1. Identity-based authenticated key agreement protocol based on Weil pairing N.P. Smart IEE Electronics Letters 2002 Presented By Kuang-Ling Lin 10/7/2003

2. Outline Introduction The protocol based on Weil pairing Security Three pass AKC protocol Conclusion

3. Introduction Key agreement is one of fundamental cryptographic primitive Properties: (1)Bilinear (2)Non-degenerate (3)Computable

4. The protocol based on Weil pairing G:a prime order l subgroup of an elliptic curve over the field F q k:the smallest integer corresponding to l | q k -1 ê:G X G → F q * V:key derivation function V:F * q k → {0,1} s:KGC’s secret key P KGS : P KGS =[s]P Q ID :Q ID =H(ID) S ID :S ID =[s]Q ID

5. The protocol based on Weil pairing User A User B T A =[a]P T B =[b]P User A computes k A = ê([a]Q B,P KGS ) ． ê(S A,T B ) User B computes k B = ê([b]Q A,P KGS ) ． ê(S B,T A ) Secret key K=V(k A )=V(k B )

6. Security Known key security Forward secrecy ê(Q B,T A ) S ． ê(Q A,T B ) S Key control

7. Three pass AKC protocol R=ê([a]Q B,P KGS )=ê([b]Q A,P KGS ) User A User B T A =[a]P T B =[b]P,M 1 =MAC k ’ (2,B,A,R) M 2 =MAC k ’ (3,A,B,R)

8. Conclusion It seems that this protocol only makes two party to agree one key.