The vulnerable part of communications between user and server is the poor authentication level on the user’s side. For example, in e-banking systems for user authentication are used passwords that can be lost or swindled by a person maliciously impersonating bank.

Nowadays appeared Smart-Id identification using smart phones has some advantages compared with the bank’s supplied passwords table to the user, but nevertheless it is a temporary measure to mitigate the increasing number of attacks to e-banking system.

Despite the fact that public key infrastructure (PKI) and certificates based identification exists for the 5-10 years, newly appeared Smart-Id identification becomes more popular. The reason is the complexity of PKI in traditional public key settings and the key escrow problem in ID-based public key settings. In this connection the alternative certificate-based signature is proposed as an attractive public key setting, which reduces the complexity of PKI and resolves the key escrow problem (Tseng et al., 2019).

Authors proposed a new and efficient certificate-based signature (CBS) scheme from lattices. Under the short integer solution (SIS) assumption from lattices, the proposed CBS scheme is shown to be existential unforgeability against adaptive chosen message attacks.

The other alternative is certificateless signature that has become a widely studied paradigm. This paradigm has a lack of key escrow problem and certificate management problem. But the problem of this primitive was non-resistance to catastrophic damage caused by key exposure. New results in this field are presented in (Mei et al., 2019).

Oulined above perspective solutions are in the investigation and developing stage so far.

The one of currently available solutions can be the cryptographic chip implemented in the user’s smartphone or in his credit card. This cryptographic chip could be supplied by the bank to the user with public key cryptosystem (PKC) parameters and supporting software. This software can be used to more secure authentication and communication session creation using authenticated key agreement protocol (AKAP).

In this case smart phone can provide much more functions to the customer. For example, it can be used as e-purse for off-line payments (Muleravicius et al., 2019).

Then user may not communicate with bank for any money transfer. It is enough to communicate with bank for withdrawal and deposit money to and from e-purse respectively using AKAP.

Moreover, AKAP can be combined together with biometric identification methods which popularity is growing nowadays but not so rapid as desirable.

In general, the user has significantly less computing power than server and therefore AKAP realization should need as small computation resources as possible.

We will consider two legal parties communication with each other, namely user Alice and Bank and an adversary. We assume that in all cases adversary has public keys of both parties and system parameters (SP) of a used cryptographic system. We consider the following type of attacks:

Active attacks are more powerful than eavesdropping attacks. They come up when Alice tries to login from a local infected computer. The malware infecting the computer could display a fake login screen and fool Alice into interacting with it, thus mounting an active attack.

One of the very “popular” kinds of attack is a Man-in-the-Middle (MiM) attack. The HTTPS protocol is vulnerable to this kind of attack (Callegati et al., 2009). An attacker capable of eavesdropping on traffic is also able to inject its own messages. The protocol completely falls apart in the presence of an active adversary who controls the network. The main reason is the lack of authentication. Alice sets up a shared secret, but she has no idea with whom the secret is shared. The same holds for the Bank. An active attacker can abuse this to expose all traffic between Alice and the Bank. This attack works against any key exchange protocol that does not include authentication. Moreover, neither KAP, nor identification protocols alone are secure against the MiM attack (Boneh and Shoup, 2020).

In 2015.03.17 Euronews made a report that on-line banking might be full of holes like Swiss Emmental cheese, http://www.euronews.com/2015/03/17/internet-banking-a-hacker-s-ideal-target/.

The reasons of this situation which has not significantly changed so far are outlined above, therefore, the measures must be implemented to protect the user especially against active adversary attacks.

To realize secure AKAP it is required to have a combination of several cryptographic primitives: key agreement protocol, identification protocol, digital signature, and asymmetric encryption.

To provide secure communications between Alice and the Bank it is required that Alice prove to the Bank her identity and that the Bank prove to Alice its identity. One party proving one’s identity is named a Prover – P and the other party verifying this proof is a Verifier – V. Hence, to create secure communications both parties should be both P and V to each other. This kind of identification is called mutual identification.

