臺灣博碩士論文加值系統

摘要
隨著網路服務的快速成長，網路通訊的安全性已逐漸受到重視。而廣為人所知的可認證的金鑰交換協定正好為這開放式的網路環境提供了所需的私密性、完整性以及確認性，因此它在許多網路的應用中扮演著重要的角色。然而，傳統的可認證金鑰交換協定卻非常容易遭受阻絕服務式攻擊，這是因為在協定中包含了計算上昂貴的指數運算。而這樣新的安全性威脅將使得蓬勃的網路發展受到阻礙。近來，為了修補這樣的缺失，一些相關的方法陸續被提出。
根據不同的身分認證機制，我們可以將可認證的金鑰交換協定區分成三類:典型的植基於公開金鑰之金鑰交換協定、植基於身份之金鑰交換之協定以及植基於通行碼之金鑰交換協定。到目前為止，大部分有關可抵擋阻絕服務式攻擊之金鑰交換協定的研究都把重點放在植基於公開金鑰之金鑰交換協定上。著眼於此，本篇論文將達到以下貢獻：
1.我們將對一些可用來預防阻絕服務式攻擊的方法、各種植基於不同認證機制之金鑰交換協定以及一些已被提出植基於公開金鑰之可抵擋阻絕服務式攻擊的金鑰交換協定做一介紹及回顧。
2.我們將對一些在設計一植基於身分和植基於通行碼之可抵擋阻絕服務式攻擊的金鑰交換協定上需要考慮的問題進行探討。
3.並且我們將分別提出一植基於身份之可抵擋阻絕服務式攻擊之金鑰交換協定及一植基於通行碼之可抵擋阻絕服務式攻擊之金鑰交換協定。而這兩套協定皆可達到以下之要求:
•可抵擋CPU消耗之攻擊
•可抵擋記憶體消耗之攻擊
•可防止已知金鑰之攻擊 (known-key attack)、金鑰洩漏之假冒攻擊 (Perfectforward secrecy)、雙方密鑰洩漏導致危害金鑰之攻擊 (key-compromiseimpersonation) 及通行碼猜測攻擊(passwordguessing attack) 等安全上的要求。
4.我們將建構一拍賣網站並將我們所提出之協定實作套用在該網站上以驗證我們所提出的方法。

Abstract
With the growth of network services, the communications security has become increasingly more important. The famous authenticated key agreement protocol provides privacy, integration and identification for open network systems. It has been an important component in many applications such as electric commerce. However, the typical authenticated key agreement protocols are vulnerable to the denial of service attack because the system employs public-key primitives involving computationally expensive modular exponentiations. This new security threat could hinder future network development. To remedy this weakness, serveral desirable countermeasures have recently been proposed such as the client puzzle, stateless connection and so on.
According to various authentication schemes, authenticated key agreement protocols can be divided into three categories: ordinary public-key based key agreement protocol, identity-based key agreement protocol and password based key agreement protocol. Most researches on DoS-resistant key agreement protocol mainly focus on the public-key based systems. Following this line of research, this thesis will also
1. survey the related works for some countermeasures used to prevent DoS attacks on key agreement protocols, traditional key agreement protocols based on different authentication schemes and existing DoS-resistant public-key based key agreement protocols;
2. discuss some considerations for designing DoS-resistant identity-based key agreement protocols and DoS-resistant password based key agreement protocols;
3. propose an identity-based key agreement protocol resistant to DoS attacks and a password based key agreement protocol resistant to DoS attacks respectively, that both achieve the following requirements:
․resistance to CPU-exhaustion attacks
․resistance to storage-exhaustion attacks
․achieving security requirements for known-key attacks, perfect forward secrecy, key-compromise impersonation and the password guessing attack
4. the proposed protocols will be implemented in an auction website environment.

