A Comprehensive Formal Security Analysis and Revision of the Two-phase Key Exchange Primitive of TPM 2.0

TL;DR

This paper provides a formal security analysis of TPM 2.0's two-phase key exchange primitive, identifies limitations, and proposes a revision that enhances its security for practical real-world applications.

Contribution

It introduces the first formal security model for TPM 2.0's key exchange and proposes a revision to overcome practical limitations.

Findings

Original key exchange primitive is secure under certain conditions.

Proposed revision removes impractical limitations.

Revised primitive achieves modern AKE security properties.

Abstract

The Trusted Platform Module (TPM) version 2.0 provides a two-phase key exchange primitive which can be used to implement three widely-standardized authenticated key exchange protocols: the Full Unified Model, the Full MQV, and the SM2 key exchange protocols. However, vulnerabilities have been found in all of these protocols. Fortunately, it seems that the protections offered by TPM chips can mitigate these vulnerabilities. In this paper, we present a security model which captures TPM's protections on keys and protocols' computation environments and in which multiple protocols can be analyzed in a unified way. Based on the unified security model, we give the first formal security analysis of the key exchange primitive of TPM 2.0, and the analysis results show that, with the help of hardware protections of TPM chips, the key exchange primitive indeed satisfies the well-defined security property of our security model, but unfortunately under some impractical limiting conditions, which would prevent the application of the key exchange primitive in real-world networks. To make TPM 2.0 applicable to real-world networks, we present a revision of the key exchange primitive of TPM 2.0, which can be secure without the limiting conditions. We give a rigorous analysis of our revision, and the results show that our revision achieves not only the basic security property of modern AKE security models but also some further security properties.

Tables

Table 1. Table 1: Min-entropy results

		NIST Series					BN Series						SECG Series					SM2
		P192	P224	P256	P384	P521	P192	P224	P256	P384	P521	P638	P192	P224	P256	P384	P521	P256
NIST	$avf\left(\right)$	95.2	111.0	126.9	190.2	258.7	95.1	111.0	126.9	190.2	253.6	315.0	95.2	111.0	126.6	190.4	258.6	125.8
800-89	SHA-2	95.9	112.0	127.9	191.3	259.8	96.2	112.0	128.0	191.2	254.8	316.1	96.0	11.0	127.9	191.3	259.6	126.9
CTW	$avf\left(\right)$	97%	98%	98%	99%	100%	97%	98%	98%	99%	99%	100%	97%	98%	98%	99%	100%	100%
Ratio	SHA-2	98%	98%	99%	99%	100%	98%	98%	99%	99%	100%	100%	98%	98%	99%	99%	100%	100%

Equations

$$H_{total}=\sum _{i=1}^n{H}_i$$

$$\begin{array}{rl}{\mathsf{Adv}}^{tpm.KE}(\mathcal{M})\le \frac{1}{2}\cdot \max & \{3n^{2}k\cdot {\mathsf{Adv}}^{GDH}(\mathcal{S}),\frac{9}{2}(nk{)}^2\cdot {\mathsf{Adv}}^{GDH}(\mathcal{S}),\\ & \frac{9}{2}(nk{)}^2\cdot {\mathsf{Adv}}^{{\mathcal{O}}^{\mathsf{MQV}}}({\mathcal{F}}^{\mathsf{MQV}}),3n^{2}k\cdot {\mathsf{Adv}}^{{\mathcal{O}}^{SM2}}({\mathcal{F}}^{SM2})\}+\frac{1}{2}\cdot \mathcal{O}(\frac{k^2}{2^{\lambda }}).\end{array}$$

$${\mathsf{Adv}}^{tpm.KE}(\mathcal{M})$$

$$=|Pr\left[b^{\prime }=b\wedge \mathsf{COLL}\right]+Pr\left[b^{\prime }=b\wedge \mathsf{GET}\wedge \overline{\mathsf{COLL}}\right]+Pr\left[b^{\prime }=b\wedge \overline{\mathsf{GET}}\wedge \overline{\mathsf{COLL}}\right]-\frac{1}{2}|$$

$$\displaystyle=\left|Pr\left[b^{\prime}=b\bigm{|}\mathsf{COLL}\right]\cdot Pr\left[\mathsf{COLL}\right]+Pr\left[b^{\prime}=b\bigm{|}\mathsf{GET}\wedge\overline{\mathsf{COLL}}\right]\cdot Pr\left[\mathsf{GET}\wedge\overline{\mathsf{COLL}}\right]\right.$$

$$+\frac{1}{2}\cdot Pr\left[\overline{\mathsf{GET}}\wedge \overline{\mathsf{COLL}}\right]-\frac{1}{2}|$$

$$\displaystyle=\left|Pr\left[b^{\prime}=b\bigm{|}\mathsf{COLL}\right]\cdot Pr\left[\mathsf{COLL}\right]+Pr\left[b^{\prime}=b\bigm{|}\mathsf{GET}\wedge\overline{\mathsf{COLL}}\right]\cdot Pr\left[\mathsf{GET}\wedge\overline{\mathsf{COLL}}\right]\right.$$

$$+\frac{1}{2}\cdot \left(1-Pr\left[\mathsf{COLL}\right]-Pr\left[\mathsf{GET}\wedge \overline{\mathsf{COLL}}\right]\right)-\frac{1}{2}|$$

$$\le \frac{1}{2}\cdot \left(Pr\left[\mathsf{GET}\wedge \overline{\mathsf{COLL}}\right]+Pr\left[\mathsf{COLL}\right]\right)$$

$$\le \frac{1}{2}\cdot \left(Pr\left[\mathsf{GET}\wedge \mathsf{QUERY}\wedge \overline{\mathsf{COLL}}\right]+Pr\left[\mathsf{GET}\wedge \overline{\mathsf{QUERY}}\wedge \overline{\mathsf{COLL}}\right]+Pr\left[\mathsf{COLL}\right]\right)$$

$$\le \frac{1}{2}\cdot \left(Pr\left[\mathsf{GET}\wedge E1\wedge \overline{\mathsf{COLL}}\right]+Pr\left[\mathsf{GET}\wedge E2\wedge \overline{\mathsf{COLL}}\right]+Pr\left[\mathsf{COLL}\right]\right)$$

Full text

K****eywords Authenticated Key Exchange  $\cdot$ Security Analysis  $\cdot$ TPM 2.0

1 Introduction

The TPM, presented by the Trusted Computing Group (TCG), is widely available in modern PCs and laptops, and is used to enhance the security of modern operating systems: the Linux kernel integrity subsystem leverages the TPM to store integrity measurements of software and attest to remote entities; Windows adds many security features based on the TPM, such as trusted boot, full disk encryption (Bitlocker), device attestation, and credential protection; the Chrome OS uses the TPM to prevent firmware rollback attacks and to protect users’ sensitive data and keys. Besides, TPM also presents a promising usage in the Industry 4.0 [2]: it has been widely used as the hardware root of trust for the Industry 4.0 devices and can protect the trustworthiness, identity, and communication of the devices. Take the automotive use case of Industry 4.0 for example, TCG publishes TPM specifications for components of vehicle systems [3, 4]: an Automotive-Rich TPM having rich capabilities can be defined for Head Unit or Gateway components of vehicle systems with powerful processing, networking and applications functionality, and an Automotive-thin TPM having fewer capabilities can be defined for Head Unit or Gateway components with limited resources.

The newest TPM specifications, TPM 2.0 [5, 6], allow each platform to choose the functions needed and the level of security required. This flexibility allows TPM 2.0 to be implemented in different types such as security chips and protected software in a trusted execution environment (TEE) [7], so that TPM chips can be applied to different kinds of platforms from low-end embedded devices to PCs and even servers. In conclusion, the TPM plays an important role in the security of both personal devices and industrial devices.

In this paper, we focus on the secure communication feature of TPM 2.0: the authenticated key exchange (AKE) functionality, which provides secure communication for devices. AKE is an important public key primitive in modern cryptography, which allows two parties to establish a shared secret session key via a public insecure communication while providing mutual authentication. To prevent active attacks, AKE protocols usually use digital signatures or message authentication codes (MAC) to explicitly authenticate the messages exchanged [8, 9, 10, 11]. However, these authentication mechanisms incur significant overhead in both computation and communication. To overcome the disadvantages of the explicitly AKE protocols, the implicitly AKE protocols [12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24] are proposed. This kind of protocols only requires basic Diffie-Hellman exchanges while providing identity authentication by combining the ephemeral keys and long-term keys during the derivation of the session key, and achieves efficiency in both computation and communication.

The TPM 2.0 specifications support three implicitly AKE protocols: the Full Unified Model (UM) [25], Full MQV [13], and SM2 key exchange protocols [22]. All the three protocols have been widely standardized: the Full UM and Full MQV protocols are standardized by ANSI [26, 27], NIST [28], IEEE [29]; the SM2 key exchange protocol is standardized by the Chinese Government State Cryptography Administration [30] and some industrial standards [31]. TPM 2.0 describes implicitly AKE protocols as two-phase key exchange protocols because TPM 2.0 implements them in two phases. In the first phase, the TPM generates an ephemeral DH key and sends its public part to the other party. In the second phase, the TPM generates the unhashed shared secret by combining ephemeral keys and long-term keys, and then the host of the TPM uses the unhashed shared secret to derive a session key. Some works [32, 33, 34] using the TPM to improve the efficiency or security of AKE protocols have been proposed.

