Abstract:In two-message authenticated key exchange (AKE), it is necessary for the initiator to keep a round state after sending the first round-message, because he/she has to derive his/her session key after receiving the second round-message. Up to now almost all two-message AKEs constructed from public-key encryption (PKE) only achieve weak security which does not allow the adversary obtaining the round state. How to support state reveal to obtain a better security called IND-AA security has been an open problem proposed by Hovelmann et al. (PKC 2020). In this paper, we solve the open problem with a generic construction of two-message AKE from any CCA-secure Tagged Key Encapsulation Mechanism (TKEM). Our AKE supports state reveal and achieves IND-AA security. Given the fact that CCA-secure public-key encryption (PKE) implies CCA-secure TKEM, our AKE can be constructed from any CCA-secure PKE with proper message space. The abundant choices for CCA-secure PKE schemes lead to many IND-AA secure AKE schemes in the standard model. Moreover, following the online-extractability technique in recent work by Don et al. (Eurocrypt 2022), we can extend the Fujisaki-Okamoto transformation to transform any CPA-secure PKE into a CCA-secure Tagged KEM in QROM. Therefore, we obtain the first generic construction of IND-AA secure two-message AKE from CPA-secure PKE in QROM. This construction does not need any signature scheme, and this result is especially helpful in the post-quantum world, since the current quantum-secure PKE schemes are much more efficient than their signature counterparts.

Security analysis of the eCK model

On Security Analysis of an After-the-fact Leakage Resilient Key Exchange Protocol

Strongly Secure Two Party Authenticated Key Agreement Scheme

Provably Secure Authenticated Key Exchange Protocol under the CDH Assumption

Research and Improvement on EAP-AKA

Provably secure identity-based two-party authenticated key agreement protocol

An efficient two-factor authentication protocol based on elliptic curve cryptosystem with provable security

Two-Pass Authenticated Key Exchange with Explicit Authentication and Tight Security.

Provably secure and efficient certificateless authenticated tripartite key agreement protocol.

Efficient Identity-Based and Authenticated Key Agreement Protocol

Authenticated Key Exchange and Signatures with Tight Security in the Standard Model.

Strongly Secure Identity-Based Authenticated Key Agreement Protocols in the Escrow Mode

Security Analysis and Enhancement for Three-Party Password-Based Authenticated Key Exchange Protocol.

Two-Message Authenticated Key Exchange from Public-Key Encryption.

On the design of provably secure identity-based authentication and key exchange protocol for heterogeneous wireless access

Revisiting OAKE in the Eck Security Model

Provably Secure Three-Party Password Authenticated Key Exchange Protocol in the Standard Model.

An improved and provable remote user authentication scheme based on elliptic curve cryptosystem with user anonymity

ECC-Based Authenticated Key Agreement Protocol for Industrial Control System

Authenticated Key Exchange from Ideal Lattices

Privacy-Enhancing Authenticated Key Agreement Protocols Based on Elliptic Curve Cryptosystem