Key Confirmation Sample Clauses

Key Confirmation. ‌ In authenticated protocols (AK), A will merely get the assurance of that B is the only party that is able the compute the shared key. However, in many cases it is also desirable to know if B has actually computed the shared key. Similarily, B would also want the assurance of that A has computed the shared key. This can be achieved by implementing key confirmation methods. Key confirmation ensures explicit authentication of messages. Xxxxxxxx identified in [36] a generic attack against forward secrecy on any interactive two-party key agreement protocol that only implicitly authenticates messages. In the attack, the adversary first masquerades as A and sends the inital message TA to B. B then replies with TB and completes the session with some key K. Once the session key expires at B, the adversary corrupts A, obtains the private key SA, and finally computes the agreed session key. In AKC protocols, key confirmation is usally provided by adding an extra pass and adding the MAC of the flow number, identities, and the ephemeral public keys. The MACs are computed under a shared key k′, which is different from the session key k. If the same key was used in both cases, a passive adversary would be able to learn some information about k. The adversary could then distinguish k from a key selected uniformly at random from the key space. [6] presents a provable secure AKC scheme (unified model) which many AK schemes [44, 42, 15, 58] has adopted. In this scheme, message authentication codes (MAC) are used in the Xxxxxx-Xxxxxxx scheme to provide key confirmation. MACs are computation- ally efficient and very easy to employ in protocols. Let A and B be two entities that wish to establish a shared secret key. A first selects a ∈ Zq∗ uniformly at random and sends ga to B. On reciept, B verifies that ga ∈ [2, p − 1] and (ga)q = 1, and then in the same way selects b ∈ Z∗q and computes gb. B then computes the MAC key κ′ = H1(gab) and uses κ′ to compute MACκ' (2, B, A, gb, ga), and sends the authenticated message to A. On reciept, A checks the validity of gb, computes κ′ and verifies the authenticated message. If the MAC is ok, A sends back MACκ' (3, A, B, ga, gb) to B, who then checks and verifies the message. Both parties now compute the agreed session key using a different hash function, κ = H2(gab). ga A −−− B −−−−−−−−−−−−−−−−−−− B A gb,MACκ ' (2→,B,A,gb,ga) ← MACκ ' (3,A,B,ga,gb) → A −−−−−−−−−−−−−−−− B Alternatively, k and k′ may be computed under both the ephemeral an...