We first introduce some notations used in this paper. Let $G^{\prime}$ be a finite Abelian group of order $N$, $G\subseteq G^{\prime}$ be a subgroup of prime order $q$. Denote by $g$ a generator of $G$, by $1_{G}$ the identity element, by $G\backslash 1_{G}=G-\{1_{G}\}$ the set of elements of $G$ except $1_{G}$, and by $h=N/q$ the cofactor. We use the multiplicative notation for the group operation in $G^{\prime}$. Let $u\in_{R}Z_{q}$ denote randomly selecting an integer $u$ between $1$ and $q-1$. Note that $G$ is an elliptic curve in this work, for all the three protocols are based on elliptic curve cryptography. Let $P.x$ denote the $x$-coordinate of point $P$. The party having $A$ as its public key will be denoted by $\hat{A}$. The Full UM, Full MQV and SM2 key exchange protocols are described in Figure 1. We let $\lambda$ denote the security parameter, and $H_{1}():\{0,1\}^{*}\rightarrow\{0,1\}^{\lambda}$ and $H_{2}():\{0,1\}^{*}\rightarrow\{0,1\}^{\lambda}$ are cryptographic hash functions. The Full UM protocol analyzed in this paper includes the ephemeral public keys exchanged as suggested by [16]. The Full MQV protocol is a variant of the original MQV protocol [13] which does not include parties’ identifiers in the session key derivation.

1.1 Security models for AKE protocols

In the early days, AKE protocols are designed in an ad-hoc manner and cannot provide well-defined security properties. To deal with this problem, some rigorous security models are proposed, and by now, it has become a basic requirement for AKE protocols to achieve the security properties defined by AKE security models. The first security model is proposed by Bellare and Rogaway [35], which is called BR model. The BR model allows the attacker to control all communications between the parties, learn secret state of some party by corrupting him, and obtain the session key of some session by revealing it. However, the BR model does not allow the attacker to get the ephemeral state of some session and the lack of simulating this attack activity prevents BR model to simulate some practical attack situations. To deal with this flaw, the CK model [36] and the eCK model [19] simulate the leakage of ephemeral state of some session by adding the SessionStateReveal and EphemeralKeyReveal queries to the model respectively. The SessionStateReveal query allows the attacker to learn the session private information while the EphemeralKeyReveal query allows the attacker to learn the ephemeral private key – which is stronger is still under discussion. Okamoto [37] claims that EphemeralKeyReveal is stronger than SessionStateReveal; Cremers [38] argues that SessionStateReveal is stronger than EphemeralKeyReveal; Boyd et al. [39] show that the two queries are incomparable, while Ustaoglu [40] shows that the functions of the two queries are essentially the same.

Since the CK model can largely provide no weaker security than the eCK model and the SessionStateReveal query of the CK model models the high risk of the leakage of the secrets in the unprotected memory of the host better than the EphemeralKeyReveal query of the eCK model, we build our security model based on the CK model.

1.2 Weaknesses of the AKE protocols in TPM 2.0

Unfortunately, all the three AKE protocols adopted by TPM 2.0 are not secure. We summarize their weaknesses in the following.

We find that the Full UM protocol is completely insecure if an attacker is able to learn the intermediate information $Z_{1}=g^{ab}$ of some session established by $\hat{A}$ with $\hat{B}$: the attacker transmits an ephemeral key $X^{\prime}=g^{x^{\prime}}$ generated by himself to party $\hat{B}$ and receives an ephemeral public key $Y^{\prime}$ from $\hat{B}$, then he can compute the session key $K=H(Z_{1},Y^{\prime x^{\prime}},\hat{A},\hat{B},X^{\prime},Y^{\prime})$, i.e., the attacker is able to impersonate $\hat{A}$ to $\hat{B}$ indefinitely.

Kaliski presents an unknown-key share (UKS) attack [41] on the original MQV protocol: the attacker $\mathcal{M}$ interfaces with the session establishment between two honest parties $\hat{A}$ and $\hat{B}$ such that $\hat{A}$ is convinced that he is sharing a key with $\hat{B}$, but $\hat{B}$ believes that he is sharing the same session key with $\mathcal{M}$. This UKS attack requires $\mathcal{M}$ to register a specific key $C=g^{c}$ with the certificate authority (CA) and send a specific ephemeral public key $X^{\prime}$ to $\hat{B}$. $c$ and $X^{\prime}$ are so carefully computed by $\mathcal{M}$ that the session keys of sessions $(\hat{A},\hat{B},X,Y)$ and $(\hat{B},\mathcal{M},Y,X^{\prime})$ are identical. The details of the UKS attack are described in A. Although the Full MQV protocol tries to prevent the above UKS attack by including identities in the session key derivation, we find that it still cannot achieve the security defined by modern AKE models if $\mathcal{M}$ is able to learn the unhashed shared $Z$ value: $\mathcal{M}$ performs the same steps above, learns $Z_{B}$ by corrupting the session $(\hat{B},\mathcal{M},Y,X^{\prime})$, then $\mathcal{M}$ can compute the session key of session $(\hat{A},\hat{B},X,Y)$, i.e., the corruption of the session $(\hat{B},\mathcal{M},Y,X^{\prime})$ helps $\mathcal{M}$ to compromise another session $(\hat{A},\hat{B},X,Y)$.

Xu et al. introduce two UKS attacks [22] on the SM2 key exchange protocol in which an honest party $\hat{A}$ is coerced to share a session key with the attacker $\mathcal{M}$, but $\hat{A}$ thinks that he is sharing the key with another party $\hat{B}$. Both attacks require $\mathcal{M}$ to reveal the unhashed shared $Z_{B}$ of $\hat{B}$. Besides, the first attack requires $\mathcal{M}$ to register with the CA a specific key $C=Ag^{e}$ where $e\in_{R}Z_{q}$, and the second attack requires $\mathcal{M}$ to perform some computations using his private key after obtaining $Z_{B}$. The details of the two attacks are described in B.

The above attacks show that the three AKE protocols cannot achieve the security property defined by modern AKE security models if the attacker is able to get the unhashed values. Unfortunately, this is exactly how the two-phase key exchange primitive of TPM 2.0 (denoted by $\mathsf{tpm.KE}$) implements these three AKE protocols: $Z_{1}$ of the Full UM protocol, the unhashed $Z$ values of the MQV and SM2 key exchange protocols are returned to the host, whose memory is vulnerable to attacks. So it seems that $\mathsf{tpm.KE}$ is not secure.

1.3 Motivations and Contributions

Fortunately, protections provided by the TPM improve the security of $\mathsf{tpm.KE}$. First, all long-term keys are generated randomly in the TPM, so attackers cannot make the TPM to generate a specific key such as the carefully computed key $C=g^{c}$ required by Kaliski’s UKS attack or $C=Ag^{e}$ required by Xu’s first attack. Second, the TPM only provides well-defined functions through TPM commands [6] in a black-box manner: when a TPM command is invoked, the TPM chip executes the pre-defined computation procedure and returns the computation result. The second feature prevents attackers from using a key to perform computations at will. So it seems that the above two features can prevent Kaliski’s UKS attack and Xu’s attacks. However, in modern cryptography, rigorous proofs of security in modern security models [36, 19] have become a basic requirement for cryptographic protocols to be standardized and are essential tools to guarantee the soundness of cryptographic protocols. As the TPM has been widely applied on kinds of computation platforms, it is important to perform formal analysis about its security mechanisms. This leads to our first motivation:

How to build a security model which can precisely model the TPM’s protections on keys and protocol computation environments and based on which we can perform rigorous security analysis of $\mathsf{tpm.KE}$?

Although protections provided by the TPM help the MQV and SM2 key exchange protocols to resist current UKS attacks, the $avf()$ and $avf^{\prime}()$ functions used in the MQV and SM2 key exchange protocols respectively make that the two protocols cannot be proven secure. Consider such a group $G$ that the representations of its elements satisfy that the $\lceil q/2\rceil$ least significant bits (LSBs) of the representations of points’ $x$-coordinate are fixed. In this case, an attacker can mount the so-called group representation attacks on the MQV and SM2 key exchange protocols, in which the attacker can impersonate $\hat{A}$ to $\hat{B}$ without knowing the private key of $\hat{A}$. The group representation attack on MQV is described in C, and a similar attack on the SM2 key exchange protocol can be found in [42]. HMQV, a variant of MQV, prevents this type of attack by replacing $avf()$ with a cryptographic hash function, which enables the protocol to be proven secure in the CK model. Zhao et al. [42] also suggest replacing the $avf^{\prime}()$ function of the SM2 key exchange protocol with a cryptographic hash function. However, group representation attacks are not practical, for it is difficult to find an elliptic curve whose $\lceil q/2\rceil$ LSBs of the representations of points’ $x$-coordinate are fixed. On the contrary, the outputs of the $avf()$ and $avf^{\prime}()$ functions seem to range in a uniform way over all possible values. This leads to our second motivation:

Can we give a quantitative measure of the amount of randomness (entropy) contained in the output distributions of $avf()$ and $avf^{\prime}()$ on real-world elliptic curves and check whether $avf()$ and $avf^{\prime}()$ provide enough entropy to prevent group representation attacks?

