Protocol Analysis. De nition 5. A node of the IG-tree is common with value v if every correct player computes the same value v for in the data conversion phase. The subtree rooted at node has a common frontier if every path from to a leaf contains at least one common node.
Protocol Analysis. We rst show that if in any run (FOR-loop in the above protocol) Byzantine agree- ment is achieved, then the agreement remains persistent (with the same value) for any following run. The following lemma follows immediately by Xxxxx 2.
Protocol Analysis. In the proposed key agreement protocol, the idea of ID-based schemes is used for mutual authenti- cation and key establishment. The key agreement procedure has the features that authentication can be efficiently achieved without the aid of a trusted third party or a public information center, and the load of key agreement is balanced and distributed among all group members. It does not have the con- spiracy problem existing in the Tsujii’s15 scheme because its security relies on the difficulty of com- puting the discrete logarithm problem. If a forger wants to persuade member i to join the group, he must find two integers X and Y satisfying the verification of equation (7). The use of low public exponents in this equation does not lower the diffi- culty to crack (Y,X). Although the forger can get a pair of integers (Y3,X2) to make the equation hold, the pair (Y,X) is unattainable because computing (Y,X) from (Y3,X2) is a discrete logarithm problem. Hastad16 proposed an attack on RSA with low exponents in a public key system. The attack will not succeed in our key agreement procedure, since the same modulus n is used for all members. An outsider, even a departed member, cannot crack the common group key, since he has no idea of all gf(ri ,Ci ) to compute the group key. Although a departed member has the old group key, he is unable to get the new gf(rri ,Cri ), which is regenerated after the member has left, to derive the new group key. Suppose an intruder has intercepted a pair (YA, XA) of the key agreement procedure between members A and B, he then chooses a random number R and computes a new pair = = (YrA YAR2, XrA XAR3). If the intruder sends the new pair (YrA, XrA) to member B, the verification of equation (7) will success because
Protocol Analysis. Beyond the security of the system, the complexity of the protocol (communication and computation) has always been an important issue when designing group key man- agement systems. In ad hoc wireless networks, both com- munication costs and computation costs are important factors that should be taken into account when designing a secure protocol. On the one hand, the mobile devices are often small and portable, and therefore, do not have much memory or computational power and they are probably not tamper-resistant. On the other hand, the connections in ad hoc networks are usually unreliable. Consequently, the number and size of messages should be reduced as much as possible, especially multi-hop messages. In A- DTGKA protocol, the total required computations are distributed among all the group members, which reduces the required computation power for each member. Al- though the number of required messages may be larger than that of the flat settings (GDH.2, Hypercube, Octo- pus, etc.), most of the manipulated messages are one hop very costly (signature and verification), whereas the mu- tual authentication provided by our protocol which uses indentity-based pairwise keys partially addresses some these issues and constraints.
Protocol Analysis. This section discusses the strength of the ALPKA 1 and ALPKA 2 proto- cols against the required security features of a proxy re-encryption scheme, as mentioned in Section 3. – Directionality: In the case of the ALPKA 1 scheme, where the proxy needs to receive a re-encryption key of the KDC, the scheme is bidirectional.
Protocol Analysis
