论文标题
EDHOC协议的安全分析
Security Analysis of the EDHOC protocol
论文作者
论文摘要
短暂的Diffie-Hellman胜过Cose（EDHOC），旨在用短暂的键是非常紧凑且轻巧的身份验证的Diffie-Hellman钥匙交换。预计它将提供相互的身份验证，远期保密和身份保护，并具有128位安全级别。在Secrypt '21上已经提出了正式的分析，以前的版本，在IETF进行的持续评估过程中进行了一些改进。不幸的是，尽管正式分析可以检测到协议中的某些误解，但它无法评估实际的安全级别。在本文中，我们研究了最后一个版本。无论如何，我们无论如何都会在2^64的操作中表现出攻击，这与预期的128位安全级别相矛盾。此后，我们提出改进，其中一些没有额外费用，以实现所有安全属性的128位安全性（即关键隐私，相互认证和身份保护）。
Ephemeral Diffie-Hellman Over COSE (EDHOC) aims at being a very compact and lightweight authenticated Diffie-Hellman key exchange with ephemeral keys. It is expected to provide mutual authentication, forward secrecy, and identity protection, with a 128-bit security level.A formal analysis has already been proposed at SECRYPT '21, on a former version, leading to some improvements, in the ongoing evaluation process by IETF. Unfortunately, while formal analysis can detect some misconceptions in the protocol, it cannot evaluate the actual security level.In this paper, we study the last version. Without complete breaks, we anyway exhibit attacks in 2^64 operations, which contradict the expected 128-bit security level. We thereafter propose improvements, some of them being at no additional cost, to achieve 128-bit security for all the security properties (i.e. key privacy, mutual authentication, and identity-protection).