Content
Acknowledgements (in Chinese)…………………………………………………………….i
Abstract (in Chinese)………………………………………...…………………………….. ii
Abstract (in English)………………………………………...…………………………….. iii
List of Figures……………………………………………………………………………...vii
List of Tables……………………………………………………………………………...viii
Chapter l Introduction…………………………………………………………………....1
1.l Authenticated Key Agreement…………………………………………………………...1
1.2 Denial of Service Attacks and Possible Countermeasures………………………………3
1.3 Threats of DoS Attacks on Key Agreement Protocols…………………………………..6
1.4 Research Motivation and Objectives……………………………………………………7
1.5 Thes Organization……………………………………………………………………...11
Chapter 2 Reviews and Analyses of Related Literatures…………………………….....12
2.l Adopting Signature Schemes……………………………………………...……………12
2.1.1 Schnorr''s Signature Scheme……………………………………………..………...12
2.1.2 ElGamal''s Signature Scheme………………………………………………..…….14
2.2 Previously Proposed Authenticated Key Agreement Protocols………………………..15
2.3 Fundamental Security Requirements…………………………………………………..20
2.4 DoS-resistant Authenticated Key Agreement Protocols……………………………….22
2.4.l Hirose and Matsuura''s Protocol………………………………………………....…22
2.4.2 Tseng''s Protocol…………………………………………………………..……….27
2.4.3 Fung and Lee''s Protocol……………………………………………………..…….29
Chapter 3 A DoS-resistant Identity-Based Key Agreement Protocol………………...…34
3.l Our Design Consideration…………………………...…………………………………34
3.2 The Proposed Protocol…………………………………………………………………36
3.2.l Identity-based Key Agreement Protocol Resistant to DoS Attacks……………..…36
3.2.2 The Replenishment Version…………………………………..………………...…40
3.3 Security and Performance Analysis………………………………………………..…..44
3.3.l Security analysis………………………………………………………...…………44
3.3.2 Performance Analysis……………………………………………………………..52
Chapter 4 A DoS-resistant Password-Based Key Agreement Protocol…………………55
4.1 Our Design Consideration……………………………………………………………...55
4.1.1 Inherent Restrictions………………………………………………………………55
4.1.2 The Consideration of Using Pricing Function in Our Protocol…………………...56
4.2 The Proposed Protocol…………………………………………………………………57
4.2.1 Password-based Key Agreement Protocol Resistant to DoS Attacks……………..57
4.2.2 The Replenishment Version……………………………………………………….60
4.3 Security and Performance Analysis……………………………………………………63
4.3.1 Security Analysis………………………………………………………………….63
4.3.2 Performance Analysis……………………………………………………………..69
Chapter 5 Implementation………………………………………………………………72
5.l Motivation………………………………………………………………………………72
5.2 Java Security and Java Cryptography………………………………………………….73
5.3 System Architecture……………………………………………………………………75
5.4 Classes Fabrication of Our Protocol…………………………………………………...81
5.5 Presentation of the Implementation……………………………………………………92
5.5.1 Running of Our Auction Web……………………………………………………..91
5.5.2 Test Result…………………………………………………………………………95
Chapter 6 Conclusions…………………………………………………………………..97
References………………………………………………………………………………100
List of Figure
Fig.2.l The identity-based key agreement protocol of Tseng etc………………………...17
Fig.2.2 The password-based key agreement protocol of Yeh and Sun…………………..19
Fig.2.3 The DoS-resistant public-key based key agreement protocol of Hirose and
Matsuura………………………………………………………………………...24
Fig.2.4 The DoS-resistant public-key based key agreement protocol of Tseng…………28
Fig.2.5 The DoS-resistant public-key based key agreement protocol of Fung and
Lee……………………………………………………………………………….32
Fig.3.l Our DoS-resistant identity-based key agreement protocol……………………….38
Fig.3.2 The replenishment version of Our DoS-resistant identity-based key
agreement protocol………………………………………………………………43
Fig.4.1 Our DoS-resistant password-based key agreement protocol…………………….59
Fig.4.2 The Replenishment Version of Our DoS-resistant password-based key
agreement protocol……………………………………………………………..62
Fig.5.l The register phase………………………………………………………………...77
Fig.5.2 The key agreement Phase………………………………………………………..78
Fig.5.3 The bidding phase………………………………………………………………..80
Fig.5.4 Auction web system architecture………………………………………………...80
Fig.5.5 The description of the class "id_kap_c.class"-part 1…………………………….82
Fig.5.6 The description of the class "id_kap_c.class"-part 2…………………………….83
Fig.5.7 The description of the class "id_kap_c.class"-part 3…………………………….83
Fig.5.8 The description of the class "id_kap_c.class"-part 4…………………………….84
Fig.5.9 The description of the class "id_kap_c.class"-part 5…………………………….85
Fig.5.lO The description of the class "id_kap_s.class"-part 1…………………………...86
Fig.5.11 The description of the class "id_kap_s.class"-part 2…………………………...87
Fig.5.12 The description of the class "id_kap_s.class"-part 3…………………………...88
Fig.5.13 The description of the class "id_kap_s.class"-part 4…………………………...89
Fig.5.14 The description of the class "id_kap_s.class"-part 5…………………………...90
List of Tables
Table 3.1 Performance comparisons among identity-based key agreement protocols…..54
Table 4.1 Performance comparisons among password-based key agreement protocols...71

Referencre
[1] R. Ankney, D. Johnson and M. Matyas, “The Unified Model”, contribution to X9F1, October 1995.
