Al-Riyami and Paterson’s Protocol Sample Clauses

Al-Riyami and Paterson’s Protocol. ‌ Al-Riyami and Paterson [1] introduced in their paper on certificateless public key cryp- tography a simple certificateless authenticated two-party key agreement protocol. The initialization of the protocol is formally specified using the algorithms of certificateless public key cryptography [1]. These include Setup, Partial-Private-Key-Extract, Set-Secret-Value, Set-Private-Key, and Set-Public Key. These algorithms are ex- plained in detail in Appendix A.1. Assume that entities A and B wish to agree on a secret key. They first each choose the random ephemeral values a, b ∈ Zq∗ as usual, and create the corresponding ephemeral public keys aP, bP ∈ G1 respectively. A then sends the ephemeral key TA = aP and A’s public key PA = ⟨XA, YA⟩ to B, who then in the same fashion responds with TB = bP and PB = ⟨XB, YB⟩ to A. Here, Xi = xiP and Yi = xiP0 = xisP, where xi is an entity’s long-term secret value and s is the KGC master key. a ∈ Z∗q TA, ⟨XA, YA⟩ b ∈ Z∗q → ê(XB, P0)? = ê(YB , P) −−−−−−−−−−−−− TB, ⟨XB, YB⟩ ê(XA, P0)? = ê(YA , P) KA = ê(QB , YB )a · ê(SA, TB) ←−−−−−−−−−−−−− KB = ê(QA , YA )b · ê(SB, TA) K = KA = KB = ê(SB, TA) · ê(SA, TB) FK = H(K abP) Figure 7: Al-Riyami and Paterson’s Protocol Once the messages are exchanged, both users verify that the same KGC master key has been used in each other’s public keys. A checks if ê(XB, P0) = ê(YB, P) and B checks if ê(XA, P0) = ê(YA, P). See that ê(xiP, sP) = ê(xisP, P) = ê(xiP, P)s. A then computes KA = ê(QB, YB)a · ê(SA, TB) and B computes KB = ê(QA, YA)b · ê(SB, TA), such that K = KA = KB becomes the shared key between A and B. Both entities then compute the → session key FK = H1(K abP) where H1 : G2 × G1 {0, 1}k. As pointed out by the authors, the protocol is vulnerable to a man-in-the-middle attack if the KGC replaces both the short-term and long-term public keys exchanged in a proto- col run. The reason only a KGC can mount such an attack is because the corresponding (partial) private key must be obtained in order to compute K. However, such an attack can be mounted on all certificateless schemes, and therefore it must be assumed that the KGC is trusted not to replace public keys. Note that the protocol may be weak against denial-of-service attacks as an adversary with no attachment to the KGC, may efficiently compute valid public keys simply by knowing (P, P0) and repeatedly query the victim to compute keys. For each key received, the victim will need to compute four pairings, and thus the computational ...