A Secure Identification and Key agreement protocol with user Anonymity (SIKA)

A Secure Identification and Key agreement protocol with user Anonymity (SIKA)Kumar Mangipudi1* and Rajendra Katti11Department of Electrical and Computer Engineering, North Dakota State University, Fargo, ND, USA, 58102*Corresponding author’s email: kumar.mangipudi@user identification, authentication, key agreement, anonymity, RSA, Denial-of-Service (DoS) attack AbstractAnonymity is a desirable security feature in addition to providing user identification and key agreement during a user’s login process. Recently, Yang et al., proposed an efficient user identification and key distribution protocol while preserving user anonymity. Their protocol addresses a weakness in the protocol proposed by Wu and Hsu. Unfortunately, Yang’s protocol poses a vulnerability that can be exploited to launch a Denial-of-Service (DoS) attack. In this paper, we cryptanalyze Yang’s protocol and present the DoS attack. We further secure their protocol by proposing a Secure Identification and Key agreement protocol with user Anonymity (SIKA) that overcomes the above limitation while achieving security features like identification, authentication, key agreement and user anonymity.IntroductionWhenever a user wants to establish a secure communication channel with the server, he initiates a service request during the login process. The server first identifies the user and then checks for the legitimacy of the user. Upon a successful identification they then negotiate a shared session key to secure the rest of the communication. Until now, numerous authentication and key agreement protocols employing a wide range of cryptography techniques have been proposed. Among them, Kerberos (Kohl and Neuman, 1993), SSL (Secure Sockets Layer) (Freier et al., 1996) and X.509 an authentication framework (ITU-T, 1997) are used to facilitate the user identification, mutual authentication and key exchange during a user’s login process. Some of the other widely studied protocols that achieve similar functionalities are password based and are often referred as Password Authenticated Key Exchange (PAKE) protocols (Bellovin and Merrit, 1992; Bellare et al., 2000; Boyko et al., 2000; Katz et al., 2001; Goldreich and Lindell, 2001). Transmitting the user’s private information during a login process may be a cause of concern. This is because the sensitive information such as shopping patterns, individual preferences, etc., can be abused for marketing purposes (Bao and Deng, 2001) resulting in violation of user’s privacy and can raise legal issues. As such user anonymity is a desirable security feature while requesting and accessing services. Unfortunately, user anonymity was not addressed in earlier authentication and key agreement protocols.In 2000, Lee and Chang proposed a user identification and key distribution protocol that attains user anonymity based on public key cryptography (RSA) and hash functions. However, Wu and Hsu (2004) cryptanalyzed Lee-Chang’s protocol and exploited its vulnerabilities to launch an impersonation attack and also pointed out that given a previously agreed session key an attacker can disclose a user’s identity. They further proposed a protocol to fix the aforementioned vulnerabilities. Later, Yang et al., (2004) showed a new weakness in Wu-Hsu’s protocol, wherein the server obtains the user’s secret token at the end of the login process i.e., after a successful user identification and key agreement process. Possessing the user’s secret information enables a server to impersonate the user at a later time. As such, Yang et al., (2004) proposed a protocol that overcomes the weakness of Wu-Hsu’s protocol and achieves user anonymity, user identification and key agreement. As mentioned by Yang et al., these three protocols (Lee-Chang, Wu-Hsu and Yang) have the following attractive features apart formachieving user anonymity: (1) each user is required to maintain only one secret irrespective of the number of servers he is accessing; (2) the server is not required to maintain a list of passwords; (3) the system is scalable as new servers can be added without requiring to update the master key. More details on this protocol can be found in Yang et al., (2004).Unfortunately, Yang’s protocol despite possessing many attractive features is vulnerable to a