3
$\begingroup$

The traditional authenticated DH protocol with PFS against active adversaries, ensures that the compromise of both party's long-term private keys after the session is completed will not help the adversary to compute session key, even adversary gets involved in the generation of messages.
An ID-based key-exchange has some differences with the traditional ones, such as it needs a KGC,
and public/private key generation is handled differently compared with the traditional ones.

Compared with the traditional authenticated DH protocol, what's the advantage of ID-based ones?

And if I want to design a ID-based key-exchange protocol with a bilinear pairing especially under eCK model, are there some ways to realise PFS against active adversaries besides using digital signatures?
Where should I pay particular attention?

Improve this question
$\endgroup$
4
  • $\begingroup$ What is the reason for your requirement "besides using digital signatures"? What's wrong with using digital signatures? This seems like an odd requirement to impose. $\endgroup$
    – D.W.
    Oct 28, 2013 at 14:10
  • $\begingroup$ signature will decrease the efficiency of protocol $\endgroup$
    – T.B
    Oct 28, 2013 at 14:21
  • $\begingroup$ Alex, (1) in that case your requirement should be that you want an efficient protocol (specify what you want to achieve, not how to achieve it), (2) I very much doubt that signatures make the protocol inefficient. Signatures are fast. I mean, you're OK with the inefficiency of bilinear pairings, but not with ordinary digital signatures? That's counter-intuitive. $\endgroup$
    – D.W.
    Oct 28, 2013 at 15:23
  • $\begingroup$ i said "if i want.." , i mainly focus on the problem of realising PFS.. $\endgroup$
    – T.B
    Oct 29, 2013 at 4:12

1 Answer 1

Reset to default
2
+25
$\begingroup$

In an ordinary ID-based scheme, you won't get strong PFS. The center always knows a secret that can be used to recover your private key and thus can violate PFS.

One approach is a hybrid scheme, such as the following. You could do a (non-ID-based) Diffie-Hellman or ECDH key exchange, with messages signed and authenticated using an ID-based signature scheme. You'd use the Diffie-Hellman/ECDH key exchange to derive an ephemeral session key for encrypting the rest of the channel. That would get you PFS (against passive eavesdroppers), along with the advantages of ID-based cryptography.

Apparently, the following paper describes an even better scheme.

Their paper apparently provides PFS against passive attackers and PFS against active attackers (even if the center is corrupted, apparently). Thanks to Alex for pointing this out.

The "advantage" of ID-based schemes is that you can use, e.g., someone's email address as their public key. The disadvantage is that you must trust the center an awful lot, because the center knows or could compute everyone's private keys. This is standard and you can find a lot written about ID-based key exchange that explains these tradeoffs in detail.

Improve this answer
$\endgroup$
5
  • $\begingroup$ Yes, the center always knows all parties' secret keys , but ephemeral keys used in a session. If $SessionKey=f(longtermkey,ephemeralkey)$, then without the ephemeral key the center cannot recover session key...also, can you give me an example of hybrid scheme? $\endgroup$
    – T.B
    Oct 27, 2013 at 6:41
  • $\begingroup$ @Alex, thanks for your interest. I described a hybrid scheme (which derives ephemeral session keys using DH/ECDH) in the 2nd paragraph of my answer, right after the phrase "hybrid scheme". $\endgroup$
    – D.W.
    Oct 27, 2013 at 6:52
  • $\begingroup$ but i know a id-based key-exchange protocol in here, that have PFS against active adversary, named mOT. mOT doesn't use signature , but it achieves PFS. so , i feel that your expression is not that accurate. $\endgroup$
    – T.B
    Oct 27, 2013 at 10:14
  • $\begingroup$ @Alex, you're right, that's an even better scheme. I've added it to my answer. (For future reference, if you already know of a partial answer to your question when asking your question, it would be helpful to include it in the question; that increases the chances that someone can give you a helpful answer.) I've edited my answer, and I believe that everything in my answer is accurate. $\endgroup$
    – D.W.
    Oct 27, 2013 at 18:16
  • $\begingroup$ i'm sorry, your answer doesn't describe my question fully and explicitly. It's not that desirable.. $\endgroup$
    – T.B
    Oct 28, 2013 at 12:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.