Paper 2009/253 Original: eprint.iacr.org/2009/253 ↗
Formally and Practically Relating the CK, CK-HMQV, and eCK Security Models for Authenticated Key Exchange
Abstract
Many recent key exchange (KE) protocols have been proven secure in the CK, CK-HMQV, or eCK security models. The exact relation between these security models, and hence between the security guarantees provided by the protocols, is unclear. First, we show that the CK, CK-HMQV, and eCK security models are formally incomparable. Second, we show that these models are also practically incomparable, by providing for each model attacks that are not considered by the other models. Our analysis enables us to find several previously unreported flaws in existing protocol security proofs. We identify the causes of these flaws and show how they can be avoided.
Metadata
- Available format(s)
PDF- Category
- Cryptographic protocols
- Publication info
- Preprint.
- History
- 2010-07-27: last updated
- 2009-06-01: published
- Short URL
- https://ia.cr/2009/253
- License
- https://creativecommons.org/licenses/by/4.0/
BibTeX
@misc{cryptoeprint:2009/253,
author = {Cas J. F. Cremers},
title = {Formally and Practically Relating the CK, CK-HMQV, and eCK Security Models for Authenticated Key Exchange},
howpublished = {Cryptology {ePrint} Archive, Paper 2009/253},
year = {2009},
url = {https://eprint.iacr.org/2009/253}
}