Denial-of-Service (DoS) attack. In this paper, we show the DoS attack on Yang’s protocol and propose a Secure Identification and Key agreement protocol with user Anonymity (SIKA). The rest of the paper is organized as follows. The next section reviews Yang’s protocol. What follows next is the DoS attack on Yang’s protocol. Further sections discuss our proposed SIKA protocol and its security and performance analysis. Finally, the last section concludes this paper. U i S j⎯⎯→⎯1Mz = g k 1−j P mod Na = z e j ID mod N ⎯⎯⎯←)(2z MK ij = a t mod N x = g et mod Np = g t mod N ),(T x H i Py = E K ij (ID i )⎯⎯⎯⎯→⎯) , , ,(3T p y x M K ij = x k mod NID i = D K ij (y )x = p ),(T x H i ID e mod N Fig. 1 Anonymous user identification and key agreement phaseReview of Yang’s identification and key agreement protocolIn this section, we review Yang’s identification and key agreement protocol. The main objectives of this protocol (as wells as Lee-Chang’s and Wu-Hsu’s protocol) are to provide user identification, authentication and key agreement between the communication parties (a user and the server), while not disclosing the user’s identity to the public. Since it is necessary to know who is providing what services, the identity of the server is disclosed to the public. The user anonymity, however, is defined against the public rather than the server. This is because the server has to identify and verify the legitimacy of the user for accounting and billing purposes. In their protocol, there exists a trusted third party, the Smart Card Producing Center (SCPC) that defines the public parameters of the system and also issues secret tokens to the users and servers upon their request through a secure channel. During the login process a user and the server authenticate each other and agree upon a session key by using their respective secret tokens. The protocol consists of two phases. A key generation phase, where the SCPC issues a secret token to each of the participants (user / server) in the system via a secure channel and an anonymous user identification and key agreement phase, which is executed as and when the user logs in to the server for a service.Key generation phase: In this phase, the SCPC chooses N = pq , where p and q are two large prime numbers; selects two integers e and d such that ed = 1 mod Φ(N ), where Φ(N ) = (p -1)(q -1); chooses a generator g in the field Z N (g ∈ Z N ), a hash function H (m ) on a message m , and a symmetric-key cryptosystem such as AES, where E K (m ) and D K (m ) represent encryption and decryption functions on a message m , respectively. The SCPC then publishes e , N , g , and H (.) asits public parameters and retains d , p , and q secret. Each entity (user/ server) first registers and then obtains a secret token P i from the SCPC through a secure channel. The P i is calculated as: P i = mod N , where ID d i ID i is the identity of a user U i or the server S i (1) Anonymous user identification and key agreement phase: A user (U i ) and the server (S j ) execute the protocol shown in Fig. 1. The protocol is used to agree upon a common session key K ij , identify the user and then authenticate, while maintaining the anonymity of U i from the public. A brief description of the protocol is given below. U i requests a service by way of M 1. Upon receiving the request, S j chooses a random number k ; calculatesz = g k 1−j P mod N (2) and then sends it to U i as M 2. U i now chooses a random number t and a time stamp T , and calculates the following,a = z e j ID mod N (3) K ij = a t mod N (4) x = g et mod N (5) p = g t mod N (6) ),(T x H i P y = E K ij (ID i ) (7) and sends M 3 (x , y , p , T ) to S j . (Note that K ij is used as the common session key for encryption and decryption of the user’s identity). Upon receiving M 3, S j first checks validity of the time stamp and then proceeds to obtain the common session K ij K ij = x k mod N (8) which is subsequently used to decrypt y and identify U i ID i = D K ij (y ) (9) If U i is a legitimate user then S j continues to check the authenticity of the message by verifying x = p ),(T x H i ID e mod N (10) If the verification passes S j accepts the request; else it is rejected. Security of the above protocol is based on solving the two underlying problems: large number integer factorization and one-way property of the cryptographic hash function, apart