Abstract:For Key Encapsulation Mechanism (KEM) deployed in a multi-user setting, an adversary may corrupt some users to learn their secret keys, and obtain some encapsulated keys due to careless key managements of users. To resist such attacks, we formalize Enhanced security against Chosen Plaintext/Ciphertext Attack (ECPA/ECCA), which ask the pseudorandomness of unrevealed encapsulated keys under uncorrupted users. This enhanced security for KEM serves well for the security of a class of Authenticated Key Exchange protocols built from KEM. In this paper, we study the achievability of tight ECPA and ECCA security for KEM in the multi-user setting, and present an impossibility result and an optimal security loss factor that can be obtained. The existing meta-reduction technique due to Bader et al. (EUROCRYPT 2016) rules out some KEMs, but many well-known KEMs, e.g., Cramer-Shoup KEM (SIAM J. Comput. 2003), Kurosawa-Desmedt KEM (CRYPTO 2004), run out. To solve this problem, we develop a new technique tool named rank of KEM and a new secret key partitioning strategy for meta-reduction. With this new tool and new strategy, we prove that KEM schemes with polynomially-bounded ranks have no tight ECPA and ECCA security from non-interactive complexity assumptions, and the security loss is at least linear in the number n of users. This impossibility result covers lots of well-known KEMs, including the CramerShoup KEM, Kurosawa-Desmedt KEM and many others. Moreover, we show that the linear security loss is optimal by presenting concrete KEMs with security loss T(n). This is justified by a non-trivial security reduction with linear loss factor from ECPA/ECCA security to the traditional multi-challenge CPA/CCA security.

Security Weakness of Flexible Group Key Exchange with On-Demand Computation of Subgroup Keys

A Group Key Agreement Protocol Based on ECDH and Short Signature

On the Security of a Group Key Agreement Protocol and Its Improvement with Pairings

Defending Against Key Exposure in Attribute-Based Encryption

On Security Analysis of an After-the-fact Leakage Resilient Key Exchange Protocol

Stronger Security Model of Group Key Agreement.

Cryptanalysis of a Simple Three-party Key Exchange Protocol

A generalization of Burmester-Desmedt GKE based on a non-abelian finite group action

A improved scheme for authenticated group key exchange

Security improvements on an efficient group key agreement protocol

Efficient Completely Non-Malleable and RKA Secure Public Key Encryptions

Efficient Password-Based Authenticated Group Key Exchange Protocol

Proving the (In)Security of CRT Based Key Management Schemes Under SAOA Model

Comments on 'chinese Remainder Theorem-based Centralised Group Key Management for Secure Multicast Communication'

Security Analysis on S-3PAKE Protocol

Password-based Dynamic Group Key Agreement

Key Encapsulation Mechanism with Tight Enhanced Security in the Multi-user Setting: Impossibility Result and Optimal Tightness

A Security Patch for a Three-Party Key Exchange Protocol

Analyses of Several Recently Proposed Group Key Management Schemes

Threshold password-based authenticated group key exchange in gateway-oriented setting

Key Replacement Attack Against A Generic Construction Of Certificateless Signature