sign in sign up
<<
Home , MQV, Oakley protocol, Speke

Information Security and Texts and Monographs Series Editors Ueli Maurer Ronald L. Rivest Associate Editors Martin Abadi Ross Anderson Mihir Bellare Oded Goldreich Tatsuaki Okamoto Paul van Oorschot Birgit Pfitzmann Aviel D. Rubin Jacques Stern Springer-Verlag Berlin Heidelberg GmbH Colin Boyd • Anish Mathuria

Protocols for and Establishment

With 12 Figures and 31 Tables

. . Springer .184').

.". Authors Series Editors Colin Boyd Ueli Maurer School of Software Engineering Inst. fur Theoretische Informatik and Data Communications ETH Zurich, 8092 Zurich Queensland University of Technology Switzerland GPO Box 2434, Brisbane Q4001 Australia Ronald 1. Rivest c. [email protected] MIT, Dept. of Electrical Engineering and Computer Science 545 Technology Square, Room 324 Anish Mathuria Cambridge, MA 02139 Dhirubhai Ambani Institute USA of Information & Communication Technology Gandhinagar-382 009 Gujarat India [email protected]

Library of Congress Cataloging-in-Publication Data Boyd, Colin. Protocols for authentication and key establishment Colin A. Boyd, Anish Mathuria. p.cm. -- (Information security and cryptography) Includes bibliographical references and index. ISBN 978-3-642-07716-6 ISBN 978-3-662-09527-0 (eBook) DOI 10.1007/978-3-662-09527-0 1. Computer networks--Security measures. 2. Computer network protocols. 3. Data (Computer science) 4. Public key infrastructure (computer security) I. Mathuria, Anish, 1967- II. Title. III. Series. TK5105.59.B592003 005.8' 2--dc21 2003054427

ACM Subject Classification (1998): K.6.S ISBN 978-3-642-07716-6

This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfIlm or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer-Vc:rIagBcrlinHeideibergGmbH. Violations are liable for prosecution under the German Copyright Law. http://www.springer.de © Springer-Verlag Berlin Heidelberg 2003 Originally published by Sprioger-Verlag Berlin Heidelberg New York in 2003 Softcover reprint of the hudcover 1st edition 2003 The use of general descriptive names, trademarks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use. Typesetting: Camera-ready by the authors Cover Design: KiinkelLopka, Heidelberg Printed on acid-free paper 06/3142PS - 5 4 3 2 1 0 To the memory of my father Thou thy worldly task hast done

To my wife, Hemal Preface

Authentication and key establishment are fundamental building blocks for se• curing electronic communications. Cryptographic algorithms for encryption and integrity cannot perform their function unless secure keys have been es• tablished and the users know which parties share such keys. It is essential that protocols for providing authentication and key establishment are fit for their purpose. Although there are certainly earlier publications on techniques for authen• tication, it is fair to regard the 1978 Communications of the ACM paper of Needham and Schroeder as the starting point for the modern study of proto• cols for authentication and key establishment. There are two main research camps that have advanced understanding of cryptographic protocols since the publication of the Needham-Schroeder paper. These are the cryptography community and the computer security community. Between them, these com• munities have produced a vast number of protocols; some would say far too many. This has led to many difficulties for researchers and practitioners who wish to navigate this vast literature. We hope that this book will help them find their way. We believe that this book is the first comprehensive treatment of protocols for authentication and key establishment. There have, of course, been previous surveys of a more limited nature and these have provided valuable information and examples for us. Particularly useful was the extensive survey of Clark and Jacob [95] which includes a library of some 40 protocols as well as introductory material and an annotated bibliography. Two chapters in the authoritative Handbook of Applied Cryptography of Menezes, van Oorschot and Vanstone were also a source of much information. Nevertheless, in virtually all cases we have taken protocol descriptions directly from the original sources. Our aim has been to provide a comprehensive coverage of our subject mat• ter. Yet, despite restricting ourselves strictly to protocols for authentication and key establishment, we quickly realised that it was unrealistic to be ex• haustive. When we started the project in 1999 it seemed to us that there was a certain stability in the field, and this was a strong argument for the time- VIII Preface liness of the work. To an extent this judgement has turned out to be sound, at least for simple protocols of well-established type. But for more complex protocols we were very definitely wrong, and the problem of trying to draw a definitive picture of an ever changing landscape caused many headaches. This is particularly true of the material on group-oriented protocols and that on -based protocols. Even as we write this preface, we are aware that new protocols and design techniques are being developed in both these areas.

How to Use This Book

We hope that this book will prove useful both to those who wish to learn more about the field and as a reference for those looking for information about a specific protocol or group of protocols. The first two chapters are introductory and may be useful for the graduate student, or anyone coming to the field for the first time. Material in the remaining five chapters has been arranged thematically to help the reader identify connections between different protocols. Between them, these five chapters survey more than 150 protocols from the literature.

