近年來，在pairing 密碼系統下植基於身份的雙方和三方金鑰協議大量被提出，而在多方(含三方以上)成員的系統我們稱之為會議金鑰協議機制。會議金鑰協議機制適用於分散式系統和無線的環境中，例如Ad hoc的網路環境。但是基於計算效率和安全的考量下，並不容易將雙方金鑰協議機制擴展到多方，除了上述兩個主要的特性外，植基於身份的金鑰協議機制應該考慮到跨領域的特性。目前只有少數的文獻提出植基於身份的多方會議金鑰協議機制，而且在這些解決方法上都不能兼具所有安全特性，例如前推私密性與抗偽裝攻擊等，而且他們的機制均是建立在同一個領域下。在此篇論文中，我們將提出一個新型有效率的多方會議金鑰協議機制並將之擴展到跨領域，同時也運用正規的方法來證明我們所提出的會議金鑰協議機制能滿足所有的安全特性。

Recently, many identity-based two-party and three-party key agreement schemes were proposed based on pairing cryptosystems. Multi-party (including more than three parties) key agreement protocols, which are called conference key schemes, can be applied to distributed systems and wireless environments such as Ad hoc networks. However, it is not easy to extend two or three-party schemes to multi-party ones with the guarantee of efficiency and security. In addition to the above two properties, inter-domain environments should also be considered in identity-based key agreement systems. However, only few identity-based multi-party conference key agreement schemes in single domain were proposed in the literature and they did not satisfy all of the security attributes such as forward secrecy and withstanding impersonation. In this thesis, we will propose a novel efficient single-domain identity-based multi-party conference key scheme and extend it to an inter-domain version. Finally, we will prove that the proposed schemes satisfy the required security attributes via formal methods.

1 Introduction 1
2 Preliminaries 4
2.1 Pairing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2.1.1 Bilinear Pairing . . . . . . . . . . . . . . . . . . . . . . 4
2.1.2 Hard Problems . . . . . . . . . . . . . . . . . . . . . . 5
2.2 Security Attributes . . . . . . . . . . . . . . . . . . . . . . . . 13
2.3 Random Oracle Security Model . . . . . . . . . . . . . . . . . 14
3 Literature Review 17
3.1 Yijuan Shi, Gongliang Chen and Jianhua Li’s Scheme . . . . . 17
3.1.1 Shi et al’s. Protocol . . . . . . . . . . . . . . . . . . . 17
3.1.2 Security Analysis . . . . . . . . . . . . . . . . . . . . . 18
3.2 Xinjun Du, Ying Wang, Jianhua Ge and Yumin Wang’s Scheme 19
3.2.1 Du et al.’s Protocol . . . . . . . . . . . . . . . . . . . . 19
3.2.2 Security Analysis . . . . . . . . . . . . . . . . . . . . . 21
3.3 Zhang Peng Ye Chengqing, Li Xin and Ma Xuying’s Scheme . 22
3.3.1 Peng et al.’s Protocol . . . . . . . . . . . . . . . . . . . 22
3.3.2 Security Analysis . . . . . . . . . . . . . . . . . . . . . 23
3.4 Jeung-Seop Kim, Hyo-Chul Kim, Kyeoung-Ju Ha, and Kee-
Young Yoo’s Scheme . . . . . . . . . . . . . . . . . . . . . . . 24
3.4.1 Kim et al.’s Protocol . . . . . . . . . . . . . . . . . . . 24
3.4.2 Security Analysis . . . . . . . . . . . . . . . . . . . . . 25
4 Our Proposed Schemes 26
4.1 The Proposed Scheme in Single TA . . . . . . . . . . . . . . . 26
4.2 The Proposed Scheme in Distinct TAs . . . . . . . . . . . . . 31
5 Security Proof 34
5.1 Correctness . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
5.2 Known Session Key Security . . . . . . . . . . . . . . . . . . . 35
5.3 Key-Compromise Impersonation . . . . . . . . . . . . . . . . . 39
5.4 Forward Secrecy . . . . . . . . . . . . . . . . . . . . . . . . . . 43
5.5 Key Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
6 Discussions 49
7 Conclusions 52

