对Bellare-Rogaway 3PKD模型安全性定义的修正  

Correcting the security definition of the Bellare-Rogaway 3PKD model

作　　者：刘军[1] 廖建新[1] 朱峰[2] 王纯[1] 

机构地区：[1]北京邮电大学网络与交换技术国家重点实验室,北京100876 [2]中国科学院软件研究所基础软件国家工程中心,北京100080

出　　处：《通信学报》2007年第9期1-6,共6页Journal on Communications

基　　金：国家杰出青年科学基金资助项目(60525110);国家重点基础研究发展计划("973"计划)基金资助项目(2007CB307100;2007CB307103);新世纪优秀人才支持计划(NCET-04-0111)~~

摘　　要：指出Bellare和Rogaway在1995年提出的三方密钥分发模型——Bellare-Rogaway 3PKD模型的安全性定义存在缺陷。为此,设计了一个新的三方密钥分发协议P-Flaw。该协议在Bellare-Rogaway 3PKD模型下是可证明安全的。但是通过分析发现该协议不能够抵抗服务器欺骗攻击、已知会话密钥攻击和重放攻击等攻击形式,其原因在于Bellare-Rogaway 3PKD模型不能够对分发的会话密钥进行源识别。利用匹配会话的概念,修正了Bellare-Rogaway 3PKD模型的安全性定义。A flaw lied in the security definition of the Bellare-Rogaway 3PKD model, which was proposed by Bellare and Rogaway for three-party key distribution in 1995, was discovered. To reveal it, a new three-party key distribution proto- col P-Flaw was proposed. The protocol was provably secure under the Bellare-Rogaway 3PKD model. However the protocol was not secure enough to withstand the server spoofing attack, known session key attack, and replay attack. The absence of the origin recognition for the distributed session key accounts for the flaw. Accordingly, the security definition of the Bellare-Rogaway 3PKD model was corrected based on matching conversation.

关 键 词：安全模型 可证明安全性 密钥分发 形式化分析 

分 类 号：TN918.91[电子电信—通信与信息系统]