As far as we know, current modern AKE security models only consider how to formally analyze one single protocol, thus all AKE protocols proven secure in the literature are analyzed separately. However, $\mathsf{tpm.KE}$ is designed to support three implicitly AKE protocols through unified interfaces, so we cannot use current security models to analyze $\mathsf{tpm.KE}$. Besides, the design of $\mathsf{tpm.KE}$ brings the following security problem that should be considered in its analysis. Suppose an honest party $\hat{A}$ tries to establish a secure channel with $\hat{B}$ through MQV and an attacker controls a long-term key of $\hat{B}$’s TPM, but the type of the key is SM2. Then the question is whether the session key of $\hat{A}$ is secure if the attacker leverages the SM2 key to complete the session. Apparently, it’s desirable for $\mathsf{tpm.KE}$ to guarantee the security of $\hat{A}$’s session key. We denote this security property by correspondence property. The requirements for analyzing multi-protocols simultaneously and capturing the correspondence property lead to our third motivation:

Can we build a unified security AKE model, based on which we can give a formal analysis of $\mathsf{tpm.KE}$ which supports three AKE protocols?

Unfortunately, even if we prove $\mathsf{tpm.KE}$ is secure, $\mathsf{tpm.KE}$ only guarantees its security under the following conditions: first, all the entities in the network must use TPM chips to run the AKE protocols and if one entity uses a less secure implementation of protocols such as a software implementation, the compromise of the software implementation will affect the security of other honest entities, such as Kaliski’s and Xu’s UKS attacks mentioned above; second, attackers are assumed to be unable to obtain the information inside the TPM, such as long-term keys. The conditions are due to the fact that the above security model creates all protocol instances based on the TPM and prohibits attackers from obtaining information inside the TPM even they compromise the TPM. However, the above conditions are not practical for real-world networks: first, it is unrealistic to assume that all devices are protected by the TPM, and there may exist some devices whose execution environments are not secure and can be easily compromised; second, it is also unrealistic to assume that no TPM is ever compromised because attackers can launch sophisticated attacks such as invasive attacks, semi-invasive attacks or side-channel attacks to compromise TPM chips. The above unrealistic assumptions lead to our fourth motivation:

How to revise the current version of $\mathsf{tpm.KE}$ so that it can be applied in real-world networks where devices may not be protected by TPM chips and TPM chips may be compromised?

Contributions. We summarize the contributions of this paper as follows:

We leverage the min-entropy, a notion in the information theory, to quantitatively evaluate the amount of randomness in the output distributions of $avf()$ and $avf^{\prime}()$. We evaluate several series of elliptic curves used in practice, covering all elliptic curves adopted by the TPM 2.0 algorithm specification [43]. The evaluation results show that $avf()$ and $avf^{\prime}()$ provide almost the same level of randomness as cryptographic hash functions. 2. 2.

We model the protections provided by the TPM by modeling the interfaces of $\mathsf{tpm.KE}$ as oracles, and present a unified AKE security model for $\mathsf{tpm.KE}$, which captures not only the basic security property defined by modern AKE security models but also the correspondence property. 3. 3.

We give a formal analysis of $\mathsf{tpm.KE}$ in our new model and prove that $\mathsf{tpm.KE}$ is secure under the condition that the unhashed shared secrets are not available to the attacker. This condition can be achieved by slightly modifying the Full UM functionality of TPM 2.0 or properly implementing the host’s software. 4. 4.

The $\mathsf{tpm.KE}$ is proven secure under some limiting conditions, resulting in some restrictions on the usage of $\mathsf{tpm.KE}$, so we give suggestions on how to use $\mathsf{tpm.KE}$ properly to achieve a secure implementation of AKE protocols. 5. 5.

The limiting conditions required by the current version of $\mathsf{tpm.KE}$ are impractical for real-world networks, so we present a revision of $\mathsf{tpm.KE}$ to eliminate the limiting conditions and give concrete suggestions on how to revise the current version of TPM 2.0 specifications. 6. 6.

We rigorously analyze our revision of $\mathsf{tpm.KE}$, and the analysis results show that our revision achieves not only the basic security property defined by modern AKE security models but also some further security properties: resistance to key-compromise impersonation (KCI) and weak Perfect Forward Secrecy (PFS).

1.4 Organization

In the rest of this paper, Section 2 gives some preliminaries. Section 3 introduces the two-phase key exchange primitive defined by TPM 2.0 specifications, gives a quantitative measure of several series of elliptic curves used in practice, and presents an informal analysis of $\mathsf{tpm.KE}$. Section 4 presents our unified security model for $\mathsf{tpm.KE}$. Section 5 gives a formal description of $\mathsf{tpm.KE}$. Section 6 proves the unforgeability of the MQV and SM2 key exchange functionalities provided by $\mathsf{tpm.KE}$, and it can simplify our security proof. Section 7 formally analyzes the basic security of $\mathsf{tpm.KE}$ in our new model. Section 8 discusses the KCI-resistance and weak PFS properties of $\mathsf{tpm.KE}$. Section 9 gives suggestions on the usage of the current version of $\mathsf{tpm.KE}$. Section 10 presents our revision of $\mathsf{tpm.KE}$. Sections 11 and 12 rigorously analyze our revision of $\mathsf{tpm.KE}$. Section 13 discusses the KCI-resistance and weak PFS properties of our revision. Section 14 concludes this paper.

2 Preliminaries

This section first introduces the notion of min-entropy and two popular methods to calculate the min-entropy, and then introduces the CDH (Computational Diffie-Hellman) and GDH (Gap Diffie-Hellman) assumptions used in this paper.

2.1 Min-entropy

Min-entropy is a notion in information theory, which provides a very strict information-theoretical lower bound (i.e., worst-case) measure of randomness for a random variable. High min-entropy indicates that the distribution of the random variable is close to the uniform distribution. Low min-entropy indicates that there must be a small set of outcomes that has an unusually high probability, and the small set can help an attacker to perform group representation attacks. Take the following two extreme cases for example: if the min-entropy of a random variable is equal to the length of the outcome, the distribution is a uniform distribution, and if the min-entropy of a random variable is zero, the outcomes of the random variable are a fixed value. From the two extreme cases, we can see that the higher the min-entropy is, the harder for the attacker to mount group representation attacks. There are two popular methods to measure the min-entropy of a random variable:

NIST SP 800-90. This method is described in NIST specification 800-90 for binary sources. The definition of min-entropy for one binary bit is: $H=-log_{2}^{p_{max}}$ where $p_{max}=max\{p_{0},p_{1}\}$ and $p_{0}$, $p_{1}$ are probabilities that the binary bit outputs zero and one respectively. The min-entropy of an $n$-bit binary string is defined by:

[TABLE] 2. 2.

Context-Tree Weighting compression. Context-Tree Weighting (CTW) [44] is an optimal compression algorithm for stationary sources and is usually used to estimate the min-entropy.

2.2 CDH and GDH Assumptions

The security of modern cryptographic constructions, including the AKE protocols, relies on some widely-believed assumptions, which are mathematical problems that are hard to solve. The rigorous proof of security typically shows how to reduce the security of cryptographic constructions to assumptions. Here we list the assumptions that used in our proof: the CDH and GDH assumptions. The CDH assumption is used in the proof of the unforgeability of MQV and SM2 key exchange functionalities (Section 6), and the GDH assumption is used in the proof of $\mathsf{tpm.KE}$ (Section 7) and the revision of $\mathsf{tpm.KE}$ (Sections 12 and 13).

Definition 1** (CDH Assumption).**

Let $G$ be a cyclic group of order $p$ with generator $g$. The CDH assumption in $G$ states that, given two randomly chosen points $X=g^{x}$ and $Y=g^{y}$, it is computationally infeasible to compute $Z=g^{xy}$.

Definition 2** (GDH Assumption).**

Let $G$ be a cyclic group generated by an element $g$ whose order is $p$. We say that a decision algorithm $\mathcal{O}$ is a Decisional Diffie-Hellman (DDH) Oracle for $G$ and its generator $g$ if on input a triple $(X,Y,Z)$, for $X,Y\in G$, oracle $\mathcal{O}$ outputs 1 if and only if $Z$ = CDH($X,Y$). We say that $G$ satisfies the GDH assumption if no feasible algorithm can solve the CDH problem, even if the algorithm is provided with a DDH-oracle for $G$.