Chapter 1 starts with a tutorial aimed at explaining the general methods of how protocols work and the typical capabilities of protocol adversaries. Definitions for the basic protocol components follow, including a quick overview of cryptographic algorithms and their properties, as well as a list of typical protocol attacks. Chapter 2 is devoted to a study of the different goals that protocols for au• thentication and key establishment may have. We believe that this is a critical part of understanding protocol analysis, and neglect of this issue has been the source of much error in the past. The chapter develops a hierarchy of different goals, considering only extensional goals. This hier• archy is used in subsequent chapters to evaluate various protocols. We feel the hierarchy provides a simple yet effective tool for describing protocol properties and for evaluating attacks against protocols with unclear goals. The last section contains a brief survey of formal protocol analysis tech• niques, broadly divided into those using formal specification and those using complexity-theoretic proofs. Chapter 3 is concerned with protocols that employ symmetric cryptography. Many of these protocols involve an on-line trusted third party, in the tradition established by Needham and Schroeder. Chapter 4 deals with protocols using public key cryptography, but excluding key agreement protocols. As in Chap. 2 we include some standardised protocols and also some protocols in wide use today, such as the TLS protocol. Chapter 5 is concerned with key agreement based on public keys. Most of the protocols in this chapter are based on the Diffie-Hellman key ex• change. There is a vast range of protocols in this class, and consequently Preface IX

this is the longest chapter. There is also a treatment of identity-based key agreement protocols. Chapter 6 covers conference key protocols. Much of this chapter concerns generalisations of protocols from Chap. 5 to the multi-party setting. In particular, Diffie-Hellman key agreement with multiple parties is dis• cussed in some detail. A topic that is not treated in any depth in this chapter is that of dynamic conferences. Chapter 7 deals with password-based protocols. Such protocols were first developed not much over 10 years ago. Recently there have been many new protocols proposed in this area, and we have tried to take into account the most important of these. Appendix A is a brief overview of published standards for authentication and key establishment protocols. Rather than give the details in this ap• pendix, reference is made to many of the standardised protocols described in different chapters of the book. We expect that the book may be used by the practitioner for tasks such as finding whether an established protocol exists for a specific application, or whether any attacks are known on a specific protocol or on related protocols. To help with such tasks we have provided a list of protocols and a list of attacks in the front matter. There is also an index of protocol names at the back as well as the more usual general index. We have used a uniform notation for all protocols in the book, and have aimed to present the protocols in a manner that explains the important details clearly, and yet does not give excessive detail. There are different views of how to best achieve this aim, and we have compromised by using two different main presentation techniques. In Chaps. 3 and 4, and occasionally in later chapters, we have used a notation simply showing the messages exchanged between the protocol principals. We have preferred this notation when there are more than two principals involved, and when the interpretation of protocol actions seems straightforward. In most of the protocols in Chaps. 5, 6 and 7 we have used protocol flow diagrams that include principal actions. This notation seems more useful when there are complex and important actions involved. However, these diagrams can get rather cluttered, particularly for conference key protocols.

Acknowledgements Many people have given their help and advice generously over the several years that it has taken us to produce the book. We would like particularly to acknowledge Paul van Oorschot who looked at an early draft of the book, provided detailed feedback and sterling advice, and also introduced us to Springer. The series editors, Ueli Maurer and Ron Rivest, have also been supportive throughout. Different people have reviewed and provided comment on various portions of the book. We thank them all for the generous spirit and are sincerely sorry X Preface if we have misinterpreted or forgotten any of their helpful advice. This list includes all those who we can remember; we hope not to have missed anyone. Ross Anderson Malcolm Boyd John Clark Ed Dawson Marie Henderson Yvonne Hitchcock David Jablon Yongdae Kim Philip MacKenzie Wenbo Mao Keith Martin Alfred Menezes Chris Mitchell DongGook Park Josef Pieprzyk Ron Rivest Carsten Rudolph Rei Safavi-Naini Kapali Viswanathan

