Is forward secrecy a necessary security property for a AKE protocol to be proven secure in Bellare-Rogway model? Is freshness also a necessary security property for a AKE protocol to be proven secure in Bellare-Rogway model? If not why A(k) MTI protocol with key confirmation can not be proven secure in the Bellare-Rogway model?


This depends on what you mean by the Bellare-Rogway model? Do you mean

  • BR93: the original AKE model by Bellare and Rogaway?

  • BR95: their follow-up AKE model which incorporates the three-party case (among other things)?

  • BPR00: their third AKE model (together with Pointcheval), which additionally deals with the case of password-based authentication?

  • Or any of the many derivative models which extends or updates the above models in various ways, but still are generally referred to as belonging to the family of "BR-like" models?

If the BR-model in your question is interpreted specifically as being about any of the first three models above, then the answer is:

  • BR93: forward-secrecy is not required. This is because the model does not give the adversary any means of obtaining long-term keys.

  • BR95: forward-secrecy is required. This is because BR95 provides a Corrupt-query which gives the adversary access to a user's internal state (including its long-term key).

  • BPR00: forward-secrecy is required. Again, in this model the adversary is provided with a query that allows it to obtain a user's long-term key.

However, if your question is more generally about the BR-model thought of as a family of models, all centered around some core modelling concepts, then the answer is: it depends. By this I mean that the BR-model can be modified to accommodate both forward secure and non-forward secure protocols. To model a forward secure protocol, include a Corrupt-query (or something similar), which allows the adversary to obtain long-term keys. To model a non-forward secure protocol, leave out this query (or at least restrict it for the Test-session).

Regarding your question about freshness, this is not really about the protocol per se, but rather a modeling artifact. I.e., by the queries and capabilities given to the adversary in the BR-model (whichever flavor you want), there will always be ways for the adversary to trivially break any protocol. This is independent of how secure the protocol actually is, because these trivial attacks are inherent to the model, and do not correspond to any real-life attacks. Thus, the concept of freshness is introduced to correct for these trivial attacks, by saying that the adversary is only "allowed" to do attacks which are not deemed trivial. I should note, however, that actually figuring out what the trivial attacks are, can sometimes be a bit tricky.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.