Abstract
In 2009, Zheng et al. proposed an efficient password-based group key agreement protocol resistant to the dictionary attacks by adding password-authentication services to a non-authenticated multi-party key agreement protocol proposed by Horng. They claimed that the proposed protocol is very efficient since it only requires constant rounds to agree upon a session key, and each user broadcasts a constant number of messages and only requires four exponentiations. Under the Decisional Diffie-Hellman assumption, they shown the proposed protocol is provably secure in both the ideal-cipher model and the random-oracle model. But in this paper, we show that the protocol Zheng et al. proposed is vulnerable to an active insider attack.
Introduction
Authenticated group key agreement (GKA) protocols enable a set of users communicating over an insecure, open network to establish a shared secret called session key and furthermore to be guaranteed that they are indeed sharing this session key with each other (i.e., with their intended partners). The session key may be subsequently used to achieve some cryptographic goals such as confidentiality or data integrity. Authenticated GKA protocols allow two or more users to agree upon session key even in the presence of active adversaries. These protocols are designed to deal with the problem to ensure users in the group setting that no other principals aside from members of the group can learn any knowledge about the session key. Hence, authenticated GKA protocols can provide a natural secure mechanism for achieving secure multicasting communication in numerous grouporiented scenarios, such as video conferencing, secure replicated database, collaborative applications and distributed computations.
Introduction
Since the elegant two-party key agreement protocol [1] was proposed by Diffie-Hellman in 1976, many papers have extended this two-party Diffie-Hellman protocol to the group setting. These GKA protocols are classified into two kinds: non-authenticated [2] [3] [4] [5] 15] and authenticated [7, 9, 11, 12, 14] . Burmester and Desmedt [2, 3] proposed a well-known non-authenticated GKA protocol (BD for short) with constant number of rounds under the broadcast channel. Horng [4] focused on the computational efficiency of GKA protocols and proposed a non-authenticated GKA protocol which requires only two rounds of communication. Recently, Katz and Yung [6] proposed a scalable compiler that transforms any GKA protocol into an authenticated one. They also applied their compiler to add authentication services for the BD protocol. However, this solution needs the support provided by the Public Key Infrastructure (PKI) which leads to be more computation overhead.
Introduction
Password is one of the ideal authentication approaches to agree a session key in the absence of PKI or pre-distributed symmetric keys. There are several works about how to design the PGKA protocol [8] [9] [10] [11] [12] . Zheng et al. presented an efficient and secure password-based group key agreement protocol in static group setting according to adding password-authentication services to the protocol proposed by Horng [4] . In their protocol, the legitimate users can share only a low entropy human-memorable password and communicating over an insecure channel controlled by the active adversary, to agree upon a high-entropy session key among themselves. They emphasize that their protocol is provably secure in the randomoracle and ideal-cipher models under the Decisional Diffie-Hellman (DDH) assumption. But in this paper, we point out that Zheng et al.'s password-based group key agreement protocol is not authenticated and easy to be forged or modified. And we give a method that the insider attacker can force all group members.
Introduction
The remainder of this paper is organized as follows: In Section 2, we review the computational assumptions and Zheng et al.'s password-based group key agreement protocols. In Section 3, we propose the attack method in details. In Section 4, we conclude.
Preliminaries

Decis n l Diffie-Hellman (DDH) assumption io a
Let G=〈g〉 be any finite cyclic group of prime order q. Informally, the DDH assumption is that it is difficult to distinguish the following real Diffie-Hellman distribution Γ real and random Diffie-Hellman distribution Γ rand :
Decis n l Diffie-Hellman (DDH) assumption io a
, we say that the DDH assumption holds in group G if is negligible for any probabilistic polynomial time adversary A. We denote the maximum value of overall adversary A running in time at most t.
Multi-Decisional Diffie-Hellman (MDDH) assumption
We present another computational assumption based on the Diffie-Hellman assumption. Let us define real Multi Diffie-Hellman distribution П real and random Multi Diffie-Hellman distribution П rand of size n as follows: 
Review of Zheng et al.'s protocol
At first, we present the following notations are used throughout this paper:
Review of Zheng et al.'s protocol
a secure large prime.
p:
a large prime such that p=2q+1.
p:
G q : a subgroup of quadratic residues in , that is
p:
g: a generator for the subgroup G q .
p:
: an ideal-cipher system. E k is a keyed permutation over G q and D k is inverse of E k . k is the symmetric key.
H:
, a hash function for generating the symmetric key.
H:
, a hash function for generating the session key.
H:
, a hash function for key confirmations.
H:
l H , l G and l F denote outputted bit-length of H, G and F, respectively. Without loss of generality, let U={u 1 ,u 2 ,…,u n } be the initial set of users that want to generate a session key. Each user u i has a specific index i. Note that in the following, the indices are taken in a cycle, e.g.: u i−1 , u i+1 are the left and right neighbors of u i for 1≤i≤n (u n+1 =u 1 ,u 0 =u n ). x∈ R X means that element x is chosen uniformly random in set X.
H:
Suppose n users share a low-entropy password pw which is uniformly drawn from a small dictionary of size N, and wish to agree a high-entropy common session key among themselves. Their PGKA protocol is obtained by modifying the non-authenticated GKA protocol of Horng [4] by using password encrypted authentication mechanism. The protocol was described as follows:
H:
Step1: Each user u i (1≤i≤n) chooses a random nonce N i and broadcasts (u i , N i ). Upon receiving all (u j , N j ) (1≤j≤n, j≠i), u i sets session S={(u i , N i )|1≤i≤n}.
H:
Step2: Each user u i chooses x i ∈ R Z q , computes and broadcasts , where , k i =H(S, i, pw). Let U={u 1 ,u 2 ,…,u n } be the initial set of users that want to generate a session key. As description in section 2.3, the n users share a low-entropy password pw. u i−1 , u i+1 are the left and right neighbors of u i for 1≤i≤n (u n+1 =u 1 ,u 0 =u n ). We suppose that user u * ∈U had participated in a previous session to make a group key. We assume u * can control the network of u r ∈U who he/she want to impersonate. Step1: Each user u (1≤i≤n) chooses a random nonce N i and broadcasts As in the above attack, any user can be an attacker who can impersonate any one of the users set to the others. As an insider user in Zheng et al.'s password-based group key agreement protocol, the others can't authenticate him/her, because the n users share a common password.
Conclusion
In this paper, we have shown that Zheng et al.'s password-based key agreement is not as secure as stated by the authors. Our proposed attack compromised Zheng et al.'s protocol, causing the user of the group to fail to agree upon a common communication key. Thus, the group members cannot communicate together security.

{'paper_id': '62226482', 'title': 'Insider Attack on A Password-Based Group Key Agreement', 's2_url': 'https://api.semanticscholar.org/CorpusID:62226482', 'source': 'S2ORC'}