In addition, Daniel Bleichenbacher and Serge Vaudenay provided helpful an• swers to specific questions we asked of them. We are solely responsible for all errors of fact, presentation style, or just plain typing errors that this book may have. The team at Springer have been encouraging and helpful throughout. We would particularly like to thank Alfred Hofmann who carefully introduced us to the publication process. Ingeborg Mayer has been an unfailing source of information and advice, and displayed extreme patience as we continually failed to meet our deadlines. CB would like to record his personal thanks to his family D + C 3 who put up with considerable neglect, week after week and month after month, yet remained understanding and supportive. The Information Security Research Centre and the School of Software Engineering and Data Communications at Queensland University of Technology provided time and material support and he would like to acknowledge the encouragement of their respective heads, Ed Dawson and Bill Caelli. He would also like to acknowledge Papa Haydn for sustaining him during many a long working session. AM would like to thank his wife, Hemal, and daughter, Radhika, for their love and patience throughout this project. His writing of this book was started at the University of Massachusetts at Dartmouth; he would like to acknowl• edge his colleagues in the Computer and Information Sciences Department at UMASS for their support and encouragement. His current institution, Dhirub• hai Ambani Institute of Information and Communication Technology, gener• ously granted him time to complete the book. This book was typeset in 9TIVC on various different platforms. We used Ron Rivest's windex package to help with index preparation. The style for the protocols and attacks is adapted from Anselm Lingau's float package.

Brisbane, Gandhinagar Colin Boyd June 2003 Anish Mathuria Contents

List of Protocols ...... XVII List of Attacks ...... XXIII

1 A Tutorial Introduction to Authentication and Key Establishment ...... 1 1.1 Introduction...... 1 1.2 Building a Key Establishment Protocol...... 2 1.2.1 Confidentiality...... 4 1.2.2 Authentication...... 5 1.2.3 Replay...... 8 1.3 Protocol Architectures...... 12 1.3.1 Existing Cryptographic Keys ...... 12 1.3.2 Method of Session Key Generation ...... 13 1.3.3 Number of Users...... 13 1.3.4 Example...... 13 1.4 Cryptographic Properties...... 14 1.4.1 Confidentiality...... 16 1.4.2 Data Origin Authentication and Data Integrity ...... 17 1.4.3 Non-repudiation...... 18 1.4.4 Examples of Cryptographic Algorithms ...... 19 1.4.5 Secret Sharing ...... 20 1.5 Freshness...... 21 1.6 Types of Attack on Protocols ...... 23 1.6.1 Eavesdropping...... 24 1.6.2 Modification...... 25 1.6.3 Replay...... 25 1.6.4 Preplay...... 25 1.6.5 Reflection...... 25 1.6.6 Denial of Service...... 27 1.6.7 Typing Attacks ...... 28 1.6.8 ...... 29 XII Contents

1.6.9 Certificate Manipulation ...... 30 1.6.10 Protocol Interaction...... 31 1. 7 Design Principles for Cryptographic Protocols...... 31

2 Goals for Authentication and Key Establishment ...... 33 2.1 Introduction...... 33 2.2 Basic Goals...... 35 2.2.1 Models of Security...... 35 2.2.2 Key Establishment or Authentication? ...... 36 2.2.3 User-Oriented Goals...... 38 2.2.4 Key-Oriented Goals...... 40 2.3 Enhanced Goals...... 41 2.3.1 A Hierarchy of Protocol Goals ...... 41 2.3.2 Example: STS Protocol ...... 44 2.3.3 Intensional and Extensional Goals...... 46 2.3.4 Protocol Efficiency ...... 47 2.3.5 Responsibility and Credit ...... 48 2.4 Goals Concerning Compromised Keys...... 49 2.4.1 Forward Secrecy ...... 50 2.4.2 Key Compromise Impersonation ...... 52 2.5 Formal Verification of Protocols ...... 52 2.5.1 FDR...... 53 2.5.2 Murq, ...... 56 2.5.3 Brutus...... 57 2.5.4 NRL Analyzer ...... 58 2.5.5 BAN Logic ...... 59 2.5.6 Strand Space Model ...... 62 2.5.7 The Inductive Model...... 63 2.5.8 Comparison of Formal Methods Approaches ...... 65 2.6 Complexity-Theoretic Proofs of Security...... 66 2.6.1 Model of Communication ...... 67 2.6.2 Defining Security...... 68 2.6.3 Shoup's Simulation Model ...... 69 2.6.4 A Modular Approach to Proofs ...... 71 2.7 Conclusion...... 71

3 Protocols Using Shared Key Cryptography ...... 73 3.1 Introduction...... 73 3.2 Entity Authentication Protocols...... 75 3.2.1 Bird-Gopal-Herzberg-Janson-Kutten-Molva-Yung Protocols...... 75 3.2.2 Bellare-Rogaway MAP1 Protocol...... 76 3.2.3 ISO/IEC 9798-2 Protocols ...... 77 3.2.4 Woo-Lam ...... 78 3.2.5 Comparison of Entity Authentication Protocols ...... 80 Contents XIII