[2] M. Bellare, D. Pointcheval and P. Rogaway, “Authenticated key, exchange secure against dictionary attacks”, Advances in Cryptology-EUROCRYPT, pp. 139-155, 2000.
[3] S. Bellovin and M. Merritt, “Augmented encrypted key exchange: a password-based protocol secure against dictionary attachs and password file compromise”, AT&T Bell Laboratories, 1993.
[4] S. Bellovin and M. Merritt, “Encrypted key exchange: password-based protocols secure against dictionary Attacks”, Proceedings of IEEE Symposium on Research in Security and privacy, Oakland, 1992.
[5] B.C. Xie, H.M. Sun, Z.L. Huang and C.T. Lin, “An improvement of Saeednia’s identity-based key exchange protocol”, Information Secruty Conference 2002, pp. 41-43.
[6] S. Blake-Wilson, D. Johnson and A. Menezes, “key agreement protocols and their security analysis”, Proceedings of the sixth IMA International Conference on Cryptography and Coding, LNCS 1355, pp. 30-45, 1997. A full version of this paper is available at http://www.cacr.math.uwaterloo.ca
[7] V. Boyko, P. Machenzie, and S. Patel, “Provably secure password-authenticated key exchange using Diffie-Hellman”, Advances in Cryptology-EUROCRYPT, pp. 156-171, 2000.
[8] S. Blake-Wilson and A. Menezes, “Authenticated Diffie-Hellman key agreement protocols”, In Fifth Annual Workshop on Selected Areas in Cryptography (SAC’ 98), Lecture Notes in Computer Science, (Springer-Verlag, 1999), pp. 339-361.
[9] C. Meadows, “A formal framework and evaluation method for network denial of service”, In Proceedings of the 12th IEEE computer Security Foundations Workshop, pp. 4-13, Mordano, Italy, June 1999.
[10] CERT Coordination Center, “Denial of service attacks”, Technical note, available from http://www.cert.org/tech_tips/denial_of_service.html, February 1999.
[11] C.L. Schuba, I.V. Krsul, M.G. Kuhn, E.H. Spafford, A. Sundaram, and D. Zamboni, “Analysis of a denial of service attack on TCP”, In Proceedings of the 1997 IEEE Symposium on Security and Privacy, pp. 208-223, Oakland, California, May 1997.
[12] C. Dwork and M. Naor, “Pricing via processing or combating junk mail”, In Advances in Cryptology-CRYPTO ’92: 12th Annual International Cryptology Conference, Proceedings, Lecture Notes in Computer Science Volume 740, pp. 139-147, Santa Barbara, California, August 1992. Springer.
[13] W. Diffie, P.C. Van Oorschot and M.J. Wiener, “Authentication and authenticated key exchanges”, Designs, Codes and Cryptography, 2, pp. 107-125, 1992.
[14] W. Diffie and M.E. Hellman, “New directions in cryptography”, IEEE Trans. on Info, Theory 22 IT-22 (6), pp. 644-654, 1976.
[15] T. ElGamal, “A public key cryptosystem and a signature scheme based on discrete logarithms”, IEEE Transactions on Information Theory, Vol. IT-31, pp.469-472, July 1985.
[16] C.K. Fung and M.C. Lee, ”A denial-of-service resistant public-key authentication and key establishment protocol”, In Proceedings of 21st IEEE International Conference on Performance, Computing, and Communications, pp. 171-178, April, 2002.
[17] C. Gunther, “An identity-based key-exchange protocol”, Advances in Cryptology (Proc. Eurocrypt’89), Lecture Notes in Computer Science, 434, (Spring-Verlag, 1990), pp. 29-37, 1990.
[18] B. Harris and R. Hunt, “TCP/IP security threats and attack methods”, Computer Communications, 22(10): pp. 885-897, June 1999. Elsevier.
[19] S. Hirose and S. Yoshida, “An authenticated Diffie-Hellman key agreement protocol secure against active attacks”, PKC’98 Lecture Notes in Computer Science 1431, pp.135-148, 1998.
[20] S. Hirose and K. Matsuura, “Enhancing the resistance of a provably secure key agreement protocol to denial-of—service attack”, In Proceedings of the 2nd International Conference on Information and Communication Security (ICICS ’99), Lecture Notes in Computer Science volume 1726, pp. 169-182, Sydney, Australia, November 1999. Springer.
[21] S. Hirose and K. Matsuura, “Key agreement protocols resistant to a denial-of- service attack”, IEICE Trans. Inf. & Syst., Vol. E84-D, No. 4, 2001.
