The vulnerabilities arise due to the fact that AKA is not a secure KE in the standard cryptographic sense, since Client C does not contribute randomness to the session key. We argue that AKA remains secure in current deployments where C is an entity controlled by a single tamper-resistant User Identity Module (UIM). However, we also show that AKA is insecure if several Client's devices/UIMs share his identity and key.
We show practical applicability and efficiency benefits of such multi-UIM scenarios. As our main contribution, we adapt AKA for this setting, with only the minimal changes, while adhering to AKA design goals, and preserving its advantages and features. Our protocol involves one extra PRFG evaluation and no extra messages. We formally prove security of the resulting protocol. We discuss how our security improvement allows simplification of some of AKA security heuristics, which may make our protocol more efficient and robust than AKA even for the current deployment scenarios.
Category / Keywords: cryptographic protocols / AKA (Authenticated Key Agreement), Key Exchange, Publication Info: SCN 2010 Date: received 16 Jun 2010 Contact author: kolesnikov at research bell-labs com Available formats: Postscript (PS) | Compressed Postscript (PS.GZ) | PDF | BibTeX Citation Note: This is the full version of the SCN 2010 paper. It contains proofs of security omitted from the proceedings version. Version: 20100618:183819 (All versions of this report) Discussion forum: Show discussion | Start new discussion