3.3 Server-Less Key Establishment ...... 80 3.3.1 Andrew Secure RPC Protocol...... 81 3.3.2 Janson-Tsudik 2PKDP Protocol ...... 83 3.3.3 Boyd Two-Pass Protocol ...... 83 3.3.4 ISO /IEC 11770-2 Server-Less Protocols ...... 84 3.3.5 Comparison of Server-Less Protocols ...... 86 3.4 Server-Based Key Establishment ...... 87 3.4.1 Needham-Schroeder Shared Key Protocol ...... 87 3.4.2 Otway-Rees Protocol ...... 88 3.4.3 Kerberos Protocol...... 91 3.4.4 ISO /IEC 11770-2 Server-Based Protocols...... 93 3.4.5 Wide-Mouthed-Frog Protocol ...... 94 3.4.6 Yahalom Protocol ...... 95 3.4.7 Janson-Tsudik 3PKDP Protocol ...... 97 3.4.8 Bellare-Rogaway 3PKD Protocol...... 98 3.4.9 Woo-Lam Key Transport Protocol ...... 99 3.4.10 Gong Key Agreement Protocols ...... 100 3.4.11 Boyd Key Agreement Protocol ...... 101 3.4.12 Gong Hybrid Protocol ...... 102 3.4.13 Comparison of Server-Based Protocols ...... 103 3.5 Key Establishment Using Multiple Servers ...... 104 3.5.1 Gong's Multiple Server Protocol ...... 104 3.5.2 Chen-Gollmann-Mitchell Protocol ...... 105 3.6 Conclusion ...... 106

4 Authentication and Key Transport Using Public Key Cryptography ...... 107 4.1 Introduction ...... 107 4.1.1 Notation ...... 108 4.1.2 Design Principles for Public Key Protocols ...... 108 4.2 Entity Authentication Protocols ...... 110 4.2.1 Protocols in ISO/IEC 9798-3 ...... 110 4.2.2 Protocols in ISO /IEC 9798-5 ...... 113 4.2.3 SPLICE/AS ...... 113 4.2.4 Comparison of Entity Authentication Protocols ...... 115 4.3 Key Transport Protocols ...... 116 4.3.1 Protocols in ISO /IEC 11770-3 ...... 116 4.3.2 Blake-Wilson and Menezes Provably Secure Key Transport Protocol ...... 120 4.3.3 Needham-Schroeder Public Key Protocol ...... 121 4.3.4 Protocols in the X.509 Standard ...... 122 4.3.5 TLS Protocol ...... 124 4.3.6 Beller-Chang-Yacobi Protocols ...... 126 4.3.7 TMN Protocol ...... 131 4.3.8 AKA Protocol ...... 132 XIV Contents

4.3.9 Comparison of Key Transport Protocols ...... 133 4.4 Conclusion ...... 134

5 1(ey Algreennent Protocols ...... 137 5.1 Introduction ...... 137 5.1.1 Key Control ...... 138 5.1.2 Unknown Key-Share Attacks ...... 139 5.1.3 Classes of Key Agreement ...... 140 5.2 Diffie-HeHman Key Agreement ...... 141 5.2.1 Small Subgroup Attacks ...... 144 5.2.2 EIGamal Encryption and One-Pass Key Establishment. 144 5.2.3 Lim-Lee Protocol Using Static Diffie-HeHman ...... 146 5.3 MTI Protocols ...... 147 5.3.1 Small Subgroup Attack on MTI Protocols ...... 149 5.3.2 Unknown Key-Share Attacks on MTI Protocols ...... 150 5.3.3 Lim-Lee Attack on MTI Protocols ...... 151 5.3.4 Impersonation Attack of Just and Vaudenay ...... 152 5.3.5 Triangle Attacks on MTI Protocols ...... 153 5.3.6 Forward Secrecy and Key Compromise Impersonation for MTI Protocols ...... 154 5.4 Diffie-HeHman-Based Protocols with Basic Message Format ... 155 5.4.1 The Goss Protocol...... 156 5.4.2 KEA Protocol ...... 157 5.4.3 The Unified Model Protocol ...... 158 5.4.4 MQV Protocol ...... 159 5.4.5 Yacobi's Protocol ...... 160 5.4.6 Ateniese-Steiner-Tsudik Protocol ...... 161 5.4.7 Just-Vaudenay-Song-Kim Protocol...... 162 5.4.8 Adding Key Confirmation ...... 163 5.4.9 Comparison ...... 164 5.5 Diffie-HeHman-Based Protocols with Enhanced Message Format ...... 165 5.5.1 STS Protocol ...... 166 5.5.2 ...... 168 5.5.3 SKEME Protocol ...... 172 5.5.4 Internet ...... 174 5.5.5 Arazi's Protocol ...... 178 5.5.6 Lim-Lee Protocols ...... 179 5.5.7 Hirose-Yoshida Protocol ...... 180 5.5.8 Comparison ...... 181 5.6 Identity-Based Schemes ...... 182 5.6.1 Okamoto's Scheme ...... 184 5.6.2 Gunther's Scheme ...... 186 5.6.3 Girault's Scheme ...... 188 5.6.4 Schemes Using Signatures with Message Recovery ..... 190 Contents XV