from the security of symmetric encryption and decryption algorithms. For more details on the security and performance analysis of this protocol, we refer the readers to Yang et al., 2004.U i S j⎯⎯→⎯1Mz = g k 1−j P mod N⎯⎯⎯⎯←)'(2'z Ma ’ = z ’e j ID mod NK ’ij = a ’t mod N x = g et mod Np = g t mod N ),(T x H i Py ’ = E K’ij (ID i )⎯⎯⎯⎯→⎯) , , ,(3T p y x MK ij = x k mod NID ’i = D K ij (y ’)x = p ),('T x H i ID e mod N Fig. 2 A DoS attack Yang’s identification and key agreement protocol .Attacks on Yang’s identification and key agreement protocolIn this section, we exploit a weakness in Yang’s protocol to launch the DoS attack. In a DoS attack, the adversary uses some ways such that the server denies the requests of a legitimate user. The weakness in Yang’s protocol is that it neither protects the integrity of the message M 2 nor provides the user a way to verify the authenticity of the message M 2 originated from the server in Fig. 1. On the other hand, the server checks the authenticity and integrity of the message M 3 in Eq. (10) of the protocol. An adversary, A launches a DoS attack by replacing M 2 with a previously recorded message M ’2 (or any arbitrary number ∈Z N ) during its transmission, as shown in Fig. 2. This is always possible because an adversary can notice a user generating the service request M 1.Upon receiving M’2, U i executes the equations (2) through (7). First U i calculates a ’ and ends up with K ’ij , which is subsequently used to encrypt his identity to obtain y ’. S j then calculates K ij from the received x , decrypts the received y ’ and obtains ID ’i . It is easy to check that ID i ≠ ID ’i, as such S j aborts the protocol because Eq. (10) returns a failure. Thus a legitimate user’s request is denied and hence a DoS attack.U iS s ⎯⎯→⎯1Mz = g k 1−j P mod N v = ud s , where u = H (z , T , ID s )w = mod N v g s s u = H (z , T , ID s )⎯⎯⎯⎯⎯←) , ,(2w T z M s e w mod N s = mod N u g s sa = z e j ID mod NK ij = a t mod Nx = g et mod Np = g t mod N ),(T x H i Py = E K ij (ID i ) ⎯⎯⎯⎯→⎯) , , ,(3T p y x MK ij = x k mod NID i = D K ij (y )x = p ),(T x H i ID e mod N A Secure Identification and Key agreement protocol with user Anonymity (SIKA)In this section, we propose SIKA that circumvents the DoS attack presented in the previous section in addition to being secure, resistant to known attacks and achieving the security objectives (identification, authentication, key agreement and user anonymity) set forth in the design of this protocol. Similar to Yang’s protocol our protocol consists of three types of entities (an SCPC, the users and the servers) and two phases, the details of which are given below.Key generation phase: This is also an initialization phase, wherein the SCPC sets up the system parameters. The SCPC chooses N = pq , where p and q are two large prime numbers; selects two integers e and d such that ed = 1 mod Φ(N ), where Φ(N ) = (p -1)(q -1); chooses a generator g in the field Z N (g ∈ Z N ), a hash function H (m ) on a message, and a symmetric-key cryptosystem such as AES, where E K (m ) and D K (m ) represent encryption and decryption functions on a message m , respectively. The SCPC then publishes it public parameters e , N , g , and H (.) and retains d , p , and q secret. Every user and server in the system first registers and then obtains a secret token, P i from SCPC through a secure channel. The P i is calculated as:P i = mod N , where ID d i ID i is the identity of a user U i or the server S i (11) In addition to this, each of the servers sets up its own public and private parameters similar to SCPC. First it chooses N s = p s q s , where p s and q s are two large prime numbers and then selects e s and d s such that e s d s = 1 mod Φ(N s ), where Φ(N s ) = (p s -1)(q s -1); a generator g s in the field Z Ns (g s ∈Z Ns ); retains d s , p s , and q s as secret; and publishes ID s , e s , g s , N s . The parameters with subscript ‘s’ are specific to the server.Anonymous user identification and key agreement phase: To request a service from the server S s a user U i initiates the protocol shown in Fig. 3 by transmitting his request M 1. Upon receiving the request, S s chooses a random number k ; calculates z and the digital signature, w for z as belowz = g k 1s −P mod N (12) w = mod N v g s s , where v = ud s , u = H (z , T , ID s ) and T is the time stamp for z (13) and