Forward-Secrecy and Escrow-Freeness Sample Clauses

Forward-Secrecy and Escrow-Freeness. Although an adversary can masquerade as the compromised entity once the latter’s long-term key has been compromised, we do not want the adversary to also obtain previously accepted session keys. Protocols that prevent this are said to provide forward secrecy. As there is usually a computational cost in providing perfect forward secrecy, it is sometimes sacrificed and a weaker notion is considered. One example is partial forward secrecy whereby the compromise of one long-term private key or both ephemeral secrets of the communicating parties does not lead to the leakage of previously accepted session keys. No such protection is made when both parties’ long-term keys are compromised. This notion is considered in existing ID-based protocols such as those of Chen and Xxxxx [10]. For our basic protocol, the proof of indistinguishability allows the adversary to ask Corrupt query for the IDI associated with the test session, it follows that our protocol also achieve partial forward-secrecy. There is an additional concern in forward secrecy for ID-based protocols when compared with those in conventional public key cryptography – the master secret of the KGC is another secret that can be compromised. When this happens, the long-term keys of all users will be compromised although it may be possible that no previously accepted session keys are deduced. Achieving this notion also mean that the key agreement protocol is escrow-free, assuming that there is no active attack by the KGC (e.g., by actively impersonating a user). A protocol is said to provide KGC forward secrecy (KGC-FS) if it retains confidentiality of previously accepted session keys even when the master secret of the KGC is compromised. It is easy to see that our protocol described in Figure 2 does not provide KGC-FS since any adversary with the knowledge of s will be able to compute eˆ(WA + hAQA, WB + hBQB)s = eˆ(QA, QB)s(a+hA)(b+hB ). KGC-FS implies forward secrecy in the usual sense since all users’ private keys can be computed with the master secret. It has been noted that two-party protocols with only two-message flow and having no previous establishment of secure shared state cannot achieve perfect forward secrecy [22]. Our protocol, having only two messages in the message flow, inherently can neither achieve perfect forward secrecy nor perfect KGC-FS. Here we consider weak KGC-FS, such that the previously established sessions without the active involvement of the adversary cannot be “recovered” eve...