3 The TPM Key Exchange Primitive

In the context of $\mathsf{tpm.KE}$, each party consists of a host and a TPM chip. The host and the TPM together can implement the three implicitly AKE protocols supported in the TPM 2.0 specifications. In general, the host runs instances of AKE protocols by exchanging messages between parties and invoking the interfaces of $\mathsf{tpm.KE}$ which are implemented as TPM commands, and at last derives session keys for instances from the shared secrets returned by the TPM. In this section, we first show how the AKE protocols can be implemented by the host and $\mathsf{tpm.KE}$, and describe the related TPM commands of $\mathsf{tpm.KE}$, and then give an informal analysis of $\mathsf{tpm.KE}$. In the informal analysis, we present solutions to prevent impersonation attacks on the Full UM protocol, and a quantitative measure of the randomness of the output distributions of $avf()$ and $avf^{\prime}()$ on all the elliptic curves adopted by the TPM 2.0 specifications.

3.1 Introduction of tpm.KE

$\mathsf{tpm.KE}$ consists of two phases. In the first phase, the TPM generates an ephemeral key which will be transferred to the other party by the TPM’s host. In the second phase, the TPM generates the unhashed secret value according to the specification of the selected protocol, and the host derives the session key from the unhashed secret value. Before the two phases, the Key Generation procedure should be invoked to generate a long-term key.

• •

Key Generation. The commands $\mathsf{TPM2\_Create()}$ and $\mathsf{TPM2\_CreatePrimary()}$ are used to generate long-term keys. They take as input public parameters including an attribute identifying the key exchange scheme for the long-term key. The scheme should be one of the following three: $\mathsf{TPM\_ALG\_ECDH}$, $\mathsf{TPM\_ALG\_ECMQV}$, and $\mathsf{TPM\_ALG\_SM2}$. In this procedure, the TPM performs the following steps: if the command is $\mathsf{TPM2\_Create()}$, it picks a random $a\in_{R}Z_{q}$ and computes $A=g^{a}$, and if the command is $\mathsf{TPM2\_CreatePrimary()}$, it derives $a$ from a primary seed using a key derivation function and computes $A=g^{a}$; finally, it returns $A$ and a key handle identifying $a$.

• •

First Phase. The command $\mathsf{TPM2\_EC\_Ephemeral()}$ is used to generate an ephemeral key, and it performs the following steps:

Generate $x=\mathsf{KDFa}(Random,Count)$, where $\mathsf{KDFa}()$ is a key derivation function [45], $Random$ is a secure random value stored inside the TPM, and $Count$ is a counter. 2. 2.

Set $ctr=Count$, $A[ctr]=1$, and $Count=Count+1$, where $A[]$ is an array of bits used to indicate whether the ephemeral key has been used. 3. 3.

Set $x=x$ mod $q$, and generate $X=g^{x}$. 4. 4.

Return $X$ and $ctr$.

Note that the TPM does not need to store the ephemeral private key $x$ as it can be recovered using $\mathsf{KDFa()}$ and $ctr$.

• •

Second Phase. The command related to this phase is $\mathsf{TPM2\_ZGen\_2Phase()}$, and it is the main command of $\mathsf{tpm.KE}$. This command takes the following items as input:

$scheme$

A protocol scheme selector.

$keyA$

The key handle identifying the long-term private key $a$.

$ctr$

The counter used to identify the ephemeral key generated in the first phase.

$B$

The public key of $\hat{B}$, with whom $\hat{A}$ wants to establish a session.

$Y$

The ephemeral public key received from $\hat{B}$.

The TPM first does the following checks:

1. (a)

Whether $scheme$ equals the scheme designated for key $A$ in the key generation procedure. 2. (b)

Whether $B$ and $Y$ are on the curve associated with $A$. 3. (c)

Whether $A[ctr]=1$. 2. 2.

If the above checks succeed, the TPM recovers $x=\mathsf{KDFa}(Random,ctr)$ and performs the following steps:

1. (a)

Compute unhashed values according to the value of $scheme$:

Case $\mathsf{TPM\_ALG\_ECDH}$:

set $Z_{1}=B^{a}$, $Z_{2}=Y^{x}$;

Case $\mathsf{TPM\_ALG\_ECMQV}$:

set $Z_{1}=(YB^{e})^{h(x+da)}$, $Z_{2}=NULL$, where $d=avf(X)$ and $e=avf(Y)$;

Case $\mathsf{TPM\_ALG\_SM2}$:

set $Z_{1}=(BY^{e})^{h(a+dx)}$, $Z_{2}=NULL$, where $d=avf^{\prime}(X)$ and $e=avf^{\prime}(Y)$. 2. (b)

Clear $A[ctr]$: set $A[ctr]=0$ to ensure that the ephemeral private key $x$ can only be used once. 3. (c)

Return $Z_{1}$ and $Z_{2}$. 3. 3.

Finally, the host computes the session key leveraging the unhanshed values $Z_{1}$ and $Z_{2}$ returned by the TPM.

3.2 Informal Analysis

In Sections 1.2 and 1.3, we show two weaknesses of $\mathsf{tpm.KE}$ which prevent it from achieving the basic security property defined by modern AKE security models. One weakness is that $\mathsf{tpm.KE}$ returns $Z_{1}$ of the Full UM protocol to the host whose memory can be compromised, which makes $Z_{1}$ be available to the attacker. The other one is the weakness caused by $avf()$ and $avf^{\prime}()$, which results in group representation attacks against the MQV and SM2 key exchange protocols.

3.2.1 Analysis of the first weakness

The first weakness prevents the Full UM protocol from being proven secure in the security model, and we give two solutions to overcome the weakness:

Perform the entire session key computation of Full UM in the secure environment of the TPM, i.e., modify the $\mathsf{TPM2\_ZGen\_2Phase()}$ command not to return $Z_{1}$ and $Z_{2}$ but the session key, i.e., $K=H_{1}(Z_{1},Z_{2},\hat{A},\hat{B},X,Y)$. 2. 2.

Protect $Z_{1}$ and $Z_{2}$ from malicious code running on the host as much as possible such as keeping them only available in the kernel mode, and delete $Z_{1}$ and $Z_{2}$ as soon as the session key is derived.

The first solution requires modifying TPM 2.0 specifications, and the second one requires that the software deriving the session key should be implemented properly and included in the Trusted Computing Base (TCB).

3.2.2 Analysis of the second weakness

As it seems that the second weakness only happens in theory, we perform a quantitative measure of the min-entropy contained in the output distributions of $avf()$ and $avf^{\prime}()$ to check whether this weakness can happen in the real world. We measure several series of widely deployed elliptic curves: the NIST series [46], the BN series [47], the SECG series [48], and an SM2 elliptic curve [49]. Our measure totals 17 elliptic curves and covers all elliptic curves adopted by TPM 2.0 [43]. We generate 16384 points for each elliptic curve, apply $avf^{\prime}()$ to the points of the SM2 P256 curve, and apply $avf()$ to the points of the rest curves. We also apply the cryptographic hash function SHA-2 to the generated points of all curves. Then we measure the min-entropy of the output distributions of $avf()$ ($avf^{\prime}()$) and SHA-2 using the methods of NIST SP 800-90 (Formula 1) and CTW compression. The measurement results are summarized in Table 1. Figure 2 shows the development of the min-entropy value calculated using NIST’s method over the number of measurements. To our surprise, the min-entropy of the output distributions of $avf()$ and $avf^{\prime}()$ is very close to the min-entropy of the output distribution of SHA-2: the former is only about 1 bit less than the latter. What’s more, the measurement results indicate that the output distributions of $avf()$ and $avf^{\prime}()$ are close to the uniform distribution. Take the measurement of BN P256 for example, the min-entropy calculated by the NIST’s method is 126.9, very close to the output length of $avf()$ which is $129=\lceil 256/2\rceil$+1, and the CTW ratio is 98.1% which is close to 100%. Our measure indicates that the outputs of $avf()$ ($avf^{\prime}()$) on different elliptic curve points are almost independent, and it is infeasible to mount group representation attacks on real-world elliptic curves. So we model $avf()$ and $avf^{\prime}()$ as random oracles in our formal analysis.

4 The Unified Security Model

This section illustrates our unified security model for $\mathsf{tpm.KE}$ and the attacker model which captures the capabilities of attackers. The first difference between our unified security model and existing security models, such as BR, CK, and eCK models, is that our model can simulate multiple types of AKE protocols simultaneously. Our model acquires this feature by adding a scheme identifier to the session identifier. The motivation and detailed techniques of this feature will be discussed later. The second difference is that our model models the concrete protections provided by the TPM chip: the attack queries of our model do not allow the attacker to obtain the cryptographic keys protected inside the TPM nor the ephemeral secrets inside the TPM. For instance, when the attacker corrupts a party, unlike existing security models, which allow him to get plaintext of the long-term key, our model only allows him to obtain the black-box access of the TPM commands in respect of the long-term key.

In our security model, each party has a long-term key generated by the TPM and a certificate (issued by a CA) that binds the public part of the long-term key to the identity of the party. The long-term key can be one of the following three types: $\mathsf{TPM\_ALG\_ECDH}$, $\mathsf{TPM\_ALG\_ECMQV}$, and $\mathsf{TPM\_ALG\_SM2}$. A party can be activated to invoke the interfaces of $\mathsf{tpm.KE}$ to run an instance of the protocol supported by the long-term key, and an instance of a protocol is called a session. In each session, a party can be activated as the role of initiator or responder who sends an ephemeral public key to its peer party, the ephemeral key is generated by invoking the interface of the first phase of $\mathsf{tpm.KE}$, and a party can complete the session by invoking the interface of the second phase of $\mathsf{tpm.KE}$ and computing the session key.

