臺灣博碩士論文加值系統

為了在手持裝置（mobile devices）與伺服器之間達到可互相認證與通訊的隱密性，研究學者們已提出許多以身分為基礎的可認證的金鑰協議（ID-AKA）協定達到認證彼此並建構共用的會談金鑰（common session key）。過去所有的ID-AKA協定中，手持裝置與伺服器在計算會談金鑰時，都會使用到一個暫時秘密金鑰（ephemeral secret key），而大多數的協定並沒有考慮這把秘密金鑰的安全性。因此，這些協定可能無法抵擋所謂的“暫時秘密洩漏＂（ephemeral-secret-leakage 簡稱ESL）的攻擊。近年來，針對ESL攻擊，目前有兩個可抵擋此攻擊的ID-AKA協定。其中一個協定在手持裝置端的運算過程中，可以完全不使用到配對(pairing)運算，但僅適用於單一伺服器的環境下。而另一個協定，雖然可以適用在多個伺服器的環境下，但在手持裝置與伺服器雙方都需要使用到兩個配對運算。因此，在這篇論文中，提出一個適用在手持裝置與多個伺服器的環境下且能夠抵擋ESL攻擊的強安全性之ID-AKA協定。由效能分析可了解，我們的協定在有限計算能力的手持裝置上是有效率的，這歸功於我們的協定在手持裝置端完全不使用配對運算。由安全分析得知，在random oracle model下以及computational Diffie-Hellman（CDH）的安全假設上，我們的協定是可證明的安全。最後，我們把所提出的協定具體實作出來，並使用個人電腦與智慧型手機來模擬整個系統環境。

To provide mutual authentication and communication confidentiality between mobile clients and servers, numerous identity (ID)-based authenticated key agreement (ID-AKA) protocols were proposed to authenticate each other while constructing a common session key. In most of the existing ID-AKA protocols, ephemeral secrets (random values) are involved in the computations of both mobile clients and servers. Thus, these ID-AKA protocols might become vulnerable due to the ephemeral-secret-leakage (ESL) attacks. Very recently, two ID-AKA protocols were proposed to withstand the ESL attacks. One of them is suitable for single server environment and requires no pairing operations on the mobile client side. The other one fits multi-server environments, but requires two expensive pairing operations. In this thesis, we present a strongly secure ID-AKA protocol resisting ESL attacks under mobile multi-server environments. By performance analysis, we demonstrate that our protocol does not require any pairing operations and is well suitable for mobile devices with limited computing capability. For security analysis, our protocol is provably secure under the computational Diffie-Hellman assumption in the random oracle model. Finally, we implement our protocol in real PC and smart phone to simulate the system environment.

CHAPTER 1 Introduction 1
1.1 Related work 2
1.2 Contribution and organization 3
CHAPTER 2 Preliminaries 5
2.1 Elliptic curve cryptography 5
2.2 Notations 5
CHAPTER 3 Adversarial model 7
CHAPTER 4 Our protocol 9
CHAPTER 5 Security analysis 13
CHAPTER 6 Performance analysis and comparisons 22
CHAPTER 7 Implementation 24
CHAPTER 8 Conclusions 27
References 28
Appendix 31

LIST OF FIGURES

Fig. 1. The system environment 9
Fig. 2. The key extract phase 10
Fig. 3. The authenticated key agreement phase 11
Fig. 4. Setup phase 24
Fig. 5. Client’s identity setup 25
Fig. 6. Server’s identity setup 25
Fig. 7. Key extract phase 25
Fig. 8. Client’s private key received 25
Fig. 9. Server’s private key received 25
Fig. 10. Secure communication in client end 26
Fig. 11. Secure communication in server end 26
Fig. 12. Decryption of client 26
Fig. 13. Decryption of server 26
Fig. A 1. The relationship of functions in client end 33
Fig. A 2. The relationship of functions in PKG end 33
Fig. A 3. The relationship of functions in server end 34

LIST OF TABLE

Table. 1. Comparisons between previously proposed ID-AKA protocols and ours 23
Table. A 1. Functions list of implementation 31