5.7 Protocols Designed for Computationally Limited Devices ..... 190 5.7.1 Yacobi-Shmuely Protocol ...... 191 5.7.2 ASPeCT Protocol ...... 192 5.7.3 Jakobsson-Pointcheval Protocol ...... 193 5.8 Protocols in ISO llEC 11770-3 ...... 195 5.9 Diffie-Hellman Key Agreement in Other Groups ...... 196 5.10 Protocols Not Based on Diffie-Hellman ...... 197 5.10.1 SKEME without Forward Secrecy ...... 197 5.10.2 Key Pre-distribution Schemes ...... 198 5.11 Conclusion ...... 199

6 Conference Key Protocols ...... 201 6.1 Introduction ...... 201 6.1.1 Generalised Security Goals ...... 202 6.1.2 Static and Dynamic Groups ...... 203 6.1.3 Notation ...... 204 6.2 Generalising Diffie-Hellman Key Agreement ...... 204 6.2.1 Ingemarsson-Tang-Wong Key Agreement ...... 204 6.2.2 Steiner-Tsudik-Waidner Key Agreement ...... 206 6.2.3 Steer-Strawczynski-Diffie-Wiener Key Agreement ..... 209 6.2.4 Perrig's Generalised Diffie-Hellman ...... 210 6.2.5 Becker and Wille's Octopus Protocol ...... 212 6.2.6 Burmester-Desmedt Key Agreement ...... 214 6.2.7 Joux's Tripartite Diffie-Hellman ...... 215 6.2.8 Security of Generalised Diffie-Hellman ...... 216 6.2.9 Efficiency of Generalised Diffie-Hellman ...... 217 6.3 Conference Key Agreement Protocols ...... 219 6.3.1 Authenticating Generalised Diffie-Hellman ...... 219 6.3.2 Klein-Otten-Beth Protocol ...... 220 6.3.3 Authenticated GDH Protocols ...... 221 6.4 Identity-Based Conference Key Protocols ...... 225 6.4.1 Koyama and Ohta Protocols ...... 226 6.4.2 Protocols of Saeednia and Safavi-Naini ...... 229 6.5 Conference Key Agreement without Diffie-Hellman ...... 230 6.5.1 Pieprzyk and Li's Key Agreement Protocol ...... 230 6.5.2 Tzeng-Tzeng Protocols ...... 232 6.5.3 Boyd's Conference Key Agreement ...... 233 6.6 Conference Key Transport Protocols ...... 235 6.6.1 Burmester-Desmedt Star and Tree Protocols ...... 235 6.6.2 Mayer and Yung's Protocols ...... 237 6.6.3 Key Hierarchies ...... 239 6.7 Key Broadcasting Protocols ...... 240 6.7.1 Key Broadcasting Using Number Theory ...... 242 6.7.2 Key Broadcasting Using Secret Sharing ...... 244 6.8 Conclusion ...... 245 XVI Contents

7 Password-Based Protocols ...... 247 7.1 Introduction ...... 247 7.2 Using Diffie-Hellman ...... 250 7.2.1 Bellovin-Merritt's Original EKE ...... 250 7.2.2 The PAK Protocol ...... 252 7.2.3 SPEKE ...... 256 7.2.4 Katz-Ostrovsky-Yung Protocol ...... 258 7.3 Augmented EKE ...... 260 7.3.1 B-SPEKE ...... 263 7.3.2 SRP Protocol ...... 264 7.3.3 AMP Protocol ...... 265 7.4 Three-Party EKE ...... 266 7.4.1 GLNS Secret Public Key Protocols ...... 267 7.4.2 Steiner, Tsudik and Waidner Three-Party EKE ...... 271 7.5 RSA-Based Protocols ...... 273 7.5.1 RSA-Based EKE ...... 273 7.5.2 OKE and SNAPI ...... 274 7.6 Protocols Using a Server Public Key ...... 276 7.6.1 GLNS Protocols with Server Public Keys ...... 277 7.6.2 Kwon-Song Protocols ...... 278 7.6.3 Halevi-Krawczyk Protocols ...... 279 7.6.4 Three-Party Protocol of Yen and Liu ...... 280 7.7 Other Protocols ...... 282 7.7.1 Lee-Sohn-Yang-Won Protocol ...... 282 7.7.2 Anderson-Lomas Protocol ...... 283 7.7.3 Strengthening ...... 284 7.8 Conclusion ...... 285

A Standards for Authentication and Key Establishment ...... 289 A.l ISO Standards ...... 289 A.L1 ISO /IEC 9798 ...... 289 A.L2 ISO/IEC 11770 ...... 290 A.L3 ISO 9594-8/ITU X.509 ...... 290 A.2 Other Standards ...... 290 A.2.1 IETF Standards ...... 290 A.2.2 IEEE P1363-2000 ...... 291 A.2.3 NIST and ANSI Standards ...... 291