Secure identification protocols are based on the interaction between the P and V. They use a technique called challenge-response identification (Just, 2011) together with other protocols including key agreement protocol (KAP) thus yielding authenticated key agreement protocol (AKAP).

The aim of this paper is to present integrated AKAP between two parties: user Alice and the Bank using well known cryptographic primitives with provable security. AKAP should have the following properties:

Security analysis of proposed AKAP is presented referencing to security assumptions of cryptographic primitives used in our construction.

Effective realization means that computations and communications should be minimized. It is also desirable that the number of system parameters should be minimized as well. The number of these parameters depends on the selection of suitable cryptographic protocols. Several cryptographic protocols and schemes are having the same system parameters such as ElGamal cryptosystem (ElGamal, 1985) together with the same private and public keys:

These protocols are realized using the same discrete exponent functions dexp() in multiplicative cyclic groups of finite order. Some of them can be realized in elliptic curve groups. We will consider numerical groups, where operations are performed modulo large prime number p.

Two protocols AKAP1 and AKAP2 are considered. AKAP1 is a simpler protocol that does not provide user’s anonymity. AKAP2 provides user’s anonymity by adding additional encryption in the first communication round.

In the list above we have two signature schemes, namely ElGamal and Schnorr. We present here some analyses allowing us to choose a unique scheme better matching our requirements. The signature scheme we use as an additional authentication means from the Bank’s side. It is an optional measure since the Bank has a qualified e-signature certificate and can be authenticated by the user’s browser and during the execution of SSL/TLS protocol.

ElGamal signature scheme (ElGamal, 1985) is based on the discrete exponent function.

The original paper did not include a hash function as a system parameter. The message m was used directly in the algorithm instead of H (m) . This enables an attack called an existential forgery, as described in the paper of Pointcheval and Stern (Pointcheval and Stern, 2000).

ElGamal signature scheme (ElGamal, 1985) is vulnerable to the Bleichenbacher attack (Bleichenbacher, 1996).

This attack is avoided by using groups Gq of prime order q. The main drawback of ElGamal signature is that it has considerable long keys.

Due to these considerations, we choose the Schnorr signature in our construction. It is a new variant of the ElGamal signature which overcomes the drawbacks, namely: a long signature size and Bleichenbacher attack.

Schnorr identification and signatures (Schnorr, 1990, 1991) constitute one of the most fundamental public-key cryptosystems.

Pointcheval and Stern (1996, 2000) have shown that it is provably secure, assuming the hardness of the discrete logarithm (DL) problem in the Random Oracle Model (Bellare and Rogaway, 1993; Neven et al., 2009; Seurin, 2012).

Schnorr identification protocol is based on the exchange of challenge-response conversations between prover P and verifier V when P is seeking to prove to V some parameters associated with his/her identity. In our case the prover is Alice and the verifier is the Bank. The process of proof is based on the exchange of messages between P and V and is called conversation. In Schnorr identification protocol conversation consists of three rounds:

Both P and V are actively involved in the conversation, and the timing and ordering of the messages are critical. The active adversary playing the role of a prover must generate the first message before it sees the challenge generated by V.

To achieve the security of the AKE protocol against the active adversary, one must carefully intertwine the processes of identification and anonymous key exchange. The adversary actively impersonates a legitimate verifier. For example, the adversary may clone a banking site and wait for a user being a prover P to visit the site. When it occurs P runs the identification protocol with the adversary. As a result, the adversary repeatedly interacts with P on the behalf of verifier V and sends the prover arbitrary messages of its choice. After several such interactions, the adversary turns around and attempts to authenticate himself as the prover to a legitimate verifier V. Identification protocol is secure against active attacks if the adversary still cannot fool the legitimate verifier V.

