利用Weil 配對之跨領域身份基礎附驗證金鑰合議協定

Abstract

當溝通雙方分處於不同領域 (domain) ，而想建立共享金鑰來進行祕密通訊時，就需要一個跨領域的金鑰合議協定 (key agreement protocol) 。近年來，很多身份基礎 (identity-based) 的附驗證 (authenticated) 金鑰合議協定被提出來。絕大多數的研究在解決此類通訊協定效率問題時，皆假設溝通的雙方處於同一個領域；例如：同一間公司的雇員。也就是說，在身份基礎的架構 (identity-based scheme) 下，溝通的雙方必須向同一個被信任的管理者 (Trusted Authority) 註冊，來獲得相對應於使用者公開身份 (public identity) 的私鑰 (private key) 。然而，在現今溝通頻繁的社會，欲建立祕密通訊的雙方極有可能處於不同的領域；例如：各自屬於兩間獨立的公司的雇員。如此一來，一個可以實現跨領域金鑰合議的通訊協定便有其必要性。 Chen 和 Kudla 在 2003 年曾提出一個具有跨領域特性的身份基礎附驗證金鑰合議協定。然而，他們所設計的協定中假設了不同領域的被信任管理者採用了一樣的系統參數，所有的領域管理者都必須向一個信任第三方 (Trusted Third Party) 索取共用的參數。我們發現這樣的假設產生了一些潛在的問題。首先，當信任第三方更新系統參數時，所有的信任管理者都必須立即更新，否則採用了不同的系統參數將導致處於不同領域的使用者無法建立共享金鑰。如此一來，從整個系統的角度來看，金鑰更新所產生的計算量相當地大，同時還有金鑰更新不同步的問題，使用者若處於金鑰更新較慢的領域，將無法和其他領域的使用者建立共享金鑰。其次，依賴信任第三方提供系統參數，而不是讓信任管理者自由地選擇系統參數，將大大限制了信任管理者在金鑰管理上的彈性。 在本篇論文當中，我們提出了一個跨領域金鑰合議通訊協定，允許信任管理者自行決定系統參數，在不降低安全性的情況下，使處於不同領域的使用者仍然可以建立共享金鑰。如此一來，每個領域的信任管理者可以自由地決定金鑰更新的時間點，更新的動作也不會影響到其他領域的信任管理員及使用者，亦可自由地選擇系統參數，也提高了金鑰管理的彈性。

An inter-domain key agreement protocol is needed while two parties in distinct domains desire to have a shared secret that is mutually agreed. A number of identity-based (ID-based) authenticated key agreement (AK) protocols using the Weil and Tate pairings have been proposed in recent years. These researches include how to make the protocols efficient, e.g., McCullagh and Barreto’s ”New Two-Party Identity-Based Authenticated Key Agreement”; how to extend AK protocol to a group, e.g., Reddy and Nalla’s ”Identity Based Authenticated Group Key Agreement Protocol”. Most of them achieve key agreement between parties inside a single domain, for example, employers of a company, staff of an organization. In other words, parties involved in communication are required to register to a common Trusted Authority (TA), which generates private keys from user’s public identity in an identity-based cryptosystem. Nowadays, a large number of communications are raised between parties in different domains, e.g., two independent companies. It is highly possible that these parties register to different TAs and thus a key agreement protocol suitable for this case is necessary. In 2003, Chen and Kudla have proposed a key agreement protocol that helps the establishment of shared secret key between parties in distinct domains. Later in 2005 McCullagh and Barreto have further proposed a new protocol to improve the efficiency of Chen and Kudla’s work. However, we found their protocols suffer from the lack of scalability and practicability. If parties involved in key agreement have registered to the same TA, they may apply identical system parameters for pairing computation. However, when parties involved in key agreement registered to distinct TAs, the possibility of applying different system parameters is not negligible. All previous works have assumed that system parameters for pairing computation are globally agreed or decided by an international standard body, which may cause vast cost of key update in real applications. Besides, following their protocols, two parties in different domains can agree on a shared secret only by applying identical system parameters. In other words, the inter-domain key agreement may fail for TAs that are inevitably equipped with different parameters, e.g., a delay of parameter update from the international standard body. In this paper, we propose an inter-domain identity-based authenticated key agreement protocol that eliminates the requirement of applying identical generator P ∈ G1 for TAs participating in key agreement protocols and achieves to establish a shared secret key between parties in distinct domains.