[1] S.S. Al-Riyami and K.G. Paterson. Tripartite authenticated key agreement protocols from pairings. In Cryptography and Coding 2003, volume 2898 of LNCS, pages 332–359, 2003.
[2] F. Bao, R. H. Deng, and H. Zhu. Variations of Diffie-Hellman problem. In Infromation and Communications Security, volume 2836 of LNCS, pages 301–312, 2003.
[3] R. Barua, R. Dutta, and P. Sarkar. Extending Joux’s protocol to multi party key agreement. In Progress in Cryptology-INDOCRYPT 2003, volume 2904 of LNCS, pages 205–217, 2003.
[4] M. Bellare and P. Rogaway. Random oracles are practical: A paradigm for designing efficient protocols. In Proceedings of the 1st ACM conference on Computer and communications security CSS, pages 62–73, 1993.
[5] M. Bellare and P. Rogaway. Entity authentication and key distribution. In Advances in Cryptology-CRYPTO 93, volume 773 of LNCS, pages
232–249, 1994.
[6] I. F. Blake, G. Seroussi, and N. P. Smart, editors. Advances in Elliptic Curve Cryptography. Number 317 in London Mathematical Society Lecture Note Series. Cambridge, 2005.
[7] S. Blake-Wilson, D. Johnson, and A. Menezes. Key agreement protocols and their security analysis. In 5th Annual Workshop on Selected Areas in Cryptography (SAC’98), volume 1355 of LNCS, pages 30–45, 1997.
[8] D. Boneh, X. Boyen, and H. Shacham. Short group signatures. In Advances in Cryptology-CRYPTO 2004, volume 3152 of LNCS, pages 41–55, 2004.
[9] D. Boneh and M. Franklin. Identity-based encryption from Weil pairing. SIAM J. of Computing, volume 32, number 3, pages 586-615, 2003.
[10] X. Boyen and B.Waters. Anonymous hierarchical identity-based encryption (without random oracles). In Advances in Cryptology-CRYPTO 2006, volume 4117 of LNCS, pages 209–307, 2006.
[11] L. Chen, Z. Cheng, and N.P. Smart. Identity-based key agreement protocols from pairings. Cryptology ePrint Archive, Report 2006/199, Available at http://eprint.iacr.org/2006/199.pdf, 2006.
[12] L. Chen and C. Kudla. Identity-based key agreement protocols from pairings. In Computer Security Foundations Workshop, 2003. Proceedings. 16th IEEE, pages 219–233, 2003.
[13] Y. J. Choie, E. Jeong, and E. Lee. Efficient identity-based authenticated key agreement protocol from pairings. Applied Mathematic and Computation, volume 162, issue 1, pages 179-188, 2005.
[14] W. Diffie and M. E. Hellman. New directions in cryptography. IEEE Transactions on Information Theory, volume 22, issue 6, pages 644-654, 1976.
[15] X. Du, Y. Wang, J. Ge, and Y. Wang. An id-based authenticated two round multi-party key agreement. Cryptology ePrint Archive, Report 2003/247, Available at http://eprint.iacr.org/2003/247.pdf, 2003.
[16] X. Du, Y. Wang, J. Ge, and Y. Wang. An improved id-based authenticated group key agreement scheme. Cryptology ePrint Archive, Report 2003/260, Available at http://eprint.iacr.org/2003/260.pdf, 2003.
[17] R. Dutta and R. Barua. Overview of key agreement protocols. Cryptology ePrint Archive, Report 2005/289, Available at http://eprint.iacr.org/2005/289.pdf, 2005.
[18] A. Joux. A one round protocol for tripartite Diffie-Hellman. Journal of Cryptology, volume 17, number 4, pages 263-276, 2004.
[19] J. S. Kim, H. C. Kim, K. J. Ha, and K. Y. Yoo. One round identity-based authenticated conference key agreement protocol. In ECUMN 2004, volume 3262 of LNCS, pages 407–416, 2004.
[20] N. Koblitz, A. J. Menezes, and S. A. Vanstone. The state of elliptic curve cryptography. Design, Codes and Cryptography, volume 19, numbers 2-3, pages 173-193, 2000.
[21] N. McCullagh and P. S. L. M. Barreto. A new two-party identity-based authenticated key agreement. In CT-RSA 2005, volume 3376 of LNCS, pages 262–274, 2005.
[22] Z. Peng, Y. Chengqing, L. Xin, and M. Xuying. An efficient keys agreement for multi-party"s communication. In Proceedings of the Sixth International Conference on Parallel and Distributed Computing, Applications and Technologies (PDCAT'05), pages 267–269, 2005.
[23] D. Pointcheval and J. Stern. Security proofs for signature schemes. In Advances in Cryptology-EUROCRYPT 96, volume 1070 of LNCS, pages
387–398, 1996.
[24] D. Pointcheval and J. Stern. Security arguments for digital signatures and blind signatures. Journal of Cryptology, volume 13, number 3, pages 361-396, 2000.
[25] A. Shamir. Identity-based cryptosystems and signature scheme. In Advance in Cryptology-CRYPTO 84, volume 196 of LNCS, pages 47–53, 1984.
[26] Y. Shi, G. Chen, and J. Li. Id-based one round authenticated group key agreement protocol with bilinear pairings. In Proceedings of the International Conference on Information Technology: Coding and Computing (ITCC’05), volume 1, pages 757–761, 2005.
[27] K. A. Shim and S. S. Woo. Cryptanalysis of tripartite and multi-party authenticated key agreement protocols. Information Sciences, volume 177, issue 4, pages 1143-1151, 2007.
[28] V. Shoup. Lower bounds for discrete logarithms and related problems. In Advance in Cryptology-EUROCRYPT 97, volume 1233 of LNCS, pages 256–268, 1997.
[29] N.P. Smart. Identity-based authenticated key agreement protocol based on Weil pairing. Electronics Letters, volume 38, number 13, pages 630-632, 2002.