两个eCK模型下可证安全的密钥交换协议分析

两个eCK模型下可证安全的密钥交换协议分析 Analysis of Two Provably Secure Authenticated Key Exchange Protocols in the eCK Model 程庆丰 CHENG Qingfeng1 1 2 first-author 马传贵 MA Chuangui1 1 胡学先 HU Xuexian1 1 信息工程大学信息研究系 信息工程大学信息研究系 Department of Information Research,Information Engineering University Department of Information Research,Information Engineering University 解放军外国语学院基础部 解放军外国语学院基础部 Department of Basic Courses,PLA University of Foreign Languages Department of Basic Courses,PLA University of Foreign Languages 基于eCK（extended Canetti-Krawczyk）模型的定义,针对eCK模型下证明安全的两个密钥交换协议进行了分析.结果显示两个密钥交换协议在eCK模型中都是不安全的,其中SAKA（secure authenticated key agree-ment）协议不能抵抗临时密钥泄露攻击也不能抵抗长期密钥泄露攻击,并且不具有前向安全性.另一个SHY（Shi-Huang-Yang）协议不能抵抗两方临时密钥同时泄露的攻击. The extended Canetti-Krawczyk（eCK） model proposed by LaMacchia et al.is currently regarded as the strongest security model for authenticated key exchange（AKE） protocols.In the eCK model,the adversary can make queries on the test session,and reveal both ephemeral private keys,both long-term keys,or one of each from the two different parties.In this paper,we analyze two AKE protocols designed in the eCK model based on the definition of eCK model.We propose ephemeral keys compromised attacks and long-term keys compromised attacks on one of them,and also propose ephemeral keys compromised attacks on the other one.The results of analysis show that both of them are insecure in the eCK model. 密钥交换 eCK模型 计算Diffie-Hellman（CDH）假设 双线性Diffie-Hellman（BDH）假设 authenticated key exchange eCK model computation Diffie-Hellman（CDH） assumption bilinear Diffie-Hellman（BDH） assumption 10.14188/j.1671-8836.2010.02.005 TN918.2 国家高技术研究发展计划（863）项目（2009AA01Z417）;河南省重大科技攻关项目（092101210502） 2010-02-01 2021-04-01 2 56