[1] M. Bellare, D. Pointcheval, P. Rogaway, “Authenticated key exchange secure against dictionary attacks,” Advances in Cryptology— Eurocrypt 2000, LNCS 1807, pp. 139-155, 2000.
[2] M. Bellare, P. Rogaway, “Random oracles are practical: a paradigm for designing efficient protocols,” The 1st ACM conference on Computer and Communications Security, pp. 62-73, 1993.
[3] D. Boneh, M. Franklin, “Identity-based encryption from the Weil pairing,” Advances in Cryptology—Crypto 2001, LNCS 2139, pp. 213-229, 2001.
[4] R. Canetti, H. Krawczyk, “Analysis of key-exchange protocols and their use for building secure channels,” Advances in Cryptology—Eurocrypt 2001, LNCS 2045, pp. 453-474, 2001.
[5] L. Chen, Z. Cheng, N. P. Smart, “Identity- based key agreement protocols from pairings,” International Journal of Information Security, Vol. 6, No. 4, pp. 213-241, 2007.
[6] L. Chen, C. Kudla, “Identity based authenticated key agreement from pairings,” IEEE Computer Security Foundations Workshop, pp. 219-233, 2003.
[7] K. Y. Choi, J. Y. Hwang, D. H. Lee, I. S. Seo, “ID-based authenticated key agreement for low-power mobile devices,” ACISP 2005, LNCS 3574, pp. 494-505, 2005.
[8] Y. J. Choie, E. Jeong, E. Lee, “Efficient identity-based authenticated key agreement protocol from pairings,” Applied Mathematics and Computation, Vol. 162, No. 1, pp. 179-188, 2005.
[9] Y. H. Chuang, Y. M. Tseng, “Towards generalized ID‐based user authentication for mobile multi‐server environment,” International Journal of Communication Systems, Vol. 25, No. 4, pp. 447-460, 2012.
[10] T. ElGamal, “A public key cryptosystem and a signature scheme based on discrete logarithms,” IEEE Transactions on Information Theory, Vol. 31, No. 4, pp. 469-472, 1985.
[11] D. Hankerson, A. Menezes, S. Vanstone, Guide to Elliptic Curve Cryptography, Springer- Verlag, New York, USA, 2004.
[12] D. He, J. Chen, J. Hu, “An ID-based client authentication with key agreement protocol for mobile client–server environment on ECC with provable security,” Information Fusion, Vol. 13, No. 3, pp. 223-230, 2012.
[13] S. H. Islam, “A Provably Secure ID-Based Mutual Authentication and Key Agreement Scheme for Mobile Multi-Server Environment Without ESL Attack,” Wireless Personal Communications, Vol. 79, No. 3, pp. 1975-1991, 2014.
[14] S. K. Islam, G. P. Biswas, “A more efficient and secure ID-based remote mutual authentication with key agreement scheme for mobile devices on elliptic curve cryptosystem,” Journal of Systems and Software, Vol. 84, No. 11, pp. 1892-1898, 2011.
[15] M. Kim, A. Fujioka, B. Ustaoğlu, “Strongly secure authenticated key exchange without NAXOS’ approach,” IWSEC 2009, LNCS 5824, pp. 174-191, 2009.
[16] N. Koblitz, “Elliptic curve cryptosystems,” Mathematics of computation, Vol.48, No.177, pp. 203-209, 1987.
[17] H. Krawczyk, “HMQV: A High Performance Secure Diffie–Hellman Protocol,” Advances in Cryptology—Crypto 2005, LNCS 3621, pp. 546-566, 2005.
[18] B. LaMacchia, K. Lauter, A. Mityagin, “Stronger security of authenticated key exchange,” ProvSec 2007, LNCS 4784, pp. 1-16, 2007.
[19] V. S. Miller, “Use of elliptic curves in cryptography,” Advances in Cryptology— CRYPTO’85, LNCS 218, pp. 417-426, 1986.
[20] S. Mitsunari, R. Sakai, M. Kasahara, “A new traitor tracing,” IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences, Vol. E85-A, No.2, pp.481-484, 2002.
[21] L. Ni, G. Chen, J. Li, Y. Hao, “Strongly secure identity-based authenticated key agreement protocols,” Computers and Electrical Engineering, Vol. 37, No. 2, pp. 205-217, 2011.
[22] T. Okamoto, “Authenticated key exchange and key encapsulation in the standard model,” Advances in Cryptology–Asiacrypt 2007, LNCS 4833, pp. 474-484, 2007.
[23] D. Pointcheval, J. Stern, “Security arguments for digital signatures and blind signatures,” Journal of cryptology, Vol. 13, No. 3, pp. 361-396, 2000.
[24] R. L. Rivest, A. Shamir, L. Adleman, “A method for obtaining digital signatures and public-key cryptosystems,” Communications of the ACM, Vol. 21, No. 2, pp. 120-126, 1978.
[25] A. P. Sarr, P. Elbaz-Vincent, J. C. Bajard, “A new security model for authenticated key agreement,” SCN2010, LNCS 6280, pp. 219-234, 2010.
[26] M. Scott, N. Costigan, W. Abdulwahab, “Implementing cryptographic pairings on smartcards,” Cryptographic Hardware and Embedded Systems—CHES 2006, LNCS 4249, pp. 134-147, 2006.
[27] A. Shamir, “Identity-based cryptosystems and signature schemes,” Advances in Cryptology— Crypto 1984, LNCS 196, pp. 47-53, 1985.
[28] K. Shim, “Efficient ID-based authenticated key agreement protocol based on Weil pairing,” Electronics Letters, Vol. 39, No. 8, pp. 653-654, 2003.
[29] N. P. Smart, “Identity-based authenticated key agreement protocol based on Weil pairing,” Electronics letters, Vol. 38, No. 13, pp. 630-632, 2002.
[30] P. Szczechowiak, L. Oliveira, M. Scott, M. Collier, R. Dahab, “NanoECC: Testing the limits of elliptic curve cryptography in sensor networks,” EWSN 2008, LNCS 4913, pp. 305-320, 2008.
[31] Y. M. Tseng, S. S. Huang, T. T. Tsai, L. Tseng, “A novel ID-based authentication and key exchange protocol resistant to ephemeral secret leakage attacks for mobile devices,” International Journal of Distributed Sensor Networks, Article ID 898716, (DOI: 10.1155/2014/898716), 2014.
[32] Y. M. Tseng, T. T. Tsai, “Efficient revocable ID-based encryption with a public channel,” The Computer Journal, Vol. 55, No. 4, pp. 475-486, 2012.
[33] Y. M. Tseng, T. T. Tsai, S. S. Huang, “Leakage-free ID-based signature,” The Computer Journal, Article in Press, (DOI: 10.1093/comjnl/bxt116), 2014.
[34] T. Y. Wu, Y. M. Tseng, “An efficient user authentication and key exchange protocol for mobile client–server environment,” Computer Networks, Vol. 54, No. 9, pp. 1520-1530, 2010.
[35] T. Y. Wu, Y. M. Tseng, “An ID-based mutual authentication and key exchange protocol for low-power mobile devices,” The Computer Journal, Vol. 53, No. 7, pp. 1062-1070, 2010.
[36] Android SDK, http://developer.android.com/sdk/index.html.
[37] Cryptographic library: Jpair, http://sourceforge.net/projects/jpair/.
[38] Integrated Development Environment: Eclipse, https://www.eclipse.org/downloads/.