In this paper we define security assumptions and provide security proof of AKAP1 against an active adversary. Security proof is based on transforming S-Id to AKAP1 which represents the so called sigma protocol (Boneh and Shoup, 2020). Unfortunately, the similar security proof for AKAP2 is not possible since AKAP2, being a more complex protocol, does not satisfy sigma protocol’s conditions. But nevertheless, AKAP2 seems to be more secure than AKAP1. Hence, so far the security of AKAP2 can be based only on the security of its cryptographic components listed above.

The other objective of this paper is to try to extend these results to the other conjectured one-way functions (OWF) having some similarity with used here dexp() function. For example, new conjectured OWF based on so called matrix power function (MPF) was proposed earlier in our papers (Sakalauskas et al., 2008, 2017; Sakalauskas and Mihalkovich, 2014, 2017; Sakalauskas, 2018). In Sakalauskas and Mihalkovich (2018) it is proved that inversion of MPF corresponds to NP-complete problem. This proof was based on the result presented in Sakalauskas (2012).

The structure of the paper is the following. To be self-contained, in Section 2 we present some mathematical background and describe cryptographic protocols and functions used in our construction. In Section 3 we present AKAP1 and AKAP2 description. Section 3 is dedicated to security analysis. In Section 4 conclusions and a look to the future work are presented.

We are dealing with a cyclic group Gq of prime order q with generator g. In our case Gq is a subgroup of the cyclic multiplicative group of integers Zp∗={1,2,…,p−1} where p is prime and multiplication is performed modulo p. Prime p is of n bit length, where n is a security parameter.

Since q is a prime factor of p−1 , then according to Lagrange’s theorem and its consequences all elements of Gq are generators. Then for all g in Gq the following identity holds (2.1) gq=1modp.

This identity allows checking if number g∈Zp∗ , g≠1 is a generator in Gq .

Let g∈Gq be a generator and x be an integer 1⩽x⩽q−1 , then discrete exponent function dexp() in Gq is defined as follows: (2.2) dexp(x)=gxmodp=a,a∈Gq.

The inverse function to dexp() is a discrete logarithm function dlogg(a) and is defined as follows: (2.3) dlogg(a)=xmod(q−1), where generator g is a discrete logarithm function’s base defined in (2.2).

If g is a generator in Gq then function dexp() is one-to-one and performs the following mapping (2.4) dexp:Zq−1→Gq, where Zq−1={0,1,2,…,q−1} is a ring of integers with addition and multiplication modulo q. This mapping plays a very important role in security considerations of cryptographic protocols based on dexp() function.

The necessary but not sufficient security assumption for all protocols presented above is discrete logarithm assumption and associated discrete logarithm problem (DLP).

Indeed, the computation of gx mod p can be done efficiently even for large numbers commonly referred to as square-and-multiply algorithms. But its inverse value computation corresponds to DLP and is reckoned as hard using classical (non-quantum) computers. But nevertheless, due to Shor (1997) DLP can be solved in polynomial-time using quantum algorithms running on quantum computers.

For example, when p and q are sufficiently large and suitably chosen primes the discrete logarithm problem in the group Gq being a subgroup of Zq−1 is believed to be hard to compute. Prime p should be at least 2048-bits, and q should be at least 256-bits.

All cryptographic primitives presented in the introduction are using the same system parameters SP=(p,g) , namely large (secure) prime number p and generator g of group  Gq .

To generate random and uniformly distributed parameters for cryptographic protocols we use a special notation. For example, if we uniformly choose a random element r from the set S then we write: (2.5) r=rand(S).

We assume that SP are generated by the Bank. The Bank generates a prime number p of at least 2048 bits length, i.e. |p|=2048 . Prime p should be suitably chosen in such a way that (p−1) should have a prime divider q of 256 bit length, i.e. |q|=256 . Then the Bank finds a generator g of defined above group Gq .

According to ElGamal cryptosystem, the Bank randomly generates its private key PrKB=y , where (2.6) y=rand(Zq),y∈Zq,1<y<q.

Then corresponding to its private key the public key PuKB=b , is computed (2.7) b=gymodp,b∈Gq.

