Browse > Article
http://dx.doi.org/10.9708/jksci.2012.17.4.091

Yi et al.'s Group Key Exchange Protocol : A Security Vulnerability and its Remediation  

Lee, Young-Sook (Department of Cyber Investigation Police, Howon University)
Kim, Jee-Yeon (School of Information and Communication Engineering, Sungkyunkwan University)
Won, Dong-Ho (School of Information and Communication Engineering, Sungkyunkwan University)
Publication Information
Journal of the Korea Society of Computer and Information / v.17, no.4, 2012 , pp. 91-98 More about this Journal
Abstract
A group key exchange (GKE) protocol is designed to allow a group of parties communicating over a public network to establish a common secret key. As group-oriented applications gain popularity over the Internet, a number of GKE protocols have been suggested to provide those applications with a secure multicast channel. Among the many protocols is Yi et al.'s password-based GKE protocol in which each participant is assumed to hold their individual password registered with a trusted server. A fundamental requirement for password-based key exchange is security against off-line dictionary attacks. However, Yi et al.'s protocol fails to meet the requirement. In this paper, we report this security problem with Yi et al.'s protocol and show how to solve it.
Keywords
group key exchange; password; dictionary attack; identity-based cryptography;
Citations & Related Records
연도 인용수 순위
  • Reference
1 J. Byun, D. Lee, J. Lim, "Password-based group key exchange secure against insider guessing attacks," in Proceedings of 2005 International Conference on Computational Intelligence and Security, LNAI vol. 3802, pp. 143-148, 2005.
2 D. Boneh, M. Franklin, "Identity-based encryption from the weil pairing," in Proceedings of Crypto'01, LNCS vol. 2139, pp. 213-229, 2001.
3 D. Boneh, M. Franklin, "Identity based encryption from the Weil pairing," SIAM Journal of Computing, vol. 32, no. 3, pp. 586-615, 2003.   DOI   ScienceOn
4 B. Waters, "Efficient identity-based encryption without random oracles," in Proceedings of Eurocrypt'05. LNCS vol. 3494, pp. 114-127, 2005.
5 C. Gentry, "Practical identity-based encryption without random oracles," in Proceedings of Eurocrypt'06, LNCS vol. 4004, pp. 445-464, 2006.
6 S. Goldwasser, S. Micali, R. Rivest, "A digital signature scheme secure against adaptive chosen-message attack," SIAM Journal of Computing, vol. 17, no. 2, pp. 281-308, 1988.   DOI   ScienceOn
7 D. Galindo, J. Herranz, E. Kiltz, "On the generic construction of identity-based signatures with additional properties," in Proceedings of Asiacrypt'06, LNCS vol. 4284, pp. 178-193, 2006.
8 K. Paterson, J. Schuldt, "Efficient identity-based signatures secure in the standard model," in Proceedings of Acisp'06, LNCS vol. 4058, pp. 207-222, 2006.
9 U. Maurer, S. Wolf, "Diffie-Hellman oracles," in Proceedings of Crypto'96, LNCS vol. 1109, pp. 268-282, 1996.
10 M. Burmester, Y. Desmedt, J. Seberry, "Equitable key escrow with limited time span," in Proceedings of Asiacrypt'98, LNCS vol. 1514, pp. 380-391, 1998.
11 F. Bao, R. Deng, H. Zhu, "Variations of Diffie-Hellman problem," in Proceedings of ICICS'03, LNCS vol. 2836, pp. 301-312, 2003.
12 Twitter, http://twitter.com
13 Facebook, http://www.facebook.com
14 J. Kwon, I. Jeong, K. Sakurai, D. Lee, "Password-authenticated multi-party key exchange with different passwords," Cryptology ePrint Archive, Report 2006/476, 2006.
15 X. Yi, R. Tso, E. Okamoto, "ID-Based group password-authenticated key exchange," Advances in Information and Computer Security - 4th International Workshop on Security, LNCS vol. 5824, pp. 192-211, 2009.
16 J. Byun, D. Lee, "N-party encrypted Diffie-Hellman key exchange using different passwords," in Proceedings of 3rd International Conference on Applied Cryptography and Network Security, LNCS vol. 3531, pp. 75-90, 2005.
17 Byun, S. Lee, D. Lee, D. Hong, "Constant-round password-based group key generation for multi-layer ad-hoc networks," in Proceedings of 3rd International Conference on Security in Pervasive Computing, LNCS vol. 3934, pp. 3-17, 2006.