Cryptology ePrint Archive: Report 2019/1239

Computationally Modeling User-Mediated Authentication Protocols

Britta Hale

Abstract: User interaction constitutes a largely unexplored field in protocol analysis, even in instances where the user takes an active role as a trusted third party, such as in the Internet of Things (IoT) device initialization protocols. Initializing the study of computational analysis of 3-party authentication protocols where one party is a physical user, this research introduces the 3-party possession user mediated authentication (3-PUMA) model. The 3-PUMA model addresses active user participation in a protocol which is designed to authenticate possession of a fixed data string – such as in IoT device commissioning. To demonstrate the 3-PUMA model in practice, we provide a computational analysis of the ISO/IEC 9798- 6:2010 standard’s Mechanism 7a authentication protocol which includes a user interface and interaction as well as a device-to-device channel. We show that the security of ISO/IEC 9798-6:2010 Mechanism 7a relies upon a non-standard MAC security notion, which we term existential unforgeability under key collision attacks (EUF-KCA). It is unknown if any standardized MAC algorithm achieves EUF-KCA security, indicating a potential vulnerability in the standard.

Category / Keywords: cryptographic protocols / authentication protocols, key distribution, user interface, MAC security, key-collision attacks

Original Publication (with major differences): ProvSec2018

Date: received 22 Oct 2019

Contact author: britta hale at nps edu

Available format(s): PDF | BibTeX Citation

Note: An extended abstract appears in the proceedings of ProvSec 2018. This is the full version.

Version: 20191023:084440 (All versions of this report)

Short URL: ia.cr/2019/1239


[ Cryptology ePrint archive ]