As we can know that the best two-pass AKE protocols with DH message can achieve is the weak form of perfect forward security (wPFS) which guarantees security against the passive adversary. But "Strongly Secure One Round Authenticated Key Exchange Protocol with Perfect Forward Security" (Hai Huang) claims that the AKE it proposed can achieve perfect forward security against active adversary in one round.

Is that correct? Why?


1 Answer 1


It is possible to achieve PFS against active adversaries in two messages. The "as we know" that you mention is incorrect; this misconception seems to stem from over-interpreting Krawczyk's result in his HMQV paper from 2005. At best, the argument seems to hold from protocols that exchange messages of the form g^x, g^y, where x and y are random values: for those protocols it seems you cannot achieve PFS against active adversaries by Krawczyk's example attack. However, his argument does not work against two-message protocols in general (e.g., that exchange messages of a different form).

This misconception is explained in detail in, e.g., the introduction of this paper by Cremers and Feltz, which also includes a full security model and detailed proof of a (construction of a) two-message protocol that achieves a form of security that implies eCK-security and PFS against active adversaries.

There is an earlier protocol (by Gennaro, Krawczyk and Rabin) that achieves PFS against active adversaries in two messages and is also implicitly authenticated, but that does not achieve e-CK security: it is the PKI-based variant described at the end of this paper.

The first description of an eCK-secure variant is found here.

So yes, it is possible to achieve this.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.