可证安全的无证书两方认证密钥协商协议  

Provably Secure Certificateless Two-party Authenticated Key Agreement Protocol

作　　者：许盛伟[1,2] 任雄鹏 陈诚 袁峰[2] 杨自力 XU Sheng-Wei;REN Xiong-Peng;CHEN Cheng;YUAN Feng;YANG Zi-Li(School of Telecommunications Engineering,Xidian University,Xi’an 710071,China;Beijing Electronic Science and Technology Institute,Beijing 100071,China;Wuhan Antiy Information Technology Co.Ltd.,Wuhan 430070,China)

机构地区：[1]西安电子科技大学通信工程学院,西安710071 [2]北京电子科技学院,北京100071 [3]武汉安天信息技术有限责任公司,武汉430070

出　　处：《密码学报》2020年第6期886-898,共13页Journal of Cryptologic Research

基　　金：国家重点研发计划(2018YFB1004101,2018YFB0803600)。

摘　　要：由于无证书密码体制能够摆脱PKI体制的证书管理和标识密码体制的密钥托管局限性,基于无证书的认证密钥协商协议成为了研究热点.目前已知的协议均未能保证安全性和计算效率的统一,本文首先通过构造攻击算法,指出现有的两个无证书密钥协商协议均存在相应安全缺陷,包括I类敌手的KCI攻击和普通敌手的KCI攻击,然后提出一个新的无证书两方认证密钥协商协议,在无证书mBR安全模型和随机预言机模型下,针对两类敌手分别基于CDH和DCDH困难问题假设实现了可证明安全.与同类协议相比,计算开销和通信成本较低,每个用户只需5个点乘运算,通信过程中除却必需的公钥外,仅需群中一个点的消息长度.该协议在安全性和效率之间实现了更好的平衡,在带宽受限的通信环境中有较好的应用前景.As certificateless cryptography can surpass the limitations of certificate management from PKI system and IBC-based key escrows,it is a hotspot in cryptographic research.Existing protocols do not make a good compromise between security and computational efficiency.This paper first constructs two attacks on two existing protocols,including KCI attack of Type I adversary and KCI attack of ordinary adversary.Based on the computational Diffie-Hellman and divisible computational Diffie-Hellman assumptions,this paper proposes a new certificateless two-party authenticated key agreement protocol with provable security under the mBR security model and random oracle model.In the proposed protocol,each party needs only five scalar multiplications,and the transmitted message only includes the information of one point in the group and the necessary public key.Compared with other similar protocols,the proposed protocol has lower computation overhead and communication cost,The proposed protocol also achieves a better compromise between efficiency and security,hence it is suitable to applications in the bandwidth-restricted communication environment.

关 键 词：无证书 密钥协商 可证明安全 安全模型 

分 类 号：TP309.7[自动化与计算机技术—计算机系统结构]