B Summary of Notation ...... 293

References ...... 295

Index of Protocols ...... 317

General Index ...... 319 List of Protocols

1.1 First protocol attempt in conventional notation ...... 3 1.2 A protocol in an unusual class ...... 14 1.3 Use of a nonce (random challenge) ...... 22 1.4 A protocol vulnerable to reflection attack...... 26 1.5 Otway-Rees protocol ...... 28 1.6 A protocol vulnerable to certificate manipulation (MTI protocol) 30 2.1 Example protocol ...... 34 2.2 A simple authentication protocol...... 38 2.3 Another simple authentication protocol ...... 39 2.4 STS protocol ...... 44 2.5 STS protocol modified to include identifiers...... 45 2.6 A protocol in which A takes 'responsibility' ...... 49 2.7 A protocol in which A takes 'credit' ...... 49 2.8 Key transport protocol providing forward secrecy...... 51 2.9 Server-based protocol providing forward secrecy...... 51 3.1 Bird et al. canonical protocol 1 ...... 75 3.2 Bellare-Rogaway MAPI protocol...... 76 3.3 Protocol for attacking MAPI protocol ...... 76 3.4 ISO /lEC 9798-2 one-pass unilateral authentication protocol. . .. 77 3.5 ISO/IEC 9798-2 two-pass unilateral authentication protocol ... 78 3.6 ISO /lEC 9798-2 two-pass mutual authentication protocol...... 78 3.7 ISO/IEC 9798-2 three-pass mutual authentication protocol .... 78 3.8 Woo-Lam unilateral authentication protocol...... 79 3.9 Andrew secure RPC protocol ...... 81 3.10 Revised Andrew protocol of Burrows et al ...... 82 3.11 Janson-Tsudik 2PKDP protocol ...... 83 3.12 Boyd two-pass protocol ...... 84 3.13 ISO/IEC 11770-2 Key Establishment Mechanism 1 ...... 84 3.14 ISO /lEC 11770-2 Key Establishment Mechanism 2 ...... 84 3.15 ISO/IEC 11770-2 Key Establishment Mechanism 3 ...... 85 3.16 ISO /lEC 11770-2 Key Establishment Mechanism 4 ...... 85 XVIII List of Protocols

3.17 ISO/IEC 11770-2 Key Establishment Mechanism 5 ...... 85 3.18 ISO/IEC 11770-2 Key Establishment Mechanism 6 ...... 86 3.19 Needham-Schroeder shared key protocol ...... 88 3.20 Denning-Sacco protocol...... 88 3.21 Bauer-Berson-Feiertag protocol ...... " 88 3.22 Otway-Rees protocol ...... " 89 3.23 Otway-Rees protocol modified by Burrows et al ...... 90 3.24 Otway-Rees protocol modified by Abadi and Needham ...... 91 3.25 Basic Kerberos protocol...... 92 3.26 Optional Kerberos message to complete mutual authentication. 92 3.27 ISO /IEC 11770-2 Key Establishment Mechanism 10 ...... 93 3.28 ISO /IEC 11770-2 Key Establishment Mechanism 12 ...... 94 3.29 ISO /IEC 11770-2 Key Establishment Mechanism 13 ...... 94 3.30 Wide-mouthed-frog protocol ...... 94 3.31 Yahalom protocol ...... 95 3.32 Yahalom protocol modified by Burrows et al ...... 96 3.33 Janson-Tsudik 3PKDP protocol ...... 98 3.34 Janson-Tsudik optimised 3PKDP protocol ...... 98 3.35 Bellare-Rogaway 3PKD protocol ...... 99 3.36 Woo-Lam key transport protocol ...... " 99 3.37 Gong's timestamp-based protocol ...... 100 3.38 Gong's nonce-based protocol ...... 100 3.39 Alternative Gong's protocol ...... 101 3.40 Boyd key agreement protocol ...... 101 3.41 Gong's hybrid protocol ...... 102 3.42 Gong's simplified multi-server protocol ...... 104 3.43 Chen-Gollmann-Mitchell multi-server protocol ...... 105 4.1 ISO /IEC 9798-3 one-pass unilateral authentication ...... 110 4.2 ISO /IEC 9798-3 two-pass unilateral authentication ...... 111 4.3 ISO /IEC 9798-3 two-pass mutual authentication ...... 111 4.4 ISO /IEC 9798-3 three-pass mutual authentication ...... 112 4.5 Early version of ISO /IEC 9798-3 three-pass mutual authentication ...... 112 4.6 ISO /IEC 9798-3 two-pass parallel authentication ...... 113 4.7 SPLICE/AS protocol ...... 114 4.8 Clark-Jacob variant of SPLICE/ AS ...... 114 4.9 Gray variant of SPLICE/AS ...... 115 4.10 ISO/IEC 11770-3 Key Transport Mechanism 1 ...... 116 4.11 ISO /IEC 11770-3 Key Transport Mechanism 2 ...... 117 4.12 ISO /IEC 11770-3 Key Transport Mechanism 3 ...... 118 4.13 Denning-Sacco public key protocol ...... 118 4.14 ISO /IEC 11770-3 Key Transport Mechanism 4 ...... 118 4.15 ISO/IEC 11770-3 Key Transport Mechanism 5 ...... 119 4.16 ISO /IEC 11770-3 Key Transport Mechanism 6 ...... 119 4.17 Helsinki protocol ...... 120 List of Protocols XIX