System parameters SP=(p,g) and the Bank’s PuKB=b are openly distributed among all the Bank’s customers including Alice.

When user Alice opens her account in the Bank, then during the registration phase she receives SP=(p,g) and the Bank’s PuKB=b .

In addition, there are two opportunities for Alice to complete the registration operation. Either she receives the Bank’s generated public and private key pair PrKA=x , PuKA=a , for her, where (2.8) x=rand(Zq),x∈Zq,1<x<q, (2.9) a=gxmodp, or she generates this key pair by herself using special certified application software supplied by the Bank. In the latter case Alice keeps secret her PrKA=x from everyone (including the Bank).

In both cases all parameters mentioned above are kept in certain storage devices (e.g. USB token, SIM card, Smart phone apps, etc.) together with the certified application program.

Every user including Alice has system parameters SP=(p,g) , the Bank’s PuKB=b , her PuKA=a and her PrKA=x .

In our model the Adversary can know two alternative sorts of information: either system parameters SP=(p,g) , the Bank’s PuKB=b and user’s public key, e.g. PuKA=a or he may know only SP and PuK B . In the latter case, PuK A is not openly transmitted during AKAP.

To be self-contained we present here a description of protocols and functions used for AKAP construction.

We present here two modifications of AKAP, namely AKAP1 and AKAP2 taking three communications between Alice and the Bank. AKAP1 is partially disclosing the user’s anonymity by openly sending her PuK A . In the case of AKAP1, the eavesdropping adversary can see that certain communications with the Bank are performed by the same person using the same PuK.

AKAP2 is providing user’s anonymity without disclosing any user’s personal information by realizing randomized encryption of the user’s PuK during every session.

All parties including the adversary share the common information, namely system parameters SP=(p,g) and the Bank’s PuKB=b . In addition, we also assume that the adversary may know public keys of users. So, in our model adversary knows two alternative sorts of information: either system parameters SP and the Bank’s PuK B or SP, PuK B and users public keys, (e.g. PuK A ).

When Alice is a prover P then she uses protocol P (x,a) with input parameters (x,a) and the Bank uses the verification protocol V(a) respectively. We assume that the Bank is the trusted party and therefore it can prove its identity to users by its signature and PuK B certificate realized in the lower level protocols such as SSL/TLS. But nevertheless, we supply AKAP1 and AKAP2 by extra identification of the Bank by signing its challenge sent to the user.

AKAP1

Alice and the Bank shares system parameters SP=(p,g) , PuKA=a and PuKB=b .

At this stage AKAP1 communications are finished.

After receiving r the Bank verifies if Alice knows her private key x corresponding to her public key a, which is registered in the Bank’s database. The verification equation is the following: (3.6) gr=lahgamodp.

If the last equation is valid, then the identification procedure is passed successfully. The Bank computes the common session secret key kBA according to Diffie–Hellman key exchange protocol (3.7) kBA=lvmodp.

Obviously at this moment parties agreed on their common session key k=kAB=kBA and parties can continue communication using created secure channel with agreed secret key k.

The difference between convenient Schnorr identification protocol and AKAP1 is that there is an additional variable ga in a verification equation (3.6). This will allow us to prove that S-Id is secure against an active adversary.

The second protocol is AKAP2 providing Alice’s anonymity against an eavesdropping adversary. In this case, Alice’s Puk = a is encrypted and the adversary cannot distinguish if either the same person or two different persons are communicating with the Bank when he is eavesdropping and analysing any two different communications.

AKAP2

At this stage AKAP2 communications are finished.

After receiving r the Bank verifies if Alice is the correct prover. He verifies if the following identity holds (3.17) gr=dAahgamodp.

If it is the case, then the Bank computes the common session secret key kBA (3.18) kBA=dAvmodp.

At this stage parties agreed on the common secret key k=kBA=kAB , performed mutual identification and can proceed communications by creating the secret channel.

