Security Analysis of Ironwood Sample Clauses

Security Analysis of Ironwood. The Ironwood protocol is an outgrowth of the Algebraic EraserTM key agreement protocol (AEKAP) first published in [1] in 2006. The security of the AEKAP was based on the difficulty of inverting E-multiplication and the hard problem of solving the simultaneous conjugacy search problem for subgroups of the braid group. The AEKAP had withstood numerous attacks (see [10], [11], [12], [14], [15], [20]) in the last 10 years. However, the recent successful attack of Xxx-Xxx, Xxxxxxxxx, Tsaban (BBT) [7], for small parameter sizes, requires an increase in key size (see [2]) to make AEKAP secure against the BBT attack. The Ironwood protocol was designed to be totally immune to the BBT attack [7] without compromising on key size, speed or power consumption. A necessary requirement for the security of Ironwood is that the T -values and conjugates which are distributed to the HD cannot be obtained by an adversary. The T -values and conjugates are not on any of the other devices Di in the network. Without knowing the T -values and conjugates the BBT attack [7] cannot proceed at all. ƒ It is also clear that the Ironwood protocol satisfies the last requirement of an MKAAP. Namely, if an attacker can break into one of the devices Di and obtain its private key, then only the security of Di is breached; all other devices remain secure. This is because the only secret information on the device Di is the private key Ci. Knowledge of Ci has no effect on the key agreement and authentication protocol between the HD and other devices Dj with j = i. We now present a preliminary informal security analysis of Ironwood. Reversing E-multiplication is Algorithmically Hard. Strong support for the hardness of reversing E- Multiplication can be found in [19] which studies the security of Z´emor’s hash function [25]. This is a hash function H : {0, 1}∗ → SL(2, Fq) constructed by fixing two matrices h0, h1 ∈ SL(2, Fq). Then if B is the bitstring b1b2 · · · bn, one puts Y H(B) = hbi .