In modern AKE security models, the session identifier is a quadruple $(\hat{A},\hat{B},Out,In)$, where $\hat{A}$ is the identity of the owner of the session, $\hat{B}$ the peer party, $Out$ the outgoing messages in the session, and $In$ the incoming messages. This kind of security models work well in proving a single protocol, but it is flawed when used to prove $\mathsf{tpm.KE}$ because $\mathsf{tpm.KE}$ supports more than one scheme (type of protocol) and instances running different schemes might have the same quadruple $(\hat{A},\hat{B},Out,In)$ but should be recognized as different sessions. To deal with this problem, we use a quintuple $(sc,\hat{A},\hat{B},Out,In)$ as the session identifier where $sc$ denotes the scheme of the session. This kind of session identifier not only distinguishes between different instances of the same scheme but also distinguishes between different schemes. For instance, two instances with different original quadruple $(\hat{A},\hat{B},Out,In)$, such as the two sessions $(sc,\hat{A},\hat{B},Out,In)$ and $(sc,\hat{A},\hat{B},Out^{\prime},In)$ having different outgoing messages, are recognized as different sessions. And further more, two instances with same original quadruple $(\hat{A},\hat{B},Out,In)$ but running different schemes, such as the two sessions $(sc,\hat{A},\hat{B},Out,In)$ and $(sc^{\prime},\hat{A},\hat{B},Out,In)$, are also recognized as different sessions. In particular, in the case of implicitly AKE protocols where the communication is basic Diffie-Hellman exchanges the session identifier is $(\hat{A},\hat{B},X,Y)$ where $X$ is the outgoing DH value and $Y$ the incoming DH value to the session. The session $(sc,\hat{B},\hat{A},Y,X)$ (if it exists) is said to be matching to the session $(sc,\hat{A},\hat{B},X,Y)$, and the session $(sc^{\prime},\hat{B},\hat{A},Y,X)$ where $sc^{\prime}\neq sc$ (if it exists) is said to be message-matching to the session $(sc,\hat{A},\hat{B},X,Y)$.

The $sc$ in the session identifier brings an issue we must address: how about the security of the session $(sc,\hat{A},\hat{B},X,Y)$ if it has a corrupted message-matching session? Previous AKE security models do not capture this attack because they do not support formal analysis of multiple kinds of protocols in a unified way. However, this attack can happen on $\mathsf{tpm.KE}$ because it supports three AKE schemes and the TPM 2.0 specifications do not force the TPM to check the key type of its peer party. We say $\mathsf{tpm.KE}$ satisfies correspondence property if it can resist the above attack, i.e., the session $(sc,\hat{A},\hat{B},X,Y)$ is secure if its message-matching session is compromised.

Attacker Model. The model involves multiple honest parties and an attacker $\mathcal{M}$ connected via an unauthenticated network. The attacker is modeled as a probabilistic Turing machine and has full control of the communications between parties. $\mathcal{M}$ can intercept and modify messages sent over the network. $\mathcal{M}$ also schedules all session activations and session-message delivery. In addition, in order to model potential disclosure of secret information, the attacker is allowed to access secret information via the following queries:

• •

SessionStateReveal(s): $\mathcal{M}$ directly queries at session $s$ while still incomplete and learns the session state for $s$. In our analysis, the session state includes the values returned by interfaces of $\mathsf{tpm.KE}$ and intermediate information stored and computed in the host.

• •

SessionKeyReveal(s): $\mathcal{M}$ obtains the session key for the session $s$.

• •

Corruption($\hat{P}$): In other AKE security models, this query allows $\mathcal{M}$ to learn the plaintext of the long-term private key of party $\hat{P}$. In our model, $\mathcal{M}$ does not learn anything about the plaintext of the long-term private key but obtains the black-box access of the key via TPM interfaces.

• •

Test(s): Pick $b\xleftarrow{R}{0,1}$. If $b$ = 1, provide $\mathcal{M}$ with the session key; otherwise provide $\mathcal{M}$ with a random value $r\in_{R}\{0,1\}^{\lambda}$. This query can only be issued to a session that is “clean". A completed session is “clean" if the session as well as its matching session (if it exists) is not subject to the above three queries. A session is called “exposed" if $\mathcal{M}$ performs any one of the above three queries to this session.

Note that our model differs from previous AKE security models in that the Corruption query to some party does not provide the attacker with the plaintext of the long-term private key of the party but the black-box access of the long-term key which is randomly generated and protected by the TPM. This difference captures the protections provided by the TPM, which are described in Section 1.3.

The security is defined based on an experiment played by $\mathcal{M}$, in which $\mathcal{M}$ is allowed to activate sessions and perform SessionStateReveal, SessionKeyReveal, and Corruption queries. At some time, $\mathcal{M}$ performs the Test query to a clean session of its choice and gets the value returned by Test. After that, $\mathcal{M}$ continues the experiment but is not allowed to expose the test session and its matching session (if it exists). Eventually, $\mathcal{M}$ outputs a bit $b^{\prime}$ as its guess, then halts. $\mathcal{M}$ wins the game if $b^{\prime}=b$. The attacker with the above capabilities is called a KE-attacker. The formal security is defined as follows.

Definition 3**.**

The advantage of any KE-attacker $\mathcal{M}$ in the above experiment with $\mathsf{tpm.KE}$ is defined as

$\mathsf{Adv}^{\mathsf{tpm.KE}}(\mathcal{M})$* = $\left|Pr[b^{\prime}=b]-\frac{1}{2}\right|$.*

$\mathsf{tpm.KE}$* is called secure if the following properties hold for any KE-attacker $\mathcal{M}$.*

When two uncorrupted parties complete matching sessions, they output the same session key, and 2. 2.

If no efficient attacker $\mathcal{M}$ has more than a negligible advantage in winning the above experiment.

The first condition is a “consistency" requirement for sessions completed by two uncorrupted parties. The second condition is the core property for the security of $\mathsf{tpm.KE}$: it guarantees that exposure of one session does not help the attacker to compromise the security of another session. Note that our security definition of $\mathsf{tpm.KE}$ allows the attacker to expose the message-matching session, that is to say, the test session is still secure even if the message-matching session is exposed by the attacker. Thus, our model captures the correspondence property.

The Definition 3 defines the basic security property that a modern AKE protocol should achieve, and it captures the common UKS attacks. We illustrate how the UKS attacks are captured in our security model. In a UKS attack, a party $\hat{A}$ ends up believing he shares a key with party $\hat{B}$, and $\hat{B}$ ends up mistakenly believing the key is shared with the attacker $\mathcal{M}$. Suppose the identifier of $\hat{A}$’s session is $(sc,\hat{A},\hat{B},X,Y)$ and that of $\hat{B}$’s session is $(sc,\hat{B},\mathcal{M},X^{\prime},Y^{\prime})$. The two sessions apparently are not either identical or matching, so according to Definition 3, the attacker $\mathcal{M}$ can expose the session $(sc,\hat{B},\mathcal{M},X^{\prime},Y^{\prime})$ to attack $\hat{A}$’s session $(sc,\hat{A},\hat{B},X,Y)$. The above illustration shows that if a protocol is proven secure under the unified security model, it should resist UKS attacks.

5 Formal Description of $\mathsf{tpm.KE}$

The implementation of $\mathsf{tpm.KE}$ in the TPM 2.0 includes two phases. The first phase is to generate an ephemeral key which is transferred to the party which the owner wants to establish a session with, and the first phase is the same to all the three protocols supported by the TPM 2.0 specifications. The second phase provides the key exchange functionalities which generate the unhashed secret values or session keys according to the specification of the protocol. Since parties or the attacker can only use $\mathsf{tpm.KE}$ in a black-box manner: they can only use $\mathsf{tpm.KE}$’ functionalities by invoking its interfaces and do not know the secrets inside the TPM. To model the black-box manner of $\mathsf{tpm.KE}$, we simulate $\mathsf{tpm.KE}$ by formalizing its interfaces as a series of oracles which receive inputs and return outputs.

We model the interface of the first phase of $\mathsf{tpm.KE}$ by the oracle $\mathsf{ephem}_{A}()$ where $A$ is the long-term key of $\hat{A}$. We model the second phase of $\mathsf{tpm.KE}$ as three oracles: the Full UM, MQV, and SM2 key exchange functionalities of $\mathsf{tpm.KE}$ are modeled as oracle $\mathcal{O}^{\mathsf{EC}}_{A}$, oracle $\mathcal{O}^{\mathsf{MQV}}_{A}$, and oracle $\mathcal{O}^{\mathsf{SM2}}_{A}$ respectively. $\mathcal{O}^{\mathsf{MQV}}_{A}$ and $\mathcal{O}^{\mathsf{SM2}}_{A}$ take as input the input of $\mathsf{TPM2\_ZGen\_2Phase()}$ and return the unhashed values. We let $\mathcal{O}^{\mathsf{EC}}_{A}$ directly return the session key but not the unhashed values $Z_{1}$ and $Z_{2}$, and this modification simulates our solutions to the first weakness of $\mathsf{tpm.KE}$. We now formally describe $\mathsf{tpm.KE}$ through the following three session activations.

