: Zhou, J., Yung, M. (eds.) ACNS 2010. LNCS, vol. 6123, pp. 329–348. Springer, Heidelberg (2010)

    Chapter  Google Scholar 

  30. Yao, A.C., Zhao, Y.: A New Family of Implicitly Authenticated Diffie-Hellman Protocols. Cryptology ePrint Archive: Report 2011/035

    Google Scholar 

  31. Yao, A.C., Zhao, Y.: OAKE: A new family of implicitly authenticated Diffie-Hellman protocols. ACM CCS (2013, to appear)

    Google Scholar 

  32. Yoneyama, K., Zhao, Y.: Taxonomical security consideration of authenticated key exchange resilient to intermediate computation leakage. In: Boyen, X., Chen, X. (eds.) ProvSec 2011. LNCS, vol. 6980, pp. 348–365. Springer, Heidelberg (2011)

    Chapter  Google Scholar 

Download references

Acknowledgments

We are grateful to the anonymous referees for many helpful suggestions.

Author information

Authors and Affiliations

  1. Department of Computer Science and Engineering, Shanghai Jiao Tong University, Shanghai, 200240, China

    Shengli Liu

  2. Department of Computer Science and Communication Engineering, Kyushu University, Fukuoka, Japan

    Kouichi Sakurai

  3. Department of Computer Science, Emergency Technology Research Center of Risk Evaluation and Prewarning on Public Network Security, Jinan University, Guangzhou, China

    Jian Weng

  4. School of Information Science and Technology, Sun Yat-sen University, Guangzhou, 510006, China

    Fangguo Zhang

  5. Software School, Fudan University, Shanghai, 201203, China

    Yunlei Zhao

  6. State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100093, China

    Shengli Liu & Yunlei Zhao

  7. Shanghai Key Laboratory of Scalable Computing and Systems, Shanghai, China

    Jian Weng

Authors
  1. Shengli Liu
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Kouichi Sakurai
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Jian Weng
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Fangguo Zhang
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Yunlei Zhao
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Yunlei Zhao .

Editor information

Editors and Affiliations

  1. Chinese Academy of Sciences, Beijing, China

    Dongdai Lin

  2. University of Texas, San Antonio, Texas, USA

    Shouhuai Xu

  3. Columbia University, New York, New York, USA

    Moti Yung

Rights and permissions

Reprints and permissions

Copyright information

© 2014 Springer International Publishing Switzerland

About this paper

Cite this paper

Liu, S., Sakurai, K., Weng, J., Zhang, F., Zhao, Y. (2014). Security Model and Analysis of FHMQV, Revisited. In: Lin, D., Xu, S., Yung, M. (eds) Information Security and Cryptology. Inscrypt 2013. Lecture Notes in Computer Science(), vol 8567. Springer, Cham. https://doi.org/10.1007/978-3-319-12087-4_16

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-12087-4_16

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-12086-7

  • Online ISBN: 978-3-319-12087-4

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation