Security Definitions. In this Agreement:
Security Definitions. We next characterize the security of a ConBE conspire. A few techniques have been proposed to change public key encryption (PKE) with security against picked plaintext assaults (CPA) into encryption against adaptively picked ciphertext assaults (CCA2) in the standard model. In [48], Xxxxxxx et al. recommended change from CPA secure IBE to CCA2- secure PKE utilizing a one-time signature. In [49], Xxxxxxx and Xxxxxxx proposed to acquire CCA2- secure PKE from any CPA-secure PKE with a general computational extractor. In [50], Xxx et al. acquired CCA2-secure ABE from CPA-secure ABE without additional cryptographic natives, however with an extra on-the-fly sham trait. We take note of that these techniques are appropriate to our ConBE setting with/without adjustment (e.g., by including a the-fly sham recipient). The cost relies upon the techniques, i.e., an all inclusive computational extractor, a one- time signature or a spurious client. Thus, it is adequate to just characterize the CPA security of a ConBE conspire. Nonetheless, taking note of that ConBE is intended for circulated applications where the clients are probably going to be defiled; we incorporate full intrigue obstruction into our security definition. The completely plot safe security of a ConBE conspire is characterized by the accompanying security amusement between a challenger CH and an assailant A.
Security Definitions. AD The concrete security of a three party-based scheme is built up both the property of the session key indistin- guishability [21, 22]. In the proposed scheme, the partici- pants include service requester CA and a service provider CB ∈ C = {C1, ..., CNC } and a trusted server S. Each service requesters CA and service providers CB hold se- cret keys, and the server S maintains a long-term private key. We also assume that an adversary who controls all the communications that take place by Ci , Cj and S is a probabilistic machine, where Ci is the ith instance of S8. Session key indistinguishability: For all probabilistic, j A any passive adversary who is ill and observes the ex- changed messages cannot derive the session key in a polynomial time. In the next section, we first define the security of the proposed scheme. In Section 3, we propose an efficient three-party key agreement scheme. In Section 4, we an- alyze the security of the proposed scheme. In Section 5, we analyze the efficiency among our proposed scheme and the service requester CA and CB is the jth instance of the service provider CB. AD can interact with all the partic- ipants (CA, CB, S) through the following oracle queries. A B A B •
Security Definitions. Now we define the security assumptions for the pro- posed key agreement protocol within the security model given above. The detailed definitions can be found in (X. Xxxxxxx and Xxxxxxxxxxx, 2004; J. Nam and Xxx, 0000x; Xxxx and Xxxxx, 2003). • Freshness Freshness captures the intuitive fact that a session key is not obviously known to the adversary. A session key is fresh if it has been accepted by an uncorrupted oracle and the oracle or any of its partners are not subjected to the reveal or corrupt query. • Authenticated group key agreement The security of an authenticated group key agree- ment protocol P is defined by a game G(A , P ) between the computationally bound adversary A and protocol P . The adversary A executes the protocol P and executes all the queries described in the security model, as many times as she wishes. A wins the game, if at any time it asks a single Test query to a fresh user and gets back a l-bit string as the response to the query. At a later point of time it outputs a bit b′ as a guess for the hidden bit b. Let GG (Good Guess) be the event that b = b′, i.e. the adversary A , correctly guesses the bit b. Then we define the advantage of A in attacking P , as A AdvP(k) = 0.Xx[GG] − 1 A We say that a group key agreement scheme P is secure if AdvP(k) is negligible for any probabilis- tic polynomial time adversary A . • Secure Signature Scheme The security notion for a signature scheme is that it is computationally infeasible for an adversary to produce a valid forgery σwith respect to any mes- sage m under (adaptive) chosen message attack (CMA). A signature scheme τ(G , S , V ) is (t, q, ε) secure if there is no adversary whose probabil- ity in mounting an existential forgery under CMA within time t after making q queries is greater than ε(negligible). The probability is denoted as Succτ(A ). • Secure encryption scheme A public-key encryption scheme PE = (K; E; D) consists of three algorithms: A key generation al- gorithm K giving a pair (e; d) of matching public and private keys, an encryption algorithm E, and a decryption algorithm D. The encryption scheme PE is secure if the ad- versary’s advantage is negligible. We denote the probability as Succenc(A ). Thus, we have defined the security model for the protocol definition. In the next section, we proceed to describe the detail of the proposed protocol. Proof P We now analyze the security of the protocol as the probability that an adversary can some information on the key and gain...
Security Definitions. In this section we first define the security of a group key agreement protocol and then describe the cryptographic assumptions on which the security of our protocol is based. A A
Security Definitions. Some security definitions are proposed for our protocol to provide strong security guarantees. AdvKey =| 2 Pr[Succ( A)Key ] −1 | . A 𝐴 Assuming that the advantage 𝐴𝑑𝑣𝐾𝑒𝑦 is negligible for any PPT adversary, then the protocol 𝛬 can be said to be AKA-secure.
Security Definitions. The correctness of a CBE scheme means that if all members and the sender follow the scheme honestly, then the members in the receiver set can always correctly decrypt. Formally, the correctness of a CBE scheme is defined as follows. Definition 1 (Correctness). A CBE scheme is correct if for any parameter λ ∈ N and any element ξ in the session key space, (U1(dk1), · · · , Un(dkn); gek) ← CBSetup(U1(x1), · · · , Un(xn)), and (c, ξ) ←CBEncrypt(R, gek), it holds that CBDecrypt(R, j, dkj, c) = ξ for any j ∈ R. We next define the secrecy of a CBE scheme. In the above, to achieve better practicality, a CBE scheme is modeled as a KEM in which a sender sends a (short) secret session key to the intended receivers and simultaneously, (long) messages can be encrypted using a secure symmetric encryption algorithm with the session key. Hence, we define the secrecy of a CBE scheme by the indistin- guishability of the encrypted session key from a random element in the session key space. Since there exist standard conversions (e.g., [16]) from secure KEM against chosen-plaintext attacks (CPA) to secure encryption against adaptively chosen-ciphertext attacks (CCA2), it is sufficient to only define the CPA se- crecy of CBE schemes. However, noting that CBE is designed for distributed applications where the users are likely to be corrupted, we include full collusion resistance into our secrecy definition. CH A The fully collusion-resistant secrecy of a CBE scheme is defined by the fol- lowing secrecy game between a challenger and an attacker . The secrecy game is defined as follows. CH
Security Definitions. The following security properties are commonly required in a certificateless key establishment protocols in general[5]. Known session key security. Each run of a key agreement protocol between two parties A and B should produce a unique session key. If some of the session keys were leaked,this should not compromise the key secrecy of any other session key.
Security Definitions. ∈ { } AD The concrete security of a three party-based scheme is built up both the property of the session key indistin- guishability [21, 22]. In the proposed scheme, the partici- pants include service requester CA and a service provider CB C = C1, ..., CNC and a trusted server S. Each service requesters CA and service providers CB hold se- cret keys, and the server S maintains a long-term private key. We also assume that an adversary who controls all the communications that take place by Ci , Cj and S