Initiate$(sc,\hat{A},\hat{B})$: $\hat{A}$ invokes $\mathsf{ephem}_{A}()$ of its TPM to obtain an ephemeral public key $X$ and an index $ctr_{x}$ identifying the ephemeral private key $x$ stored in the TPM, creates a local session which is identified as (an incomplete) session $(sc,\hat{A},\hat{B},X)$, where $sc$ is the key exchange scheme supported by the long-term key $A$, and outputs $X$ as its outgoing ephemeral public key. 2. 2.

Respond$(sc,\hat{B},\hat{A},X)$ ($sc$ is the scheme supported by $B$): After receiving $X$, $\hat{B}$ performs the following steps:

1. (a)

Invoke $\mathsf{ephem}_{B}()$ of its TPM to obtain an ephemeral public key $Y$ and an index $ctr_{y}$ identifying the ephemeral private key $y$ stored in the TPM; output $Y$ as its outgoing ephemeral public key. 2. (b)

With input $(sc,keyB,ctr_{y},A,X)$ where $keyB$ is the key handle of $B$, invoke the corresponding oracle according to the value of $sc$:

Case $\mathsf{TPM\_ALG\_ECDH}$: Invoke $\mathcal{O}^{\mathsf{EC}}_{B}$ and set the session key $K$ to be the return result of $\mathcal{O}^{\mathsf{EC}}_{B}$.

Case $\mathsf{TPM\_ALG\_ECMQV}$: Invoke $\mathcal{O}^{\mathsf{MQV}}_{B}$, obtain $Z_{B}$ from the return result, and compute the session key $K=H_{2}(Z_{B},\hat{A},\hat{B})$.

Case $\mathsf{TPM\_ALG\_SM2}$: Invoke $\mathcal{O}^{\mathsf{SM2}}_{B}$, obtain $Z_{B}$ from the return result, and compute the session key $K=H_{2}(Z_{B},\hat{A},\hat{B})$. 3. (c)

Complete the session with identifier $(sc,\hat{B},\hat{A},Y,X)$. 3. 3.

Complete$(sc,\hat{A},\hat{B},X,Y)$: $\hat{A}$ checks that it has an open session with identifier $(sc,\hat{A},\hat{B},X)$, and then performs the following steps:

1. (a)

With input $(sc,keyA,ctr_{x},B,Y)$ where $keyA$ is the key handle of $A$, invoke the corresponding oracle according to the value of $sc$:

Case $\mathsf{TPM\_ALG\_ECDH}$: Invoke $\mathcal{O}^{\mathsf{EC}}_{A}$ and set the session key $K$ to be the return result of $\mathcal{O}^{\mathsf{EC}}_{A}$.

Case $\mathsf{TPM\_ALG\_ECMQV}$: Invoke $\mathcal{O}^{\mathsf{MQV}}_{A}$, obtain $Z_{A}$ from the return result, and compute the session key $K=H_{2}(Z_{A},\hat{A},\hat{B})$.

Case $\mathsf{TPM\_ALG\_SM2}$: Invoke $\mathcal{O}^{\mathsf{SM2}}_{A}$, obtain $Z_{A}$ from the return result, and compute the session key $K=H_{2}(Z_{A},\hat{A},\hat{B})$. 2. (b)

Complete the session with identifier $(sc,\hat{A},\hat{B},X,Y)$.

6 Unforgeability of MQV and SM2 Key Exchange Functionalities

In this section, we give the formal definitions of MQV and SM2 key exchange functionalities of $\mathsf{tpm.KE}$, denoted by $\mathcal{O}^{\mathsf{MQV}}_{B}$ and $\mathcal{O}^{\mathsf{SM2}}_{B}$ respectively where $B$ is the public key of the party. In Theorem 1 and Theorem 2, we formally prove the unforgeability of $\mathcal{O}^{\mathsf{MQV}}_{B}$ and $\mathcal{O}^{\mathsf{SM2}}_{B}$ with a constraint on the attacker respectively. Although the unforgeability of $\mathcal{O}^{\mathsf{MQV}}_{B}$ and $\mathcal{O}^{\mathsf{SM2}}_{B}$ does not directly prove the security analysis of $\mathsf{tpm.KE}$, it acts as a building block in the security of $\mathsf{tpm.KE}$ and greatly simplifies our security analysis. In some cases in our security proof in Section 7, we reduce the security of $\mathsf{tpm.KE}$ to the unforgeability of $\mathcal{O}^{\mathsf{MQV}}_{B}$ or $\mathcal{O}^{\mathsf{SM2}}_{B}$: if the attacker is able to break the security of $\mathsf{tpm.KE}$, we can leverage it to forge the result of $\mathcal{O}^{\mathsf{MQV}}_{B}$ or $\mathcal{O}^{\mathsf{SM2}}_{B}$.

Definition 4** (The MQV Functionality of $\mathsf{tpm.KE}$).**

The functionality ($\mathcal{O}^{\mathsf{MQV}}_{B}$) is provided by a party possessing a private/public key pair $(b,B=g^{b})$. A challenger, possessing a private/public key pair $(a,A=g^{a})$, provides $\mathcal{O}^{\mathsf{MQV}}_{B}$ with a challenge $X=g^{x}$ ($x$ is chosen and kept secret by the challenger). With the pair $(A,X)$, $\mathcal{O}^{\mathsf{MQV}}_{B}$ first computes an ephemeral private/public key pair $(y,Y=g^{y})$ and returns $Z=(XA^{d})^{h(y+eb)}$ where $d=avf(X)$ and $e=avf(Y)$. The challenger can verify the return result $(Y,Z)$ with respect to the challenge $X$ by checking whether $Z=(YB^{e})^{h(x+da)}$.

Definition 5** (The SM2 Key Exchange Functionality of $\mathsf{tpm.KE}$).**

The functionality ($\mathcal{O}^{\mathsf{SM2}}_{B}$) is provided by a party possessing a private/public key pair $(b,B=g^{b})$. A challenger, possessing a private/public key pair $(a,A=g^{a})$, provides $\mathcal{O}^{\mathsf{SM2}}_{B}$ with a challenge $X=g^{x}$ ($x$ is chosen and kept secret by the challenger). With the pair $(A,X)$, $\mathcal{O}^{\mathsf{SM2}}_{B}$ first computes an ephemeral private/public key pair $(y,Y=g^{y})$ and returns $Z=(AX^{d})^{h(b+ey)}$, where $d=avf^{\prime}(X)$ and $e=avf^{\prime}(Y)$. The challenger can verify the return result $(Y,Z)$ with respect to the challenge $X$ by checking whether $Z=(BY^{e})^{h(a+dx)}$.

Theorem 1**.**

Under the CDH assumption, with $avf()$ modeled as a random oracle, given a challenge $X$, it is computationally infeasible for an attacker to forge a return result of $\mathcal{O}^{\mathsf{MQV}}_{B}$ on behalf of a challenger whose public key is $A$ under the constraint that $(a,x)$ is unknown to the attacker.

The constraint is reasonable because the TPM prevents attackers from obtaining the plaintext of keys in it. We prove Theorem 1 by showing that if an attacker $\mathcal{M}$ can forge a return result under our constraint, then we can construct a CDH solver $\mathcal{C}$ which uses $\mathcal{M}$ as a subroutine.

Proof.

$\mathcal{C}$ takes as input a pair $(X,B)\in G^{2}$ and $(a,A=g^{a})$, and it simulates $\mathcal{O}^{\mathsf{MQV}}_{B}$ as follows:

On receipt of the input $(A^{\prime},X^{\prime})$, choose $e,s\in Z_{q}$ randomly. 2. 2.

Let $Y^{\prime}=g^{s}/B^{e}$, and set $avf(Y^{\prime})=e$. 3. 3.

Choose $d$ randomly, and set $avf(X^{\prime})=d$. 4. 4.

Return $(Y,Z^{\prime}=(X^{\prime}A^{d})^{hs})$.

If $\mathcal{M}$ successfully forges a return result $(Y,Z)$ on the pair $(A,X)$ in an experiment, then $\mathcal{C}$ obtains $Z=(XA^{d})^{h(y+eb)}$ where $d=avf(X)$ and $e=avf(Y)$. Note that without the knowledge of the private key $y$ of $Y$, $\mathcal{C}$ is unable to compute CDH($X,B$). Following the Forking Lemma [50] approach, $\mathcal{C}$ runs $\mathcal{M}$ on the same input and the same coin flips but with carefully modified answers to $avf()$ queries. Note that $\mathcal{M}$ must have queried $avf(Y)$ in its first run because otherwise $\mathcal{M}$ would be unable to compute $Z$. For the second run of $\mathcal{M}$, $\mathcal{C}$ responds to $avf(Y)$ with a value $e^{\prime}\neq e$ selected uniformly at random. If $\mathcal{M}$ succeeds in the second run, $\mathcal{C}$ obtains $Z^{\prime}=(XA^{d})^{h(y+e^{\prime}b)}$ and can compute CDH$(X,B)=(\frac{Z}{Z^{\prime}})^{\frac{1}{h(e-e^{\prime})}}B^{-da}$. $\hfill\blacksquare$ ∎

Theorem 2**.**

Under the CDH assumption, with $avf^{\prime}()$ modeled as a random oracle, given a challenge $X$, it is computationally infeasible for an attacker to forge a return result of $\mathcal{O}^{\mathsf{SM2}}_{B}$ on behalf of a challenger whose public key is $A$ under the constraint that $(a,x)$ is unknown to the attacker.

