Abstract:For Key Encapsulation Mechanism (KEM) deployed in a multi-user setting, an adversary may corrupt some users to learn their secret keys, and obtain some encapsulated keys due to careless key managements of users. To resist such attacks, we formalize Enhanced security against Chosen Plaintext/Ciphertext Attack (ECPA/ECCA), which ask the pseudorandomness of unrevealed encapsulated keys under uncorrupted users. This enhanced security for KEM serves well for the security of a class of Authenticated Key Exchange protocols built from KEM. In this paper, we study the achievability of tight ECPA and ECCA security for KEM in the multi-user setting, and present an impossibility result and an optimal security loss factor that can be obtained. The existing meta-reduction technique due to Bader et al. (EUROCRYPT 2016) rules out some KEMs, but many well-known KEMs, e.g., Cramer-Shoup KEM (SIAM J. Comput. 2003), Kurosawa-Desmedt KEM (CRYPTO 2004), run out. To solve this problem, we develop a new technique tool named rank of KEM and a new secret key partitioning strategy for meta-reduction. With this new tool and new strategy, we prove that KEM schemes with polynomially-bounded ranks have no tight ECPA and ECCA security from non-interactive complexity assumptions, and the security loss is at least linear in the number n of users. This impossibility result covers lots of well-known KEMs, including the CramerShoup KEM, Kurosawa-Desmedt KEM and many others. Moreover, we show that the linear security loss is optimal by presenting concrete KEMs with security loss T(n). This is justified by a non-trivial security reduction with linear loss factor from ECPA/ECCA security to the traditional multi-challenge CPA/CCA security.

Two-Pass Authenticated Key Exchange with Explicit Authentication and Tight Security.

Two-Message Authenticated Key Exchange from Public-Key Encryption.

Authenticated Key Exchange and Signatures with Tight Security in the Standard Model.

EKE Meets Tight Security in the Universally Composable Framework

Improvement of Provably Secure Self-Certified Proxy Convertible Authenticated Encryption Scheme

Key Encapsulation Mechanism with Tight Enhanced Security in the Multi-user Setting: Impossibility Result and Optimal Tightness

Strongly Secure Two Party Authenticated Key Agreement Scheme

Provably Secure Password Authenticated Key Exchange Based On Rlwe For The Post-Quantum World

Fuzzy Authenticated Key Exchange with Tight Security

A Secure Two-factor Authentication Key Exchange Scheme

Authenticated Key Exchange from Ideal Lattices

Tightly Sim-So-Cca Secure Public Key Encryption From Standard Assumptions

Two-Factor Authenticated Key Exchange from Biometrics with Low Entropy Rates

Privacy-Preserving Authenticated Key Exchange in the Standard Model

Provably Secure Authenticated Key Exchange Protocol under the CDH Assumption

Efficient KDM-CCA Secure Public-Key Encryption Via Auxiliary-Input Authenticated Encryption

Provably Secure Three-Party Password-Based Authenticated Key Exchange Protocol

An Efficient One-Way Authenticated Key Exchange Protocol for Anonymity Networks.

Public-key Authenticated Encryption with Keyword Search Achieving Both Multi-Ciphertext and Multi-Trapdoor Indistinguishability.

A General Construction for Password-Based Authenticated Key Exchange from Witness PRFs.

On Security Analysis of an After-the-fact Leakage Resilient Key Exchange Protocol