| Foreword | 6 |
|---|
| Preface | 8 |
|---|
| Comments and Errata | 9 |
| Acknowledgements | 10 |
|---|
| Contents | 12 |
|---|
| List of Protocols | 18 |
|---|
| List of Attacks | 20 |
|---|
| List of Figures | 21 |
|---|
| List of Tables | 22 |
|---|
| Introduction | 23 |
|---|
| 1.1 The Key Distribution Problem | 23 |
| 1.2 Solution: Key Establishment Protocols | 25 |
| 1.2.1 Computer Security Approach | 26 |
| 1.2.2 Computational Complexity Approach | 27 |
| 1.2.3 Research Objectives and Deliverables | 28 |
| 1.3 Structure of Book and Contributions to Knowledge | 28 |
| References | 32 |
| Background Materials | 41 |
|---|
| 2.1 Mathematical Background | 41 |
| 2.1.1 Abstract Algebra and the Main Groups | 41 |
| 2.1.2 Bilinear Maps from Elliptic Curve Pairings | 42 |
| 2.1.3 Computational Problems and Assumptions | 43 |
| 2.1.4 Cryptographic Tools | 45 |
| 2.2 Key Establishment Protocols and their Basis | 51 |
| 2.2.1 Protocol Architectures | 52 |
| 2.2.2 Protocol Goals and Attacks | 55 |
| 2.3 The Computational Complexity Approach | 60 |
| 2.3.1 Adversarial Powers | 61 |
| 2.3.2 Definition of Freshness | 63 |
| 2.3.3 Definition of Security | 63 |
| 2.3.4 The BellareÒRogaway Models | 64 |
| 2.3.5 The CanettiÒKrawczyk Model | 68 |
| 2.3.6 Protocol Security | 70 |
| 2.4 Summary | 71 |
| References | 71 |
| A Flawed BR95 Partnership Function | 78 |
|---|
| 3.1 A Flaw in the Security Proof for 3PKD Protocol | 79 |
| 3.1.1 The 3PKD Protocol | 79 |
| 3.1.2 Key Replicating Attack on 3PKD Protocol | 80 |
| 3.1.3 The Partner Function used in the BR95 Proof | 81 |
| 3.2 A Revised 3PKD Protocol in Bellare Rogaway Model | 83 |
| 3.2.1 Defining SIDs in the 3PKD Protocol | 83 |
| 3.2.2 An Improved Provably Secure 3PKD Protocol | 83 |
| 3.2.3 Security Proof for the Improved 3PKD Protocol | 84 |
| 3.3 Summary | 91 |
| References | 91 |
| On The Key Sharing Requirement | 92 |
|---|
| 4.1 Bellare Rogaway 3PKD Protocol in CK2001 Model | 93 |
| 4.1.1 The 3PKD Protocol | 93 |
| 4.1.2 New Attack on 3PKD Protocol | 94 |
| 4.1.3 A New Provably-Secure 3PKD Protocol in CK2001 Model | 95 |
| 4.2 Jeong Katz Lee ProtocolT S2 | 97 |
| 4.2.1 ProtocolT S2 | 97 |
| 4.2.2 New Attack on ProtocolT S2 | 98 |
| 4.2.3 An Improved ProtocolT S2 | 98 |
| 4.3 The Key Sharing Requirement | 99 |
| 4.4 Summary | 101 |
| References | 101 |
| Comparison of Bellare Rogaway and Canetti Krawczyk Models | 104 |
|---|
| 5.1 Relating The Notions of Security | 107 |
| 5.1.1 Proving BR93 (EA+KE) . BPR2000 ( EA+ KE) | 109 |
| 5.1.2 Proving CK2001 . BPR2000 ( KE) | 111 |
| 5.1.3 Proving CK2001 . BR93 ( KE) | 112 |
| 5.1.4 BR93 (KE) . BR95 and BR93 ( KE), CK2001 BR95 | 113 |
| 5.1.5 BR93 (KE) / CK2001 BPR2000 (KE) | 114 |
| 5.1.6 CK2001 BR93 (EA+KE) | 114 |
| 5.1.7 BR93 (KE) CK2001 | 115 |
| 5.1.8 BPR2000 (KE) BR95 | 117 |
| 5.2 A Drawback in the BPR2000 Model | 117 |
| 5.2.1 Case Study: AbdallaÒPointcheval 3PAKE | 117 |
| 5.2.2 Unknown Key Share Attack on 3PAKE | 118 |
| 5.3 Summary | 120 |
| References | 120 |
| An Extension to the Bellare Rogaway Model | 122 |
|---|
| 6.1 A Provably-Secure Revised Protocol of Boyd | 123 |
| 6.1.1 Secure Authenticated Encryption Schemes | 123 |
| 6.1.2 Revised Protocol of Boyd | 124 |
| 6.1.3 Security Proof | 125 |
| 6.2 An Extension to the BR93 Model | 129 |
| 6.3 An Efficient Protocol in Extended Model | 131 |
| 6.3.1 An Efficient Protocol | 131 |
| 6.3.2 Security Proof | 132 |
| 6.4 Comparative Security and Efficiency | 135 |
| 6.5 Summary | 136 |
| References | 137 |
| A Proof of Revised Yahalom Protocol | 138 |
|---|
| 7.1 The Yahalom Protocol and its Simplified Version | 139 |
| 7.2 A New Provably-Secure Protocol | 140 |
| 7.2.1 Proof for Protocol 7.2 | 141 |
| 7.2.2 An Extension to Protocol 7.2 | 144 |
| 7.3 Partnering Mechanism: A Brief Discussion | 145 |
| 7.4 Summary | 147 |
| References | 148 |
| Errors in Computational Complexity Proofs for Protocols | 150 |
|---|
| 8.1 Boyd Gonz ´ alez Nieto Protocol | 151 |
| 8.1.1 Unknown Key Share Attack on Protocol | 152 |