We omit the proof of theorem 2 because it can be easily completed following the proof of theorem 1.

7 Security Analysis of $\mathsf{tpm.KE}$

Although our model is based on the CK model, the security analysis based on our new model differs from that based on the CK model in some aspects. First the Corrupt query in our model does not let the attacker obtain the plaintext of the long-term key but only allows him to get the black-box access of the long-term key. The second difference is about the session state that allows the attacker to get by the SessionStateReveal query. For most security analysis of AKE protocols, the session state is defined by the requirement of the proof. For instance, the security analysis of the HMQV protocol [17] requires that the session state only includes the session key, which means that the SessionStateReveal query and the SessionKeyReveal query are the same. But for the security analysis of $\mathsf{tpm.KE}$, we need to define the session state according to the specifications of $\mathsf{tpm.KE}$: we have to put into session state all the secrets that are processed and stored on the host’s memory which is easily to be tampered with. In the following we define the session state allowed to be revealed by the attacker.

Session State. In order to simulate the protections provided by the TPM, we specify that the state of a session stores the results returned by the TPM and the information stored in the host. For the Full UM scheme, the session state is the session key; for the MQV and SM2 key exchange schemes, the session state is the unhashed values returned by the TPM.

Theorem 3**.**

Under the CDH and GDH assumptions, with hash functions $H_{1}()$, $H_{2}()$, $avf()$, and $avf^{\prime}()$ modeled as random oracles, $\mathsf{tpm.KE}$ is secure in the unified model.

Let $\mathsf{Adv}^{GDH}(\mathcal{C})$, $\mathsf{Adv}^{\mathcal{O}^{\mathsf{MQV}}}(\mathcal{C})$ and $\mathsf{Adv}^{\mathcal{O}^{\mathsf{SM2}}}(\mathcal{C})$ denote the advantage of an algorithm $\mathcal{C}$ in solving the GDH problem, forging the functionality of $\mathcal{O}^{\mathsf{MQV}}$, and forging the functionality of $\mathcal{O}^{\mathsf{SM2}}$. For any attacker $\mathcal{M}$ against $\mathsf{tpm.KE}$ whose security parameter is $\lambda$, and that involves at most $n$ parties and activates at most $k$ sessions, we construct a GDH solver $\mathcal{S}$, a $\mathcal{O}^{\mathsf{MQV}}$ forger $\mathcal{F}^{\mathsf{MQV}}$, and a $\mathcal{O}^{\mathsf{SM2}}$ forger $\mathcal{F}^{\mathsf{SM2}}$ such that

[TABLE]

Proof.

The proof of the above theorem follows from the definition of secure key exchange protocols outlined in Section 4 and the following two lemmas.

Lemma 4*.*

If two parties $\hat{A}$ and $\hat{B}$ complete matching sessions, then their session keys are the same.

Lemma 5*.*

Under the CDH and GDH assumptions, there is no feasible attacker that succeeds in distinguishing the session key of an unexposed session with non-negligible probability.

Lemma 4 follows immediately from the definition of matching sessions. That is, if $\hat{A}$ completes the session $(sc,\hat{A},\hat{B},X,Y)$ and $\hat{B}$ completes the matching session $(sc,\hat{B},\hat{A},Y,X)$, it’s easy to verify that $\hat{A}$’s session key is the same as $\hat{B}$’s according to the specifications of the protocols (Figure 1).

We now prove Lemma 5. Let $\mathcal{M}$ be an attacker against $\mathsf{tpm.KE}$ and $\mathit{ts}$ the test session. Let $\mathsf{COLL}$ denote the event that the random oracles produce collisions, $\mathsf{GET}$ the event that the attacker gets the session key of $\mathit{ts}$, $\mathsf{QUERY}$ the event that someone, either the attacker or some party, queries the random oracle with the same tuple $\sigma$ as that of $\mathit{ts}$, $\mathsf{E1}$ the event that the attacker himself queries the random oracle with the same tuple $\sigma$ as that of $\mathit{ts}$, $\mathsf{E2}$ the event that some party queries the random oracle with the same tuple $\sigma$ as that of $\mathit{ts}$. Observe that $Pr\left[b^{\prime}=b\mid\overline{\mathsf{GET}}\wedge\overline{\mathsf{COLL}}\right]=\frac{1}{2}$, $Pr\left[b^{\prime}=b\mid\mathsf{GET}\wedge\overline{\mathsf{COLL}}\right]=1$, $Pr\left[\mathsf{GET}\wedge\overline{\mathsf{QUERY}}\wedge\overline{\mathsf{COLL}}\right]=0$, and $Pr\left[\mathsf{QUERY}\right]=Pr\left[\mathsf{E1}\right]+Pr\left[\mathsf{E2}\right]$, we may write

[TABLE]

If random oracles produce no collisions, the event $\mathsf{GET}\wedge\mathsf{E1}\wedge\overline{\mathsf{COLL}}$ means that $\mathcal{M}$ himself queries the random oracle with the same tuple $\sigma$ as that of $\mathit{ts}$ and gets the session key of $\mathit{ts}$. We denote this event by the forging attack. And if random oracles produce no collisions, the event $\mathsf{GET}\wedge\mathsf{E2}\wedge\overline{\mathsf{COLL}}$ means that $\mathcal{M}$ gets the session key of $\mathit{ts}$ but he does not query the random oracle with the tuple $\sigma$ of $\mathit{ts}$, and that some party establishes a session $\mathit{s}^{\prime}$ with the same tuple $\sigma$ of $\mathit{ts}$. Since $\mathcal{M}$ himself does not query the tuple $\sigma$ of $\mathit{ts}$ and is not allowed to reveal $\mathit{ts}$ in the experiment, he must get the session key of $\mathit{ts}$ by revealing $\mathit{s}^{\prime}$. So the event $\mathsf{GET}\wedge\mathsf{E2}\wedge\overline{\mathsf{COLL}}$ implies that $\mathcal{M}$ forces the establishment of another session $\mathit{s}^{\prime}$ that has the same session key as the test session and he gets the session key of the test session by revealing $\mathit{s}^{\prime}$, and we denote this event by the key-replication attack. We summarize the two attacks as follows:

Forging attack. At some point $\mathcal{M}$ queries $H_{1}()$ or $H_{2}()$ on the same tuple $\sigma$ as the test session. 2. 2.

Key-replication attack. $\mathcal{M}$ succeeds in forcing the establishment of another session that has the same session key as the test session.

The rest of this section will prove the infeasibility of forging attack and key-replication attack by showing that if either of the above attacks succeed with non-negligible probability then there exists an attacker against the GDH problem or a forger against the MQV functionality of $\mathsf{tpm.KE}$, or a forger against the SM2 key exchange functionality of $\mathsf{tpm.KE}$, and the latter two forgers are in contradiction to the CDH assumption (Theorem 1 and Theorem 2). The proof of Lemma 5 will be completed after the proof of the infeasibility of forging attack and key-replication attack. $\hfill\blacksquare$ ∎

7.1 Infeasibility of Forging Attacks

Consider a successful forging attack performed by $\mathcal{M}$. Let $(sc,\hat{A},\hat{B},X_{0},Y_{0})$ be the test session for whose tuple $\mathcal{M}$ outputs a correct guess. By the convention on session identifiers, we know that the test session is held by $\hat{A}$, its peer is $\hat{B}$, $X_{0}$ was output by $\hat{A}$, and $Y_{0}$ was the incoming message to $\hat{A}$. $sc$ can fall under one of the following three cases:

$sc=\mathsf{TPM\_ALG\_ECDH}$. 2. 2.

$sc=\mathsf{TPM\_ALG\_ECMQV}$. 3. 3.

$sc=\mathsf{TPM\_ALG\_SM2}$.

As we assume that $\mathcal{M}$ succeeds with non-negligible probability in the forging attack, there is at least one of the above three cases that occurs with non-negligible probability. We assume that $\mathcal{M}$ operates in an environment that involves at most $n$ parties and each party participates in at most $k$ sessions. We analyze the three cases separately in the following.

