Open main menu

Wikipedia β

MQV (Menezes–Qu–Vanstone) is an authenticated protocol for key agreement based on the Diffie–Hellman scheme. Like other authenticated Diffie-Hellman schemes, MQV provides protection against an active attacker. The protocol can be modified to work in an arbitrary finite group, and, in particular, elliptic curve groups, where it is known as elliptic curve MQV (ECMQV).

MQV was initially proposed by Menezes, Qu and Vanstone in 1995. It was modified with Law and Solinas in 1998. There are one-, two- and three-pass variants.

MQV is incorporated in the public-key standard IEEE P1363 and NIST's SP800-56A standard.[1]

Some variants of MQV are claimed in patents assigned to Certicom.

ECMQV has been dropped from the National Security Agency's Suite B set of cryptographic standards.

Contents

DescriptionEdit

Alice has a key pair   with   her public key and   her private key and Bob has the key pair   with   his public key and   his private key.

In the following   has the following meaning. Let   be a point on an elliptic curve. Then   where   and   is the order of the used generator point  . So   are the first L bits of the first coordinate of  .

Step Operation
1 Alice generates a key pair   by generating randomly   and calculating   with   a point on an elliptic curve.
2 Bob generates a key pair   in the same way as Alice.
3 Now, Alice calculates   modulo   and sends   to Bob.
4 Bob calculates   modulo   and sends   to Alice.
5 Alice calculates   and Bob calculates   where   is the cofactor (see Elliptic curve cryptography: domain parameters).
6 The communication of secret   was successful. A key for a symmetric-key algorithm can be derived from  .

Note: for the algorithm to be secure some checks have to be performed. See Hankerson et al.

CorrectnessEdit

Bob calculates:  

Alice calculates:  

So the shared secrets   are indeed the same with  

MQV vs HMQVEdit

The original MQV protocol does not include user identities of the communicating parties in the key exchange flows. User identities are only included in the subsequent explicit key confirmation process. However, explicit key confirmation is optional in MQV (and in the IEEE P1363 specification). In 2001, Kaliski presented an unknown key-share attack that exploited the missing identities in the MQV key exchange protocol.[2] The attack works against implicitly authenticated MQV that does not have explicit key confirmation. In this attack, the user establishes a session key with another user but is tricked into believing that he shares the key with a different user. In 2006, Menezes and Ustaoglu proposed to address this attack by including user identities in the key derivation function at the end of the MQV key exchange.[3] The explicit key confirmation process remains optional.

In 2005, Krawczyk proposed a hash variant of MQV, called HMQV.[4] The HMQV protocol was designed to address Kaliski's attack (without mandating explicit key confirmation), with the additional goals of achieving provable security and better efficiency. HMQV made three changes to MQV:

  1. Including the user identities in the key exchange flows: more specifically, letting   and   where   and   are identities of Alice and Bob respectively.
  2. Removing the mandatory requirement in MQV that a Certificate Authority (CA) must verify the proof-of-possession of the user's private key during the public key registration. In HMQV, the CA merely needs to check the submitted public key is not 0 or 1.
  3. Removing the mandatory requirement in MQV that a user must verify whether the received ephemeral public key is a valid public key (known as public key validation). In HMQV, a user merely needs to check the received ephemeral public key is not 0 or 1.

HMQV claims to be superior to MQV in performance because it dispenses with the operations in 2) and 3) above, which are mandatory in MQV. The HMQV paper provides "formal security proofs" to support that dispensing with these operations is safe.

In 2005, Menezes first presented a small subgroup confinement attack against HMQV.[5] This attack exploits the exact missing of public key validations in 2) and 3). It shows that when engaged with an active attacker, the HMQV protocol leaks information about the user's long-term private key, and depending on the underlying cryptographic group setting, the entire private key may be recovered by the attacker. Menezes proposed to address this attack by at least mandating public key validations in 2) and 3).

In 2006, in response to Menezes' attack, Krawczyk revised HMQV in the submission to IEEE P1363 (included in the IEEE P1363 D1-pre draft). However, instead of validating the long-term and ephemeral public keys in 2) and 3) respectively as two separate operations, Krawczyk proposed to validate them together in one combined operation during the key exchange process. This saves cost. With the combined public key validation in place, Menezes' attack is prevented. The revised HMQV can still claim to be more efficient than MQV.

In 2010, Hao presented two attacks on the revised HMQV (as specified in the IEEE P1363 D1-pre draft).[6] The first attack exploits the fact that HMQV allows any data string other than 0 and 1 to be registered as a long-term public key. Hence, a small subgroup element is allowed to be registered as a "public key". With the knowledge of this "public key", a user is able to pass all verification steps in HMQV and is fully "authenticated" in the end. This contradicts the common understanding that "authentication" in an authenticated key exchange protocol is defined based on proving the knowledge of a private key. In this case, the user is "authenticated" but without having a private key (in fact, the private key does not exist). This issue is not applicable to MQV. The second attack exploits the self-communication mode, which is explicitly supported in HMQV to allow a user to communicate with himself using the same public key certificate. In this mode, HMQV is shown to be vulnerable to an unknown key-share attack. To address the first attack, Hao proposed to perform public key validations in 2) and 3) separately, as initially suggested by Menezes. However, this change will diminish the efficiency advantages of HMQV over MQV. To address the second attack, Hao proposed to include additional identities to distinguish copies of self, or to disable the self-communication mode.

Hao's two attacks were discussed by members of the IEEE P1363 working group in 2010. However, there was no consensus on how HMQV should be revised. As a result, the HMQV specification in the IEEE P1363 D1-pre draft was unchanged, but the standardisation of HMQV in IEEE P1363 has stopped progressing since.

See alsoEdit

ReferencesEdit

  1. ^ "Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography". Retrieved 15 April 2018. 
  2. ^ Kaliski, Burton S., Jr. (August 2001). "An Unknown Key-share Attack on the MQV Key Agreement Protocol". ACM Trans. Inf. Syst. Secur. 4 (3): 275–288. doi:10.1145/501978.501981. ISSN 1094-9224. 
  3. ^ Menezes, Alfred; Ustaoglu, Berkant (2006-12-11). "On the Importance of Public-Key Validation in the MQV and HMQV Key Agreement Protocols". Progress in Cryptology - INDOCRYPT 2006. Lecture Notes in Computer Science. Springer, Berlin, Heidelberg: 133–147. doi:10.1007/11941378_11. ISBN 9783540497677. 
  4. ^ Krawczyk, H. (2005). "HMQV: A High-Performance Secure Diffie-Hellman Protocol". Advances in Cryptology – CRYPTO 2005. Lecture Notes in Computer Science. 3621. pp. 546–566. doi:10.1007/11535218_33. ISBN 978-3-540-28114-6. 
  5. ^ Menezes, Alfred (2007-01-01). "Another look at HMQV". Mathematical Cryptology. 1 (1). doi:10.1515/jmc.2007.004. ISSN 1862-2984. 
  6. ^ F. Hao, On Robust Key Agreement Based on Public Key Authentication. Proceedings of the 14th International Conference on Financial Cryptography and Data Security, Tenerife, Spain, LNCS 6052, pp. 383–390, Jan, 2010.

BibliographyEdit

External linksEdit