Security Theorem. Let A be an adversary against the Authenticated Key Exchange (AKE) security of our protocol P, making at most qs active requests, and asking at most qH queries to the hash oracles (H0 and H1). Let N denote the total number of low-power devices. Then we have: P SIGN G Advake(A) ≤ 2N · Succcma (t, qs) + 2qsqH · Succcdh(t). The above theorem shows that the security of our protocol is based on the intractability of the well-studied computational Xxxxxx-Xxxxxxx problem (CDH) and on the security of the signature scheme (CMA) to prevent existential forgeries under adaptive chosen message attacks. C A A
Security Theorem. Let be an adversary against the Authenticated Key Exchange (AKE) se- curity of our protocol P, making at most qs active requests, and asking at most qH queries to the hash oracles ( 0 and 1). Let N denote the total number of low-power devices. Then we have: P SIGN G Advake(A) ≤ 2N · Succcma (t, qs) + 2qsqH · Succcdh(t). • H by storing many 0(x xx), xxx xxxx (xx, xx, xx), for several values of the counter, one increases efficiency, since only one XOR has to be per- formed on-line. The above theorem shows that the security of our protocol is based on the intractability of the well-studied computational Xxxxxx-Xxxxxxx problem (CDH) and on the security of the signature scheme (CMA) to prevent existential forgeries under adap- tive chosen message attacks. G · · SIGN · ·
Security Theorem. Let A be an adversary against the Authenticated Key Exchange (AKE) security of our protocol P , making at most qs active requests, and asking at most qH queries to the hash oracles (H0 and H1). Let N denote the total number of low-power devices. Then we have:
Security Theorem. Let A be an adversary against the Authenticated Key Exchange (AKE) security of our protocol P, making at most qs active requests, and asking at most qH queries to the hash oracles (H0 and H1). Let N denote the total number of low-power devices. Then we have: Advake(A) ≤ 2N · Succcma (t, qs) + 2qsqH · Succcdh(t). The above theorem shows that the security of our protocol is based on the intractability of the well-studied computational Xxxxxx-Xxxxxxx problem (CDH) and on the security of the signature scheme (CMA) to prevent existential forgeries under adaptive chosen message attacks. G SIGN Sketch of Proof. Unless the adversary breaks the signature scheme for one among the N clients (so, N · Succcma (·)), any valid message is output by a regular node, and can be simulated. We then note that the simulated flows can be derived from a CDH problem (ga, gb), while the hash values that would involve gab are answered randomly. The adversary breaks the scheme if it is able to discover which hash value corresponds to a given flow (so, qsqH · Succcdh(·)). The full proof can be found in the full version [7]. 5 Mutual Authentication and (Partial) Forward Secrecy Mutual authentication ensures each player that all other parties did actually compute the same key. Our protocol can be modified to achieve this goal. The natural modification, wherein each player sends to all the other ones an “authenticator”, requires that each low-power device com- putes N hashings and sends one flow to the server S. This computational overhead is tolerable only if N does not get too large, but for larger values of N this overhead can also be kept to a minimum by performing mutual authentication through the server. Each client authenticates to the server which then in turn authenticates to each client only after all clients have been authenticated. This approach has the attractive advantage of being not only provably secure, in the random-oracle model, but to also add little overhead to the original protocol. About forward-secrecy, it is clear that as soon as the long-term key x of the server is leaked, all the session keys can be recovered, since all the αi can easily be computed from the yi and
Security Theorem. Let A be an adversary against the Authenticated Key Exchange (AKE) security of our protocol P, making at most qs active requests, and asking at most qH queries to the hash oracles (H0 and H1). Let N denote the total number of low-power devices. Then we have: Advake(A) ≤ 2N · Succcma (t, qs) + 2qsqH · Succcdh(t). The above theorem shows that the security of our protocol is based on the intractability of the well-studied computational Xxxxxx-Xxxxxxx problem (CDH) and on the security of the signature scheme (CMA) to prevent existential forgeries under adaptive chosen message attacks. G SIGN Sketch of Proof. Unless the adversary breaks the signature scheme for one among the N clients (so, N · Succcma (·)), any valid message is output by a regular node, and can be simulated. We then note that the simulated flows can be derived from a CDH problem (ga, gb), while the hash values that would involve gab are answered randomly. The adversary breaks the scheme if it is able to discover which hash value corresponds to a given flow (so, qsqH · Succcdh(·)). The full proof can be found in the full version [7].
