Key Derivation. Finally, each peer computes the actual only its identity U , its implicit certificate CU , and the CA’s public key PCA, as PU = PCA + H(CU , U ) · CU . Indeed, PCA+H(CU , U )CU = {pca+(r+k)H(CU , U )}G = puG = PU . The security of such construction was formally proven in [10], and an X.509-compliant implicit certificate format using in total 78 bytes was presented in [11].
Key Derivation. Xxxxx and Xxx use a key derivation algorithm to generate secret key. · · · – Xxxxx generates a vector (s1, · · · , sn1 ) with si = ri if vi = 1, si = 0 if vi = 0 for i, = 1 , n1. Xxxxx generates a key kA using randomness extractor,
Key Derivation. A user with identity U receives its private key (rU , sU ) from the KGC computed as the Xxxxxxx’x signature of the string U under public key y. That is rU sU = kU + xH1(U, rU ) mod q. = gkU for kU Zq and ← $ Key agreement: A and B choose ephemeral private exponents tA and tB , respectively. A A, rA, uA = g tA - B B, rB, uB = g tB z1 = (uBrByH1(B,rB ))tA+sA z1 = (uArAyH1(A,rA))tB +sB z2 = utA B z2 = utB A Z = H2(z1, z2) Fig. 1. A and B share session key Z. See Section 3 for more specific details. protocol). Each party must compute four exponentiations to compute the session key (as opposed to two in the Xxxxxx-Xxxxxxx protocol). A similar favorable comparison holds with the Xxxxxxx-Xxxxxx protocol in [30]. While that protocol requires only two exponentiations, it does works over ZN∗ therefore requiring the use of a larger group size, which almost totally absorbs the computational advantage, and immediately implies a much larger bandwidth requirement. Detailed efficiency comparisons to other protocols in the literature are discussed in Section 6. We present a full proof of security of our protocol in the Xxxxxxx-Xxxxxxxx security model. Our results hold in the random oracle model, under the Strong Xxxxxx-Xxxxxxx Assumption. We also present some variations of our protocol that can be proven secure under the basic Computational Xxxxxx-Xxxxxxx Assumption. Our protocol can be proven to satisfy additional desirable security properties such as perfect forward secrecy3, and resistance to reflection and key-compromise impersonation attacks. 3 We can prove PFS only in the case the adversary was passive in the session that he is attacking – though he can be active in other sessions. As proven by Xxxxxxxx in [26], this is the best that can be achieved for 1-round protocols with implicit authentication, such as ours. Our Approach. The first direction we took in our approach was to attempt to analyze the id-based KA protocols by Xxxxxxx [22] and Xxxxxxxx [32]. They also work over any cyclic group where the Xxxxxx-Xxxxxxx problem is assumed to be hard, but their protocols lack a formal proof of security. While the original protocols cannot be shown to be secure, we were able to prove the security of modified versions of them. Nevertheless these two protocols were not very satisfactory solutions for the problem we had set out to solve, particularly for reasons of efficiency since they required a large number of exponentiations, which made them less efficient than say MQV w...