We show that AKAP1 is secure against active attack under the DL assumption by transforming the Schnorr identification protocol to Schnorr Sigma we denoted as AKAP1 protocol. A brief introduction to Sigma protocols is needed. Let X and A be finite sets and R is a binary relation R⊆X×A on X×A . Then referencing to Boneh and Shoup (2020) we have the following definition.

Let X=Zq and A=Gq then R⊆Zq×Gq and (x,a)∈R , when a=gxmodp . Then element PrKA=x∈Zq is a witness and element PuKA=a∈Gq is a statement.

P and V interactions are carried out in a similar way as they are presented in Section 2.

To transform S-Id to AKAP1 we include an input a witness-statement pair (x,a)∈R to compute P (x,a) for the prover.

We will prove that the AKAP1 protocol satisfies Sigma protocol’s conditions. Notice that the prover P in S-IP takes as an input just the witness x, rather than the witness/statement pair (x,a) , as formally required in the definition of any Sigma protocol. Therefore the conversation (l,h,r) is changed to the conversation (l,a,h,r) .

Sigma protocol must satisfy the following conditions:

The following theorem is presented without a proof (Boneh and Shoup, 2020).

To proceed we must transform Definition 2.17 of HVZK to the definition of special HVZK (Boneh and Shoup, 2020).

The differences between HVZK and special HVZK are the following: first, the simulator takes the challenge h as an additional input; second, it is required that the simulator produce an accepting conversation even when the statement a does not have a witness x. These two properties are the reason for the introduction of the notion of special HVZK.

The following theorem we present without proof is required (Boneh and Shoup, 2020).

Referencing to our considerations above and Theorem 4.6. We can prove the following result.

Unfortunately, the similar result can not be proved for the AKAP2 protocol. The main reason is that it is not a Sigma protocol since the user’s PuKA=a is encrypted during the first move of the protocol and can be decrypted only by a designated verifier V which is a Bank. In this case an active adversary has no access to the user’s public key. Therefore, the theorems formulated above for Sigma protocols are not valid.

The security of AKAP2 we consider in the context of security of its components.

The user’s anonymity protection is based on the security of the ElGamal encryption scheme. According to Theorem 2.12, the compromising of anonymity is equivalent to DDH problem solution. If SP has secure values then DDH assumption holds and anonymity is not compromised. In this case an eavesdropping adversary cannot distinguish any two conversations either they are originated from the same user or from the two different users.

The other characteristic of AKAP2 is that challenge h in AKAP1 is encrypted and signed. This encrypt and sign paradigm avoids the chosen-ciphertext attack and is CCA-secure encryption (Boneh and Shoup, 2020).

Two authenticated key agreement protocols AKAP1 and AKAP2 based on Diffie–Hellman KAP, Schnorr identification, Schnorr signature, and ElGamal encryption are presented.

It is proved that AKAP1 is secure against an active adversary under the discrete logarithm (DL) assumption.

To increase the security of AKAP1 the modified AKAP2 is proposed. Since this protocol does not satisfy sigma protocols conditions, the security proof of AKAP2 is restricted to only two components providing user’s anonymity and CCA-secure encryption of verifiers (Bank’s) challenge which is used also to agree on the common secret key.

Referencing to these results it is an intriguing idea to construct AKAP based on other similar assumptions instead of classical DL assumption, namely based on NP-complete problems. New conjectured one-way-function based on so called matrix power function (MPF) was proposed earlier in our papers (Sakalauskas et al., 2008, 2017; Sakalauskas and Mihalkovich, 2014, 2017; Sakalauskas, 2018). MPF has some similarities with discrete exponent function. In Sakalauskas and Mihalkovich (2018) it is proved that inversion of MPF corresponds to a NP-complete problem. This proof was based on the result presented in Sakalauskas (2012). So far, the only key agreement protocol and asymmetric encryption scheme were realized using MPF but we think that the other protocols suitable for AKAP construction can be realized as well. Hence we expect that referencing to the results presented in this paper we could construct new AKAP based on MPF and prove its security using a similar methodology to the one presented in this paper.