Pairwise Key Agreement in Broadcasting Networks Ik Rae Jeong

Contents I.Security Notions of Key Exchange II.Type of Networks III.Key Agreement for Key Graphs

I.Security Notions of Key Exchange IA (Implicit Authentication) –Only a designated party can calculate the same session key. Dishonest parties can not get any information about the session key. KI (Key Independence) –security against Denning-Sacco attacks (known key attacks) –for the cases when other session keys are revealed FS (Forward Secrecy) –for the cases when long-term secrets are revealed

II.Types of Network half-duplex full-duplex 4 Rounds 2 Rounds Alice Bob Alice Bob

II.Types of Network Broadcasting Network Round 1 P1 P4 P3 P2 Round 2

DH (half-duplex) Alice Bob 2 Rounds

DH (full-duplex) Alice Bob 1 Round

Session Identifier The unique string per session Used to define matching session in the definition of security of key exchange In the full-duplex channel: the message concatenation by the ordering of owners

III. Key Agreement for Key Graphs We have constructed more efficient key exchange schemes which provides pairwise key exchange between parties via randomness re-use technique.

Sequential Key Exchange between Parties P1 P4P3 P2

Concurrent Key Exchange between Parties P1 P4P3 P2

Motivation How do we efficiently do concurrent execution of the two-party key exchange scheme ?

Our Results An efficient one-round key exchange scheme providing key independence in the standard model A two-round key exchange scheme providing forward secrecy in the standard model

Key Graph for Session keys (1) P1 P4 P3 P2 G={V,E} V={P1,P2,P3,P4} E={(P1,P2),(P1,P3),(P1,P4)} G={V,E} V={P1,P2,P3,P4} E={(P1,P2),(P2,P3),(P3,P4), (P4,P1)} P1 P4 P3 P2

Key Graph for Session keys (2) G={V,E} V={P1,P2,P3,P4} E={(P1,P2),(P1,P3), (P2,P4), (P2,P5), (P3,P6), (P3,P7)} G={V,E} V={P1,P2,P3,P4} E={(P1,P2),(P1,P3),(P1,P4), (P2,P3),(P2,P4),(P3,P4)} P1 P4 P3 P2 P1 P4 P3P2 P5 P6 P7

Key Exchange Model for Key Graphs Broadcasting network Several session keys in a single session

One-Round Two-Party Diffie- Hellman Key Exchange P1 P2

One-Round Concurrent Key Exchange using Two-Party Key Exchange P1 P4P3 P2 P1 requires three random values.

One-Round Concurrent Key Exchange using randomness re-use technique P1 P4P3 P2 P1 requires one random values.

Randomness Re-use under the DDH assumption Pairwise DDH assumption 1 Exp

Randomness Re-use under the DDH assumption Pairwise DDH assumption 2 Exp

PKA1 P1 P4 P3 P2 Round 1: KI in the standard model F is a pseudo random function

PKA2 P1 P4 P3 P2 Round 1: FS in the standard model

Security PKA1 and PKA2 –reduced to the DDH problem in the standard model

Discussion Key exchange for key graph is an extension of two-party key exchange. Key exchange for key graph can be used as a subprotocol of another protocol such as group key exchange protocols.

Thank You !