Security Analysis of KEA Authenticated Key Exchange Protocol
KEA is a Diffie-Hellman based key-exchange protocol developed by NSA which provides mutual authentication for the parties. It became publicly available in 1998 and since then it was neither attacked nor proved to be secure. We analyze the security of KEA and find that the original protocol is susceptible to a class of attacks. On the positive side, we present a simple modification of the protocol which makes KEA secure. We prove that the modified protocol, called KEA+, satisfies the strongest security requirements for authenticated key-exchange and that it retains some security even if a secret key of a party is leaked. Our security proof is in the random oracle model and uses the Gap Diffie-Hellman assumption. Finally, we show how to add a key confirmation feature to KEA+ (we call the version with key confirmation KEA+C) and discuss the security properties of KEA+C.
- 4.Bellare, M., Rogaway, P.: Entity Authentication and Key Distribution. In: Stinson, D.R. (ed.) CRYPTO 1993, vol. 773, pp. 110–125. Springer, Heidelberg (1993)Google Scholar
- 5.Blake-Wilson, S., Johnson, D., Menezes, A.: Key Agreement Protocols and their Security Analysis. In: Darnell, M.J. (ed.) Cryptography and Coding 1997. LNCS, vol. 1355, pp. 30–45. Springer, Heidelberg (1997)Google Scholar
- 6.Canetti, R.: Universally Composable Security: A New Paradigm for Cryptographic Protocols. In: FOCS 2001: Proceedings of the 42nd IEEE symposium on Foundations of Computer Science. IEEE Computer Society, Los Alamitos (2001)Google Scholar
- 14.Menezes, A.: Another look at HMQV, IACR Eprint archive (2005), http://eprint.iacr.org/2005/205
- 15.NIST, SKIPJACK and KEA Algorithm Specification (1998), http://csrc.nist.gov/encryption/skipjack/skipjack.pdf
- 17.Shoup, V.: On Formal Models for Secure Key Exchange, Theory of Cryptography Library (1999), http://www.shoup.net/papers/skey.ps