Protocol Analysis. We rst show that if in any run (FOR-loop in the above protocol) Byzantine agree- ment is achieved, then the agreement remains persistent (with the same value) for any following run. The following lemma follows immediately by Xxxxx 2.
Protocol Analysis. This section discusses the strength of the ALPKA 1 and ALPKA 2 proto- cols against the required security features of a proxy re-encryption scheme, as mentioned in Section 3.
Fig. 4 Schematic overview of the cryptographic operations in the second part of the ReEn- crypt phase and the DeCrypt phase, performed by the proxy Pk and receiver Uj . Both for the communication from Ui to Uj and vice versa, the re-encryption scheme is similar, due to construction, i.e. rkij = (h(si Bj) · h(sj Bi))−1 = rkji = (h(sj Bi) · h(si Bj))−1 In the ALPKA 2 scheme, this feature is not applicable since there is no re-encryption key used. – Interactivity: The presence of this feature is one of the main differences between ALPKA 1 and ALPKA 2 schemes. The protocol ALPKA 1 is not interactive as for the computation of the key K1 by the receiver, since the proxy first needs to use additional information (proxy re-encryption key) coming from the KDC. For the key K2 in ALPKA 2 on the other hand, it suffices to securely forward the random value Ni, generated by the sending entity. Unfortunately, we explain later that it is not possible to combine the non-interactive property with a collusion resistant feature.
Protocol Analysis. De nition 5. A node of the IG-tree is common with value v if every correct player computes the same value v for in the data conversion phase. The subtree rooted at node has a common frontier if every path from to a leaf contains at least one common node.
Lemma 1. For any adversary structure over a player subset S ) and any adversary set A , the restricted adversary structure c A Corollary 1. If the adversary structure ) then for every internal node of the IG-tree,
Protocol Analysis. De nition 5. A node of the IG-tree is common with value v if every correct player computes the same value v for in the data conversion phase. The subtree rooted at node has a common frontier if every path from to a leaf contains at least one common node.
Lemma 1. For any adversary structure over a player subset S , the restricted adversary structure (S nA) (S nA)). A A j 1
k 1 A A A; (S nA)).
Corollary 1. If the adversary structure over the player set P satis es Qk(P; ) then for every internal node of the IG-tree, satis es Qk-1(C( );
Protocol Analysis. In the proposed key agreement protocol, the idea of ID-based schemes is used for mutual authenti- cation and key establishment. The key agreement procedure has the features that authentication can be efficiently achieved without the aid of a trusted third party or a public information center, and the load of key agreement is balanced and distributed among all group members. It does not have the con- spiracy problem existing in the Tsujii’s15 scheme because its security relies on the difficulty of com- puting the discrete logarithm problem. If a forger wants to persuade member i to join the group, he must find two integers X and Y satisfying the verification of equation (7). The use of low public exponents in this equation does not lower the diffi- culty to crack (Y,X). Although the forger can get a pair of integers (Y3,X2) to make the equation hold, the pair (Y,X) is unattainable because computing (Y,X) from (Y3,X2) is a discrete logarithm problem. Hastad16 proposed an attack on RSA with low exponents in a public key system. The attack will not succeed in our key agreement procedure, since the same modulus n is used for all members. An outsider, even a departed member, cannot crack the common group key, since he has no idea of all gf(ri ,Ci ) to compute the group key. Although a departed member has the old group key, he is unable to get the new gf(rri ,Cri ), which is regenerated after the member has left, to derive the new group key. Suppose an intruder has intercepted a pair (YA, XA) of the key agreement procedure between members A and B, he then chooses a random number R and computes a new pair = = (YrA YAR2, XrA XAR3). If the intruder sends the new pair (YrA, XrA) to member B, the verification of equation (7) will success because
Protocol Analysis. Beyond the security of the system, the complexity of the protocol (communication and computation) has always been an important issue when designing group key man- agement systems. In ad hoc wireless networks, both com- munication costs and computation costs are important factors that should be taken into account when designing a secure protocol. On the one hand, the mobile devices are often small and portable, and therefore, do not have much memory or computational power and they are probably not tamper-resistant. On the other hand, the connections in ad hoc networks are usually unreliable. Consequently, the number and size of messages should be reduced as much as possible, especially multi-hop messages. In A- DTGKA protocol, the total required computations are distributed among all the group members, which reduces the required computation power for each member. Al- though the number of required messages may be larger than that of the flat settings (GDH.2, Hypercube, Octo- pus, etc.), most of the manipulated messages are one hop very costly (signature and verification), whereas the mu- tual authentication provided by our protocol which uses indentity-based pairwise keys partially addresses some these issues and constraints.
Protocol Analysis
