Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
As we can know that the best two-pass AKE protocols with DH message can achieve is the weak form of perfect forward security (wPFS) which guarantees security against the passive adversary. But "Strongly Secure One Round Authenticated Key Exchange Protocol with Perfect Forward Security" (Hai Huang) claims that the AKE it proposed can achieve perfect forward security against active adversary in one round.
Is that correct? Why?
It is possible to achieve PFS against active adversaries in two messages. The "as we know" that you mention is incorrect; this misconception seems to stem from over-interpreting Krawczyk's result in his HMQV paper from 2005. At best, the argument seems to hold from protocols that exchange messages of the form g^x, g^y, where x and y are random values: for those protocols it seems you cannot achieve PFS against active adversaries by Krawczyk's example attack. However, his argument does not work against two-message protocols in general (e.g., that exchange messages of a different form).
This misconception is explained in detail in, e.g., the introduction of this paper by Cremers and Feltz, which also includes a full security model and detailed proof of a (construction of a) two-message protocol that achieves a form of security that implies eCK-security and PFS against active adversaries.
There is an earlier protocol (by Gennaro, Krawczyk and Rabin) that achieves PFS against active adversaries in two messages and is also implicitly authenticated, but that does not achieve e-CK security: it is the PKI-based variant described at the end of this paper.
The first description of an eCK-secure variant is found here.
So yes, it is possible to achieve this.
