Similar to the textbook Diffie-Hellman key exchange protocol, the Burmester-Desmedt

Similar to the textbook Diffie-Hellman key exchange protocol, the Burmester-Desmedt

1. Alice and Bob share a common password PW which contains 6 alphanumeric characters where each character can be an upper or lower case English letter or a number between 0-9. They want to establish a secure communication channel using the following protocol.
   •  B: A, E_PW(KA)
   •  A: B, E_PW(KB), MAC_K(B, A, 0)

A  B: MAC_K(A, B, 1)

In the protocol, E denotes a secure symmtric key encryption algorithm, MAC denotes a secure message authentication code function, KA and KB are both 128-bit random strings, and the shared session key is K = SHA2(KA,KB).

• What is the size of the password space? Suppose you have a computer that can enumerate 10,000,000 passwords per second, how long does it take to enumerate all

the possible passwords?                                                                            (1 mark)

• Is this protocol secure? Justify your answer. (2 marks)
• The protocol does not provide forward secrecy (FS). Modify the protocol to achieve

1.                                                                                                            (2 marks)

2. Similar to the textbook Diffie-Hellman key exchange protocol, the Burmester-Desmedt

(BD) group key exchange protocol is only secure against passive attackers. Modify the BD protocol to make it secure against active attackers. Describe clearly each step of your modified protocol and justify its security under active attacks.

(Hint: consider the approach to modify the textbook Diffie-Hellman in order to achieve

active security.)                                                                                               (3 marks)

3. The 3GPP AKA is an improvement of the GSM (i.e., 2G) AKA scheme by allowing mutual authentication between the MS and the VLR. However, as shown in the lecture, the counter-based VLR authentication mechanism in 3GPP may encounter a desynchronisation problem. Design a new approach to improve the GSM AKA scheme for mutual authentication without bringing any synchronisation issue. You are allowed to modify the message flows among the MS, the VLR and the HLR. However, same as the GSM AKA scheme, you should assume there is only a long-term shared secret key between MS and HLR and only symmetric-key operations are allowed in your design.

Describe clearly each step of your new scheme.                                             (5 marks)

2