4.18 Blake-Wilson-Menezes provably secure key transport protocol.. 121 4.19 Needham-Schroeder public key protocol ...... 121 4.20 Lowe's variant of Needham-Schroeder public key protocol ..... 122 4.21 X.509 one-pass authentication ...... 123 4.22 X.509 two-pass authentication ...... 123 4.23 X.509 three-pass authentication ...... 124 4.24 Simplified TLS key transport protocol ...... 125 4.25 Simplified TLS key agreement protocol ...... 126 4.26 Basic MSR protocol of Beller, Chang and Yacobi ...... 127 4.27 Improved IMSR protocol of Carlsen ...... 128 4.28 Beller-Yacobi protocol ...... 129 4.29 Improved Beller-Yacobi protocol ...... 130 4.30 Carlsen's improved Beller-Chang-Yacobi MSR + DH protocol. 131 4.31 Simplified TMN protocol (KDP2) ...... 132 4.32 AKA protocol ...... 132 5.1 Diffie-Hellman key agreement ...... 141 5.2 Agnew-Mullin-Vanstone protocol ...... 145 5.3 Original Nyberg-Rueppel protocol ...... 145 5.4 Revised Nyberg-Rueppel protocol ...... 146 5.5 Lim-Lee protocol using static Diffie-Hellman ...... 147 5.6 MTI A(O) protocol ...... 148 5.7 MTI A(k) protocol ...... 148 5.8 Modified MTI B(O) protocol ...... 151 5.9 KEA protocol ...... 157 5.10 Unified Model key agreement ...... 158 5.11 MQV protocol ...... 159 5.12 Ateniese--Steiner-Tsudik key agreement ...... 161 5.13 Just-Vaudenay-Song-Kim protocol ...... 162 5.14 Generic addition of key confirmation to basic DH protocols .... 164 5.15 STS protocol ...... 166 5.16 Modified STS protocol ...... 167 5.17 STS protocol using MACs ...... 168 5.18 Oakley aggressive mode protocol ...... 169 5.19 Alternative Oakley protocol ...... 170 5.20 Oakley conservative protocol ...... 171 5.21 SKEME protocol basic mode ...... 173 5.22 IKE main protocol using digital signatures ...... 176 5.23 Arazi's key agreement protocol ...... 178 5.24 Lim-Lee Schnorr-based protocol...... 179 5.25 Lim-Lee Schnorr-based variant ...... 180 5.26 Hirose-Yoshida key agreement protocol ...... 181 5.27 Okamoto's identity-based protocol ...... 184 5.28 Okamoto-Tanaka identity-based protocol ...... 186 5.29 Gunther's key agreement protocol ...... 187 5.30 Gunther's extended key agreement protocol ...... 188 XX List of Protocols