then sends (z , T , w ) to U i as M 2. U i first performs an integrity check on the received M 2 as per Eq (14).s e w mod N s = mod N u g s s , where u = H (z , T , ID s ) (14) If successful, he then proceeds to choose a random number t ; updates T (current time stamp); calculates the followinga = z e j ID mod N (15) K ij = a t mod N (16) x = g et mod N (17) p = g t mod N (18) ),(T x H i P y = E K ij (ID i ) (19) and sends M 3(x , y , p , T ) to S s . (Note that K ij serves as the common session key for encryption and decryption of the user’s identity). Upon receiving M 3, S s again checks validity of the time stamp and then proceeds to obtain the common session K ij K ij = x k mod N (20) which is subsequently used to decrypt y and identify U iID i = D K ij (y ) (21) If U i is a legitimate user then S s continues to check the authenticity of the message by verifying x = p ),(T x H i ID e mod N (22) If the verification returns a success S j accepts the request; else it rejects the request.In the above SIKA protocol, our idea is to overcome the vulnerability of Yang’s protocol without sacrificing its security, computational and communicational overheads. We protect the integrity of the transmitted message M 2 by having the server generate a digital signature, w for the message M 2 in Eq. (13) and on the other hand the user verifies the correctness of the digital signature in Eq. (14) before executing the rest of the protocol. The security analysis and how we thwart the DoS attack is deferred until the next section.Security analysis of SIKAThis section discusses the security analysis of our proposed SIKA protocol. SIKA enhances the security while inheriting the original security features of Yang’s protocol. To prove that SIKA is secured, it is sufficient to show that it is secure against DoS attacks and does not introduce any additional weaknesses. To simplify our discussion and for comparison we follow Yang’s security analysis. First, we shall briefly introduce the inherited security features and then discuss bulk on the enhanced security of SIKA.Inherited security: The security of Yang’s protocol depends on the RSA assumption, (Rivest et al., 1979) namely, the hardness of factorization of a large number N into its prime factors p & q , the DH assumption (Diffie and Hellman, 1976) i.e. given g x mod p and g y mod p , it is infeasible to compute g xy mod p (Pointcheval, 2000), the one-way property of a collision free hash function, H(.), (Stinson, 2002) and the security of the encryption and decryption algorithms. Further they have classified attacks into four types: attacks to the SCPC, attacks to the user, attacks to the server and attacks to the protocol as a whole and then analyzed robustness of their protocol against these attacks. Interested readers may refer to (Yang et al., 2004).Enhanced security: We show that our modifications enhance the security (resist against DoS attack) while achieving the design objectives (identification, authentication, key agreement and user anonymity). If equations (1) through (10) in Yang’s protocol are secure, achieve user identification, authentication, key agreement and preserve user anonymity so do equations (11),(12) and (15) through (22) in our proposed SIKA protocol. It now suffices to prove that equations (13) and (14) resist DoS attacks and do not introduce any new vulnerability. Note that equations (13) and (14) protect and verify the integrity of the transmitted message M 2, respectively.(i) Resist DoS attack: In Eq. (13) we have w = mod N v g s s , where v = ud s = H (z , T , ID s )d s . It isimpossible for an adversary to launch a DoS attack by modifying the transmitted message M 2 in Fig. 3. This is because any modification results in a failure on the integrity check in Eq.(14). Without loss of generality, let us consider that an adversary launches a DoS attack by replacing z with some z ’ in the transmitted message M 2 (z , T , W ) (an adversary is free to replace any or all of the parameters in M2) and let the calculated hash value be u ’ = H(z ’, T , ID s ) then Eq. (14) results in a failure and the user immediately aborts the protocol withoutexecuting the rest of the protocol because mod N s e w s = mod N s s ve g s = mod N s s e ud g s s =u g s mod N s ) mod N ≠'su g s . Based on the assumption of RSA, it is impossible for the adversary to generate the corresponding digital signature, w ’mod N s = mod N s d u g 'ss as he cannot derive the secret key d s without factoring N s . Further an adversary cannot use any previously generated message M 2 (similar to the attack shown in Fig. 2), because of the current time stamp T .