Protocol preliminaries. The session-key space SK associated to this method is {0, 1}l equipped with a uniform dis- tribution, where l is a security parameter. Arithmetic is in a finite cyclic group G = g of l-bit prime order q. Both g and q are publicly known. There are also three hash func- tions H : {0, 1}٨ → {0, 1}l, H0 : {0, 1}٨ → {0, 1}l0 , where l0 needs not be equal to l, and H { } × → { }
Protocol preliminaries. The session-key space SK associated to this method is f0; 1g` equipped with a uniform dis- tribution, where ` is a security parameter. Arithmetic is in a nite cyclic group G = hg i of `-bit prime order q. Both g and q are publicly known. There are also three hash func- tions H : f0; 1g? ! f0; 1g`, H0 : f0; 1g? ! f0; 1g`0 , where `0 needs not be equal to `, and H1 : f0; 1g`1 G ! f0; 1g`0 , where `1 is the maximal bit-length of a counter c used to prevent replay attacks. We consider a signature scheme SIGN = (SIGN:KGen; SIGN:Sig; SIGN:Ver). Each client Ui holds a pair of signing private/public key (SKi;P Ki) which are the output of the key generation BasePublic keyGc = station SP KS = y f1; 2; 3; 4g = g x 1 y1 = Client U1 x1 2R Z? q = gx1 ; 1 = yx1 SIGN:Sig(SK1; y1 ) 2 y2 = Client U2 x2 2R Z? q = gx2 ; 2 = yx2 SIGN:Sig(SK2; y2 ) 3 y3 = Client U3 x3 2R Z? q = gx3 ; 3 = yx3 SIGN:Sig(SK3 ; y3 ) 4 y4 = Client U4 x4 2R Z? q = gx4 ; 4 = yx4 SIGN:Sig(SK4; y4 ) K1 = 1 = yx 1 K H1(ck 1 ) De ne K2 Base station S 2 = yx 3 = yx 2 3 Initialize a counter c = 0 2 f0; 1g`1the shared secret data K = H0(ck 1k ::: = K H1(ck 2) K3 = K H1(ck 3 k 4) ) K4 = 4 = yx 4 K H1(ck 4 ) K = K1 H1 (ck 1 ) K = K2 H1 (ck 2 ) K = K3 H1 (ck 3 ) K = K4 H1 (ck 4 ) Shared session key sk = H(KkGckS) c; K4 #
