1. Computer Science Authenticated Group Key Agreement and Friends Giuseppe Ateniese, Michael Stiener and Gene Tsudik Presented by Young Hee Park November 11, 2005 1

2. Computer Science 2 Outline Introduction Authenticated 2-party Key Agreement Proposed Schemes –Authenticated Group Key Agreement A-GDH protocol –Complete Group Key Authentication SA-GDH protocol Conclusions Future Work

3. Computer Science 3 Introduction Secure and efficient communications among group members in dynamic peer groups Group key establishment Key establishment Key distributionKey agreement symmetric techniques Iolus, LKH Key Graph asymmetric techniques GDH TGDH

4. Computer Science 4 Introduction Authenticated key agreement in dynamic peer groups –Extend 2-party authenticated key agreement to group Diffie-Hellman key agreement Security services –Perfect forward secrecy (PFS) –Resistance to known-key attacks –Key authentication –Key confirmation and key integrity

5. Computer Science 5 Notations nnumber of protocol parties (group members) i, jindices of group members MiMi i-th group member; i ∈ [1, n] Gunique subgroup of Z* p of order q with p, q prime qorder of the algebraic group αexponentiation base xixi long-term secret key of M i riri random (secret) exponent ∈ Z p generated by M i SnSn group key shared among n members S n (M i )M i ’s view on a group key K ij long-term secret shared by M i and M j, with i ≠ j

6. Computer Science 6 Authenticated 2-party Key Agreement 2-party Diffie-Hellman key agreement M 1 M 2 Authenticated 2-party key agreement M1M1 M2M2

7. Computer Science 7 Authenticated Group Key Agreement Overview of GDH.2 M1M1 M2M2 M3M3 M4M4

8. Computer Science 8 Authenticated Group Key Agreement A-GDH.2 M1M1 M2M2 M3M3 M4M4

9. Computer Science 9 Authenticated Group Key Agreement Provides perfect forward secrecy Resistant to passive known key attacks Weak form of key authentication –Key is not directly authenticated between arbitrary nodes –All key authentication is performed through M n –No one can be sure of other members’ participation Complete group key authentication

10. Computer Science 10 Complete Group Key Agreement(SA-GDH.2) M1M1 M2M2 M3M3 M4M4

11. Computer Science 11 Complete Group Key Agreement SA-GDH.2 –Advantages Perfect forward secrecy Resistance to know-key attacks Complete key authentication Each member can be aware of the exact membership –Disadvantages More expensive than A-GDH.2 –Every member M i requires n exponentiations –Every member M i requires many pairwise keys(K ij )

12. Computer Science 12 Communication and Computation Cost Comm./Comp. CostGDH.2A-GDH.2SA-GDH.2 Comm unicati on Roundsnnn messagesnnn Total messages size(n 2 +n)/2 - 1 n2n2 Compu tation Exponentiations for M i i+1 n Exponentiations for M n nnn Total exponentiations(n 2 +3n)/2 - 1 n2n2 Inverses for M i 11 Inverses for M n 1 Total inversesn - 1n Multiplications for M i 12n - 2 Multiplications for M n n - 12n - 2 Total multiplications2n -22n 2 - 2n

13. Computer Science 13 Conclusions Secure authenticated key agreement protocol for dynamic peer groups –Extend 2-party authenticated key agreement to n parties authenticated key agreement –Provides perfect forward secrecy –Key authentication, key confirmation and integrity –Resistance to active attacks

14. Computer Science 14 Future Work Develop a general-purpose toolkit for key agreement and related security services in dynamic peer groups Develop more efficient secure group key agreement protocol which provides the resistance to insider attacks and more group security services