Secret-Key Agreement without Public-Key Cryptography Security Seminars Kulesh Shanmugasundaram

SYN  SYN  Secret-Key Paradigms  Leighton-Micali Scheme  Sensor Networks Perspectives  References  FIN

Secret-Key Sharing  Secret-Key Sharing Paradigms –Public-key framework –Needham-Schroeder framework  Needham-Schroeder framework –Trusted authority T mediates key agreements between Alice and Bob –We know the framework well(?)

Needham-Schroeder  Issues with the scheme 1.Requires trusted authority to be continuously available 2.Exposes arbitrarily many clear-text- cipher-text pairs 3.Requires encryption to provide authentication 4.Security of the scheme depends on advances in number theory

Leighton-Micali Scheme  Properties of the scheme 1.Simple, elegant and easy to implement 2.Depends on ordinary one-way functions 3.Continuous presence of trusted authority is not required 4.Requires computing or storing N 2 k-bit keys, for an N-node network 5.Encryption, authentication in one protocol 6.Compromising nodes, trusted authority doesn’t affect the security…

Leighton-Micali Scheme  One time initialization of protocol –h() denotes a hash function, + denotes xor operation 1. Trusted authority creates two secret master keys 1.Exchange key – K 2.Authentication key – K’ 2. TA assigns two keys for each node 1.Exchange key K i = h(K, i) 2.Authentication key K’ i = h(K’, i) 3. TA computes O(N 2 ) keys for each pair of nodes 1.Exchange key P i,j = h(K j, i) + h(K i, j) 2.Authentication key A i,j = h(K’ i, h(K j,i))

Leighton-Micali Scheme…  Computing Secret-keys 1. Suppose P a,b is pair key for Alice and Bob 2. Alice computes E = P a,b + h(K a, Bob) 3. Alice authenticates the key A a,b = h(K a, E) 4. To decrypt Bob simply computes h(K b, Alice) 5. Done!

Leighton-Micali Scheme…  Security properties of the scheme 1.Unpredictability of individual keys 2.Unpredictability of pair-keys 3.When requesting pair-keys, requestor doesn’t need to authenticate herself 4.No man-in-the-middle 5.This is not a public-key approach

Leighton-Micali Scheme…  Sensor network perspectives… –Simple operations (hash, xor) –Relatively few messages across entities –No need for a trusted authority –Pair-keys can be stored on any or all nodes  Questions –Are hash functions inexpensive? –How to efficiently find pair-keys on nodes?

References  Secret-Key Agreement without Public-Key Cryptography, Tom Leighton, Silvio Micali, Crypto 93

FIN Questions, comments, concerns?