(ii) No new vulnerabilities. Digital signatures are widely used to protect the integrity of a message (Rivest, 1979; Stinson 2002). As such, the digital signature based on RSA, deployed in our scheme does not introduce any new vulnerability.Performance analysis of SIKAIn this section, we compare the performance of SIKA in terms of computational and communicational overheads with Yang’s scheme. Note that SIKA resists DoS attacks. Our scheme (Fig. 3) is almost similar to Yang’s scheme (Fig. 1) except for the inclusion of equations(13) and (14). Eq. (13) requires an extra modular multiplication, modular exponentiation and hash computation on the server’s side, while the user requires computing an additional hash value along with a modular exponentiation (Eq. (14)). There is a minimal increase in the communication cost because of transmitting two variables T and w in addition to z in M 2. Thus, SIKA is as efficient as Yang’s scheme except for a modest increase in computational and communicational cost. Of course, this is the price of enhancing the security (resisting DoS attacks).ConclusionsIn this paper, we exploited the weakness of a recently proposed user identification and key distribution protocol (Yang’s scheme) to launch a DoS attack. A DoS attack is a very serious attack. We proposed SIKA to overcome this limitation while achieving the same set of security services. By performance analysis, we showed that our protocol is as efficient as the previously proposed protocols with a modest increase in communicational and computational cost. ReferencesBao F, Deng Robert H. Privacy protection for transactions of digital goods. In: Proceedings of international conference on information and communications security. LNCS 2229. Springer-Verlag; 2001. p. 202-13.Bellare M, Pointcheval D, Rogaway P. Authenticated key exchange secure against dictionary attacks. In: Proceedings of Eurocrypt’00. LNCS 1807. Springer-Verlag; 2000. p. 139-55. Bellovin S, Merrit M. Encrypted key exchange: password based protocols secure against dictionary attacks. In: Proceedings of IEEE symposium on security and privacy; 1992. p. 72-84. Boyko V, MacKenzie P, Patel S. Provably secure password authenticated key exchange using Diffie Hellman. In: Proceedings of Eurocrypt’00. LNCS 1807. Springer-Verlag; 2000. p. 156-71. Diffie W, Hellman M. New directions in cryptography. IEEE Transactions on Information Theory 1976;2(6):644-54.Freier AO, Karlton P, Kocher PC. Secure Socket Layer 3.0, Internet Draft; 1996. Girault M. An identity-based identification scheme based on discrete logarithms modulo a composite number. In: Proceedings of Eurocrypt’90. Springer-Verlag; 1991. p. 481-6.Goldreich O, Lindell Y. Session-key generation using human passwords only. In: Proceedings of Crypto’01. LNCS 2139. Springer-Verlag; 2001. p. 408-32.ITU-T recommendation X.509: information technology-open systems interconnection-the directory: authentication framework. June 1997.Katz J, Ostrovsky R, Yung M. Efficient password-authenticated key exchange using human-memorable passwords. In: Proceedings of Eurocrypt’01. LNCS 2045. Springer-Verlag; 2001. p. 475e94.Kohl J, Neuman C. The Kerberos authentication service (y5), Internet RFC 1510; 1993.Lee WB, Chang CC. User identification and key distribution maintaining anonymity for distributed computer network. Comput Syst Sci Eng 2000;15(4):113-6.Pointcheval D. The composite discrete logarithm and secure authentication. In: Proceedings of PKC’00. LNCS 1751. Springer-Verlag; 2000. p. 113-28.Rivest R, Shamir A, Adleman L. A method for obtaining digital signature and public-key cryptosystem. Commun ACM 1979; 21(2):120-6.Stinson D. Cryptography Theory and Practice. Second Edition. CRC Press. March 2002.Wu TS, Hsu CL. Efficient user identification scheme with key distribution preserving anonymity for distributed computer networks. Elsevier, Computers & Security 2004;23(2):120-5.Yang Y, Wang S, Bao F, Wang J, Deng RH. New Efficient user identification and key distribution scheme providing enhanced security. Elsevier, Computers & Security 2004; 23(8): 697-7.。