Analysis of Key-Exchange Protocols and Their Use for Building Secure Channels

By Ran Canetti, Hugo Krawczyk. International Conference on the Theory and Application of Cryptographic Techniques, 2001

1,697 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Information Systems

View Paper: https://www.semanticscholar.org/paper/e56f9dc2ef53c9479d3d94f593b66a40e6dba52b

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Information Systems

Citations in the corpus

Modern Cryptography: Theory and Practice (2003, background): “, [37] on key transport protocols, [36, 38] on key agreement protocols, [21, 57] on password-based protocols, [18, 66] on key exchange protocols and design to be correct protocols, and [67] on the Internet Key Exchange (IKE) protocols.”
Stronger Security of Authenticated Key Exchange (2006, methodology): “Additionally, the Canetti-Krawczyk [11] definition has an optional perfect forward secrecy (PFS) requirement.”
The Order of Encryption and Authentication for Protecting Communications (or: How Secure Is SSL?) (2001, methodology): “We also sketch the model of “secure channels” from [8].”
HMQV: A High-Performance Secure Diffie-Hellman Protocol (2005, methodology): “In spite of the ambitious security goals described above, it turns out that when casting these goals in a well-defined formal setting as the one in [11], the MQV protocol falls short of delivering most of its intended security.”
On the Security of Joint Signature and Encryption (2002, background): “The above argument also indicates that gCCA2 -security is suf-£cient for all applications where chosen ciphertext security matters (e.g., those in [31, 9, 8]).”
Off-the-record communication, or, why not to use PGP (2004, background): “(3)For clarity, we describe only the simplest form of DiffieHellman key agreement here; for more detailed versions of the protocol, see [7].”
Relaxing Chosen-Ciphertext Security (2003, methodology): “Next, we consider the simple key-exchange protocol of [10] based on any CCA-secure encryption scheme.”
Scalable Protocols for Authenticated Group Key Exchange (2003, background): “, [19,8,20,6, 25,4,30,15,16,17] and others) and is fairly well-understood; furthermore, a variety”
A Formal Security Analysis of the Signal Messaging Protocol (2017, background): “It is often preferable to analyze the key exchange portion independently from the message transport layer, and then compose this with authenticated encryption to establish a secure channel [22].”
CRYSTALS - Kyber: A CCA-Secure Module-Lattice-Based KEM (2017, background): “(Note that full forward secrecy is not achievable for a two-round authenticated key-exchange protocol [25].”
Leakage-Resilient Public-Key Cryptography in the Bounded-Retrieval Model (2009, methodology): “We adapt the notion of SK-security with perfect forward secrecy from Canetti and Krawczyk in [6], and update it to model key-leakage attacks.”
Guide to Elliptic Curve Cryptography (2004, background): “50 were proven secure by Canetti and Krawczyk [84].”
Provably Secure Authenticated Key Agreement Scheme for Smart Grid (2018, methodology): “ysis, and show that the proposed authentication scheme is provably secure under CK-adversary model [17] (described in Section I-B).”