The development of analysis tools for 2/3 party protocols has benefited from a common corpus of protocols to analyse, courtesy of Clark and Jacob. Group protocol analysis, where the number of parties involved in a single round is indeterminate and unbounded, presents new challenges for these tools. A corpus of problems to work on would be a great help. We have started to assemble one here. The total currently stands at 19 attacks on 15 different group key management, group key agreement, and multi-party contract signing protocols. Pointers to further attacks would be greatly appreciated (contributors will be credited in the list).
Where the attack reference is marked with a *, this indicates a previously unknown attack we discovered using the Coral system.
If you use this corpus in your work, a citation would be appreciated (just mention the URL). Last update: September 2006.
NEW! Raúl Monroy and I have written a survey of group protocol attacks that covers most of the attacks in the corpus below. Feedback welcome.
| Protocol | Reference | Attack | Attack Reference | Notes |
| Cliques - A.GDH.2 | [3] | Spy learns key when a group he is a legitimate member of tries to form a subgroup without him in | [17, p.15] | All CLIQUES prots. require Diffie-Hellman exponentiation to be modelled. It has since been shown that this operation is not sufficient to construct secure Cliques protocols, [18] |
| Cliques - A.GDH.2 | [3] | Spy learns a session key if a long-term key is later compromised | [17, p.17] | spy must send some faked messages in the original set up of the session key in order to break it later. One agent in the group may be able to detect this. |
| Cliques - A.GDH.2 | [3] | Spy can use one compromised session key to learn the key in a subsequent round | [17, p.20] | Spy must send one faked message in the original round, that one agent in the group may detect. |
| Cliques - A.GDH.2-MA | [3] | Spy can learn a group key when a group of size 3 tries to admit a new member under A.GDH.2-MA | [17, p.22] | |
| Cliques - SA.GDH.2 | [3] | Spy learns key when a group he is a legitimate member of tries to form a subgroup without him in | [17, p.24] | |
| GDOI (early draft) | [1] | Man-in-the-middle/oracle attack by dishonest group member. Requires type confusion (and GDOI bit-length pattern would have allowed this) | [12, p.33] | Fixed in recent versions of GDOI |
| Asokan-Ginzboorg | [2] | Disruption by faking key contributions | [21, p.10]* | Designed to be disruption-proof in a wireless environment (so not full Dolev-Yao) - a pretty ambitious goal |
| Asokan-Ginzboorg | [2] | Intruder in group can force players to accept different keys, all of which he knows | [21, p.11]* | |
| Tanaka-Sato multicast key management | [24] | Group members accept messages from outside group | [23] | Modelled without an intruder |
| Tanaka-Sato-Taghdiri-Jackson | [23] | Group members accept messages from outside group | [20]* | With an active intruder, Tagdhiri+Jackson's improved protocol has the same flaw as the original |
| Tanaka-Sato-Taghdiri-Jackson | [23] | Group members send messages an outsider can read | [20]* | |
| Iolus | [14] | Group members accept messages from an ex-member and broadcast messages an ex-member can read | [20]* | The Iolus flaw is similar to that of the Tanaka-Sato-Taghdiri-Jackson protocol, although the key management scheme is quite different. |
| GDH.2 | [22] | Honest group members agree on different keys | [13] | No details of the attack in the paper |
| Bull-Otway (early draft) | [7] | Compromise of one key can lead to compromise of all keys | [19] | Requires properties of XOR to be taken into account |
| Bresson-Chevassut-Essiari-Pointcheval Low Power Devices Protocol | [6] | Several attacks including compromise of perfect forward secrecy, implicit key authentication and a known-key attack | [16] | Published in Cryptology eprint Archive (so not peer-reviewed). |
| Boyd-Gonaález Nieto Conference Key Agreement Protocol | [5] | Unknown key share attack | [9] | Thanks to Raymond Choo for the pointer |
| Garay-MacKenzie Multi-Party Contract Signing Protocol | [10] | Attack on Fairness | [8] | Attack requires n >= 4 players |
| Chadha-Kremer-Scederov version of Garay-MacKenzie protocol | [8] | Attack on Fairness | [15] | Mukhamedov and Ryan found an attack on the revised protocol for n > 4 players |
| HI-KD | [11] | Attack on member promotion protocol | [4] |
This document was generated using the LaTeX2HTML translator Version 2K.1beta (1.47)
Copyright © 1993, 1994, 1995, 1996,
Nikos Drakos,
Computer Based Learning Unit, University of Leeds.
Copyright © 1997, 1998, 1999,
Ross Moore,
Mathematics Department, Macquarie University, Sydney.