PAKE Game-based Security Universal Composability LAKE Outline Password-based Authenticated Key Exchange Password-based Authenticated Key Exchange 1 David Pointcheval Ecole Normale Sup´ erieure Game-based Security 2 Universal Composability 3 Language-based Authenticated Key Exchange 4 PKC 2012 Darmstadt, Germany May 22nd, 2012 ´ Ecole Normale Sup´ erieure David Pointcheval 2/40 PAKE Game-based Security Universal Composability LAKE PAKE Game-based Security Universal Composability LAKE Introduction Introduction Key Exchange Protocols Diffie-Hellman Key Exchange A fundamental problem in cryptography: The classical Diffie-Hellman protocol allows such a key exchange: Enable secure communication over insecure channels in a finite cyclic group G , of prime order p , with a generator g A common scenario: X $ $ ← Z p , X ← g x ← Z p , Y ← g y Users encrypt and authenticate their messages x − − − − − − − − − − − − − → y using a shared secret key Y K ← Y x = g xy K ← X y = g xy ← − − − − − − − − − − − − − m A m A No authentication provided − − − − − − → − − − − − − → Authenticated Key Exchange m B m B Semantic security / Implicit Authentication: ← − − − − − − ← − − − − − − the session key should be indistinguishable from a random string Alice Bob to all except the expected players How to obtain such a shared secret key? − → Key exchange protocols ´ ´ Ecole Normale Sup´ erieure David Pointcheval 3/40 Ecole Normale Sup´ erieure David Pointcheval 4/40
PAKE Game-based Security Universal Composability LAKE PAKE Game-based Security Universal Composability LAKE Introduction A Case Study Authentication Techniques Electronic Passport Since 1998, some passports contain digital information on a chip. Asymmetric technique Standards are specified by ICAO Assume the existence of a public-key infrastructure (International Civil Aviation Organization) Each party holds a pair of secret and public keys In 2004, security introduced: 2-party and group settings encrypted communication between the chip and the reader access control: BAC (Basic Access Control) Symmetric technique The shared secret is on the MRZ Users share a random secret key (Machine Readable Zone) 2-party or server-based settings It has low entropy: at most 72 bits, Password-based technique but actually approx. 40 Users share a random low-entropy secret: password = ⇒ low-entropy shared secret: 2-party and group settings a password pw ´ ´ Ecole Normale Sup´ erieure David Pointcheval 5/40 Ecole Normale Sup´ erieure David Pointcheval 6/40 PAKE Game-based Security Universal Composability LAKE PAKE Game-based Security Universal Composability LAKE A Case Study Attacks BAC: Basic Access Control Off-line Dictionary Attacks The symmetric encryption and MAC keys are derived from pw As in the previous scenario, after having Passport Reader eavesdropped some (possibly many) transcripts r P $ $ ← { 0 , 1 } 64 ← { 0 , 1 } 64 − − − − − − − − − − − − − → r R , k R interacted (quite a few times) with players r P , k P C R ← Enc pw ( r R , r P , k R ) the adversary accumulates enough information C R , M R C P ← Enc pw ( r P , r R , k P ) ← − − − − − − − − − − − − − M R ← Mac pw ( C R ) to take the real password apart from the dictionary C P , M P efficient password-recovery after off-line exhaustive search M P ← Mac pw ( C P ) − − − − − − − − − − − − − → K ← k P ⊕ k R For the BAC: quite a few passive eavesdroppings are enough From a pair ( C R , M R ) , one can make an exhaustive search to recover the password! on the password pw to check the validity of the Mac M R How many active interactions could one enforce? After a few eavesdroppings only : password recovery What can we expect from a low-entropy secret? ´ ´ Ecole Normale Sup´ erieure David Pointcheval 7/40 Ecole Normale Sup´ erieure David Pointcheval 8/40
PAKE Game-based Security Universal Composability LAKE PAKE Game-based Security Universal Composability LAKE Attacks Examples On-line Dictionary Attacks The Most Famous Examples On-line Dictionary Attacks In a finite group G , of prime order p , with key derivation function K The adversary interacts with a player, trying a password EKE: Encrypted Key Exchange [Bellovin–Merritt, 1992] In case of success: it has guessed the password $ $ ← Z p , X ← g x ← Z p , Y ← g y x y DH Key Exchange In case of failure: it tries again with another password X X ′ X ′ ← E pw ( X ) X ← D pw ( X ′ ) − − − − − − − − − − − − → with flows Y Y ′ If the dictionary has a size N , the adversary wins after N / 2 attempts Y ′ ← E pw ( Y ) Y ← D pw ( Y ′ ) ← − − − − − − − − − − − − encrypted under pw k ← Y x = g xy k ← X y = g xy K ← K ( A , B , X , Y , k ) K ← K ( A , B , X ′ , Y ′ , k ) In Practice This attack is unavoidable SPEKE: Simple Password Exponential Key Exchange [Jablon, 1996] If the failures for a target user can be detected: the impact can be limited by various techniques g ← G ( A , B , pw ) DH Key Exchange X $ $ ← Z p , X ← g x ← Z p , Y ← g y (limited number of failures, delays between attempts, . . . ) x − − − − − − − − − − − − → y with a basis Y k ← Y x = g xy k ← X y = g xy derived from pw ← − − − − − − − − − − − − If the failures cannot be detected (anonymity, no check, . . . ) the impact can be dramatic K ← K ( A , B , X , Y , k ) K ← K ( A , B , g , X , Y , k ) ´ ´ Ecole Normale Sup´ erieure David Pointcheval 9/40 Ecole Normale Sup´ erieure David Pointcheval 10/40 PAKE Game-based Security Universal Composability LAKE PAKE Game-based Security Universal Composability LAKE Examples Examples PACE: Password Authenticated Security Models Connection Establishment Game-based Security [Bellare–P.–Rogaway, 2000] Find-then-Guess The recent alternative to BAC is PACE: Real-or-Random [Abdalla–Fouque–P., 2005] Password Authenticated Connection Establishment Simulation-based Security [Boyko–MacKenzie–Patel, 2000] In the spirit of SPEKE: a generator derived from the password Universal Composability [Canetti–Halevi–Katz–Lindell–MacKenzie, 2005] With security analyses: Where PACE v1 [Bender–Fischlin–Kuegler, 2009] The adversary controls all the communications: PACE v2 It can create, modify, transfer, alter, delete messages [Coron–Gouget–Icart–Paillier, 2011] Users can participate in concurrent executions of the protocol Instances of the players are denoted A i and B j What does security really mean? On-line dictionary attack should be the best attack = ⇒ No adversary should win with probability greater than q S / N where q S = # Active Sessions and N = # Dictionary ´ ´ Ecole Normale Sup´ erieure David Pointcheval 11/40 Ecole Normale Sup´ erieure David Pointcheval 12/40
Recommend
More recommend