[22] P. Horster, M. Michels and H. Petersen, “Meta-ElGamal signature scheme”, Technical Report TR-94-5, university of Technology Chemnitz-Zwichau, 16, 1994.
[23] ISO 7498-2:1989 Information processing systems, “Open Systems Interconnection Basic Reference Model”, Part 2: Security Architecture, 1989.
[24] J. Dube, “Web under attack”, Article on abcnews.com, February 2000.
[25] A. Juel and J. Brainard, ”Client Puzzles: A Cryptographic Countermeasure Against Connection depletion Attacks”, NDSS ’99, Proceedings of the 1999 Network and Distributed System Security Symposium.
[26] P. Karn and W. Simpson, “Photuris: Session-key Management Protocol”, RFC 2522, March 1999.
[27] L. Law, A. Menezes, M. Qu, J. Solinas and S. Vanstone, “An efficient Protocol for authenticated key agreement”, Technical report CORR 98-05, University of Waterloo, 1998. Also available at http://www.cacr.math.uwaterloo.ca/
[28] D. Maughan, M. Schertler, M. Schneider, and J. Turner, “Internet security association and key management protocol (ISAKMP)”, RFC 2408, November 1998.
[29] K. Matsuura and H. Imai, “Protection of authenticated key-agreement protocol against a denial-of-service attack”, Cientifica, 2(11): pp. 15-19, 1999.
[30] K. Matsuura and H. Imai, “Modified aggressive mode of Internet key exchange resistant against denial-of-service attacks”, IEICE Transactions on Information and Systems, E83-D(5): pp. 972-979, May 2000.
[31] K. Matsuura and H. Imai, “Resolution of ISAKMP/Oakley key-agreement protocol resistant against denial-of-service attack”, Pre-Proc. Internet Workshop’99 (IWS’99), pp.17-24, Osaka, Japan, Feb. 1999.
[32] A. Menezes, L. Law, M. Qu, J. Solians and S. Vanstone, “An efficient protocol for authenticated key agreement”, Technical report CORR 98-05, Department of C&O, University of Waterloo, March 1998.
[33] National Security Agency, “SKIPJACK and KEA algorithm specification”, Version 2.0, May 29 1998.
[34] P.C. Schnorr, “Efficient ldentification and signatures for smart card”, Lecture Notes in Computer Science 435, Advances in Cryptology: Crypto’89, Berlin: Springer Verlag, pp. 339-351, 1990.
[35] B. O’Higgins, W. Diffie, L. Strawczynski and R. de Hoog, “Encryption and ISDN — A Natural Fit”, 1987 International Switching Symposium (ISS 87).
[36] E. Okamoto, “Key distribution systems based on identification information”, Advances in Cryptology (Proc. Crypto ’87), Lecture Notes in Computer Science, 293, (Springer-Verlag, 1988), pp. 194-202, 1988.
[37] P.G.. Neumann, “Inside fisks: denial-of-service attacks”, Communications of the ACM,43(4):136, April 2000.
[38] P. Karn and W.A. Simpson, “Photuris: Session-key management protocol”, Experimental RFC 2522, IETF, March 1999.
[39] S. Saeednia and R. Safavi-Naini, “A new identity-based key exchange protocol minimizing computation and communication”, Information Security Workshop (Proc. ISW ’97), Lecture Notes in Computer Science, 1396, (Springer-Verlag, 1998), pp. 328-334, 1998.
[40] S. Saeednia, “Improvenemt of Gunther’s identity-based key exchange protocol”, Electronics Letters, 36,(18), pp. 1535-1536, 2000.
[41] A. Shamir, “Identity-based cryptosystems and signature schemes”, Advances in Cryptology (Proc. Crypto ’84), Lecture Notes in Computer Science, Vol. 196, (Springer-Verlag, 1985), pp. 47-53, 1985.
[42] Y.M. Tseng, J.K. Jan and C.H. Wang, “Cryptanalysis and improvement of an identity-based key exchange protocol”, Computer Society of the Republic of China, Journal of Computers, Vol. 14, No. 3、4, December 2002.
[43] Y.M. Tseng, “Design of authenticated key exchange protocols resistant to a denial-of-service attack”, Information Security Conference 2002.
[44] T. Aura and P. Nikander, “Stateless connections”, In Proceedings of International Conference on Information and Communications Security (ICICS ’97), Lecture Notes in Computer Science volume 1334, pp. 87-97, Beijing, China, Springer November 1997.
[45] H.T. Yeh and H.M. Sun, “Simple authenticated key agreement protocol resistant to password guessing attacks”, ACM Operating Systems Review, Vol. 36, No. 4, pp. 14-22, New York, ACM Press, October 2002.