5.31 Saeednia's variant of Gunther's key agreement protocol ...... 189 5.32 Girault's identity-based protocol ...... 190 5.33 Yacobi-Shmuely protocol ...... 191 5.34 Park key agreement protocol ...... 192 5.35 ASPeCT protocol ...... 193 5.36 Jakobsson-Pointcheval protocol ...... 194 5.37 Wong-Chan protocol ...... 195 5.38 SKEME protocol without forward secrecy ...... 197 6.1 Ingemarsson-Tang-Wong generalised Diffie-Hellman ...... 206 6.2 Steiner-Tsudik-Waidner GDH.1 ...... 207 6.3 Steiner-Tsudik-Waidner GDH.2 ...... 207 6.4 Steiner-Tsudik-Waidner GDH.3 ...... 209 6.5 Steer-Strawczynski-Diffie-Wiener generalised Diffie-Hellman .. 210 6.6 Perrig's generalised Diffie-Hellman ...... 212 6.7 Four-principal basic Octopus protocol ...... 213 6.8 Burmester-Desmedt generalised Diffie-Hellman with broadcasts 214 6.9 Burmester-Desmedt pairwise generalised Diffie-Hellman ...... 216 6.10 Ateniese-Steiner-Tsudik A-GDH.2 ...... 222 6.11 Protocol 6.10 when m = 4 ...... 223 6.12 Ateniese-Steiner-Tsudik SA-GDH.2 ...... 224 6.13 Koyama--Ohta type 1 identity-based conference key agreement . 227 6.14 Saeednia-Safavi-Naini identity-based conference key agreement. 230 6.15 Tzeng and Tzeng's conference key agreement ...... 233 6.16 Boyd's conference key agreement ...... 234 6.17 Burmester-Desmedt star protocol ...... 236 6.18 Hirose-Yoshida conference key transport protocol ...... 236 6.19 Mayer-Yung conference key transport protocol ...... 238 6.20 Chiou-Chen's key broadcasting ...... 243 6.21 Key broadcasting using secret sharing ...... 244 7.1 Diffie-HeIlman-based EKE protocol ...... 250 7.2 PAK protocol ...... 254 7.3 PPK protocol ...... 255 7.4 PAK-R protocol ...... 256 7.5 SPEKE protocol ...... 257 7.6 Katz-Ostrovsky-Yung protocol ...... 259 7.7 Augmented Diffie-HeIlman-based EKE protocol ...... 261 7.8 PAK-Y protocol ...... 262 7.9 B-SPEKE protocol ...... 263 7.10 SRP protocol ...... 264 7.11 AMP protocol ...... 266 7.12 GLNS secret public key protocol ...... 267 7.13 Simplified GLNS secret public key protocol ...... 269 7.14 Optimal GLNS secret public key protocol ...... 271 7.15 Steiner, Tsudik and Waidner three-party EKE ...... 271 7.16 SNAPI protocol ...... 275 List of Protocols XXI

7.17 GLNS compact protocol ...... 277 7.18 Optimal GLNS nonce-based protocol ...... 278 7.19 K won-Song basic protocol ...... 279 7.20 Halevi-Krawczyk password-based protocol ...... 280 7.21 Yen-Liu protocol ...... 281 7.22 Lee-Sohn-Yang-Won protocol ...... 282 7.23 Anderson-Lomas protocol ...... 283 List of Attacks

1.1 Reflection attack on Protocol 1.4 ...... 26 1.2 Typing attack on Otway-Rees protocol...... 29 1.3 Certificate manipulation attack on MTI protocol ...... 30 2.1 Attack on Protocol 2.1 ...... 34 2.2 An attack on Protocol 2.2 ...... 39 2.3 Lowe's attack on Protocol 2.5 ...... 45 3.1 An oracle attack on Protocol 3.1 ...... 76 3.2 Chosen protocol attack on MAP1 ...... 77 3.3 Abadi's attack on Protocol 3.8 ...... 79 3.4 Clark-Jacob attack on Andrew protocol ...... 81 3.5 Lowe's attack on revised Andrew protocol ...... 82 3.6 Attack on Otway-Rees protocol without plaintext checking . . .. 89 3.7 Attack on Otway-Rees protocol modified by Burrows et al. . .. 90 3.8 Attack on Wide-mouthed-frog protocol...... 95 3.9 Syverson's attack on modified Yahalom protocol ...... 97 3.10 Alternative Syverson's attack on modified Yahalom protocol ... 97 3.11 Insider attack on Protocol 3.41 ...... 102 4.1 Canadian attack on Protocol 4.5 ...... 112 4.2 Attack of Clark-Jacob on SPLICE/AS protocol ...... 114 4.3 Attack on Helsinki protocol ...... 120 4.4 Lowe's attack on Needham-Schroeder public key protocol ..... 122 4.5 Attack on Beller-Yacobi protocol ...... 130 4.6 Abadi's attack on AKA protocol ...... 133 5.1 Attack on basic Diffie-Hellman ...... 142 5.2 Small subgroup attack on MTI C(1) protocol ...... 150 5.3 Unknown key-share attack on MTI B(O) protocol ...... 150 5.4 Lim-Lee attack on MTI A(O) ...... 152 5.5 Just-Vaudenay impersonation attack on MTI A(O) protocol ... 153 5.6 Key compromise impersonation on MTI C(O) ...... 155 5.7 Unknown key-share attack on generic protocol ...... 156 5.8 Kaliski's unknown key-share attack on MQV protocol ...... 160 XXIV List of Attacks

5.9 Key compromise impersonation on Just-Vaudenay-Song-Kim protocol ...... 163 5.10 Attack on Park key agreement ...... 192 7.1 Ding and Horster's attack on Protocol 7.15 ...... 272 7.2 Lin-Sun-Hwang attack on Protocol 7.15 ...... 272 7.3 Attack on Protocol 7.21 ...... 281