7.1.1 Analysis of Case 1

For this case, we build a GDH solver $\mathcal{S}_{1}$ with the following property: if $\mathcal{M}$ succeeds with non-negligible probability in this case, then $\mathcal{S}_{1}$ succeeds with non-negligible probability in solving the GDH problem. $\mathcal{S}_{1}$ takes as input a pair $(A,B)$, creates an experiment which includes $n$ honest parties and the attacker $\mathcal{M}$, and is given access to a DDH oracle $DDH$. $\mathcal{S}_{1}$ randomly selects two parties $\hat{A}$ and $\hat{B}$ from the honest parties and sets their public keys to be $A$ and $B$ respectively, and all the other parties compute their keys normally. Furthermore, $\mathcal{S}_{1}$ randomly selects an integer $i\in[1,...,k]$. The simulation for $\mathcal{M}$’s environment proceeds as follows:

$\mathcal{S}_{1}$ models $\mathsf{ephem}_{P}()$ for all parties except party $\hat{B}$ following the description in Section 5. $\mathcal{M}$ sets the type of all long-term keys. If the type of $A$ is not $\mathsf{TPM\_ALG\_ECDH}$, $\mathcal{S}_{1}$ aborts. $\mathcal{S}_{1}$ creates oracles modeling the two-phase key exchange functionalities for each party normally except parties $\hat{A}$ and $\hat{B}$ because it possesses the long-term private keys of all parties except $\hat{A}$ and $\hat{B}$. $H_{1}()$, $H_{2}()$, $avf()$, and $avf^{\prime}()$ are modeled as random oracles described below. 2. 1.

Initiate$(sc,\hat{P_{1}},\hat{P_{2}})$: $\hat{P_{1}}$ executes the Initiate() activation of the protocol. However, if the session being created is the $i$-th session at $\hat{A}$, $\mathcal{S}_{1}$ checks whether $sc=\mathsf{TPM\_ALG\_ECDH}$ and $\hat{P_{2}}=\hat{B}$. If not, $\mathcal{S}_{1}$ aborts. 3. 2.

Respond$(sc,\hat{P_{1}},\hat{P_{2}},Y)$: With the exception of $\hat{A}$ and $\hat{B}$ (whose behaviors we explain below), $\hat{P_{1}}$ executes the Respond() activation of the protocol. However, if the session being created is the $i$-th session at $\hat{A}$, $\mathcal{S}_{1}$ checks whether $sc=\mathsf{TPM\_ALG\_ECDH}$ and $\hat{P_{2}}=\hat{B}$. If not, $\mathcal{S}_{1}$ aborts. 4. 3.

Complete$(sc,\hat{P_{1}},\hat{P_{2}},X,Y)$: With the exception of $\hat{A}$ and $\hat{B}$ (whose behaviors we explain below), $\hat{P_{1}}$ executes the Complete() activation of the protocol. However, if the session is the $i$-th session at $\hat{A}$, $\mathcal{S}_{1}$ completes the session without computing a session key. 5. 4.

With the input $(sc,keyA,ctr_{x},P,Y)$, $\mathcal{S}_{1}$ creates the oracle $\mathcal{O}^{\mathsf{EC}}_{A}$ as follows:

1. (a)

If $\hat{P}=\hat{B}$, $\mathcal{O}^{\mathsf{EC}}_{A}$ returns a session key to be $H_{spec}(\hat{A},\hat{B},X,Y)$. $H_{spec}()$ is simulated as a random oracle. 2. (b)

If $\hat{P}\neq\hat{B}$, returns a session key to be $H_{1}(Z_{1},Z_{2},\hat{A},\hat{P},X,Y)$ where $Z_{1}=A^{p}$ ($p$ is the long-term private key of $\hat{P}$) and $Z_{2}=Y^{x}$ ($x$ is the ephemeral private key indexed by $ctr_{x}$). 6. 5.

Now $\mathcal{S}_{1}$ can simulate all the session activations at $\hat{A}$ for $\mathcal{M}$ with the help of $\mathcal{O}^{\mathsf{EC}}_{A}$. 7. 6.

$\mathcal{S}_{1}$ creates a Table $T$ and models $\mathsf{ephem}_{B}()$ according to the type of $B$:

1. (a)

Case $\mathsf{TPM\_ALG\_ECDH}$: Model following the description in Section 5. 2. (b)

Case $\mathsf{TPM\_ALG\_ECMQV}$:

1. i.

Randomly choose $e,s\in Z_{q}$. 2. ii.

Set $Y=g^{s}/B^{e}$ and $e=avf(Y)$. 3. iii.

Randomly choose an index $ctr$, and add a record $(ctr,e,s,Y,-)$ to $T$. 4. iv.

Return $ctr$ and $Y$. 3. (c)

Case $\mathsf{TPM\_ALG\_SM2}$:

1. i.

Randomly choose $e,s\in Z_{q}$. 2. ii.

Set $Y=(g^{s}/B)^{e^{-1}}$ and $e=avf^{\prime}(Y)$. 3. iii.

Randomly choose an index $ctr$, and add a record $(ctr,e,s,Y,-)$ to $T$. 4. iv.

Return $ctr$ and $Y$. 8. 7.

With the input $(sc,keyB,ctr_{y},P,X)$, $\mathcal{S}_{1}$ creates the oracle $\mathcal{O}^{\mathsf{EC}}_{B}$ to model the two-phase key exchange functionality for party $\hat{B}$ according to the type of $B$:

1. (a)

Case $\mathsf{TPM\_ALG\_ECDH}$: $\mathcal{O}^{\mathsf{EC}}_{B}$ is modeled similarly to $\mathcal{O}^{\mathsf{EC}}_{A}$ which is described in step 4. 2. (b)

Case $\mathsf{TPM\_ALG\_ECMQV}$:

1. i.

Check whether (1) $sc=\mathsf{TPM\_ALG\_ECMQV}$, (2) $P$ and $X$ are on the curve associated with $B$, and (3) the last element of the record in $T$ indexed by $ctr_{y}$ is ‘$-$’. If the above checks succeed, continue, else return an error. 2. ii.

Suppose the record in $T$ indexed by $ctr_{y}$ is $(ctr_{y},e,s,Y,-)$, set $Z_{1}=(XP^{d})^{hs}$ where $d=avf(X)$, and set the last element of the record to be $\times$. 3. iii.

Return $(Z_{1},Z_{2}=NULL)$. 3. (c)

Case $\mathsf{TPM\_ALG\_SM2}$:

1. i.

Check whether (1) $sc=\mathsf{TPM\_ALG\_SM2}$, (2) $P$ and $X$ are on the curve associated with $B$, and (3) the last element of the record in $T$ indexed by $ctr_{y}$ is ‘$-$’. If the above checks pass, continue, else return an error. 2. ii.

Suppose the record in $T$ indexed by $ctr_{y}$ is $(ctr_{y},e,s,Y,-)$, set $Z_{1}=(PX^{d})^{hs}$ where $d=avf^{\prime}(X)$, and set the last element of the record to be $\times$. 3. iii.

Return $(Z_{1},Z_{2}=NULL)$. 9. 8.

$\mathcal{S}_{1}$ simulates all the session activations at $\hat{B}$ for $\mathcal{M}$ with the help of $\mathsf{ephem}_{B}()$ and the oracle created in step 7. 10. 9.

SessionStateReveal($s$): $\mathcal{S}_{1}$ returns to $\mathcal{M}$ the session state of session $s$. However, if $s$ is the $i$-th session at $\hat{A}$, $\mathcal{S}_{1}$ aborts. 11. 10.

SessionKeyReveal($s$): $\mathcal{S}_{1}$ returns to $\mathcal{M}$ the session key of $s$. If $s$ is the $i$-th session at $\hat{A}$, $\mathcal{S}_{1}$ aborts. 12. 11.

Corruption($\hat{P}$): $\mathcal{S}_{1}$ gives $\mathcal{M}$ the handle of the long-term key $P$. If $\mathcal{M}$ tries to corrupt $\hat{A}$ or $\hat{B}$, $\mathcal{S}_{1}$ aborts. 13. 12.

$H_{1}(\sigma)$ function for some $\sigma=(Z_{1},Z_{2},\hat{P_{1}},\hat{P_{2}},X,Y)$ proceeds as follows:

1. (a)

If $\hat{P_{1}}=\hat{A}$, $\hat{P_{2}}=\hat{B}$, and $DDH(A,B,Z_{1})=1$, then $\mathcal{S}_{1}$ aborts $\mathcal{M}$ and succeeds by outputting CDH$(A,B)=Z_{1}$. 2. (b)

If the value of the function on input $\sigma$ has been defined previously, return it. 3. (c)

If the value of $H_{spec}()$ on input $(\hat{P_{1}},\hat{P_{2}},X,Y)$ has been defined previously, return it. 4. (d)

Pick a random key $k\in_{R}\{0,1\}^{\lambda}$, and define $H_{1}(\sigma)=k$. 14. 13.

$H_{spec}()$, $H_{2}()$, $avf()$, and $avf^{\prime}()$ are simulated as random oracles in the usual way.

Proof.

The probability that $\mathcal{M}$ sets the type of $A$ to be $\mathsf{TPM\_ALG\_ECDH}$ and selects the $i$-th session of $\hat{A}$ and the peer of the test session is party $\hat{B}$ is at least $\frac{1}{3n^{2}k}$. Suppose that this indeed the case: the type of $A$ is $\mathsf{TPM\_ALG\_ECDH}$, so $\mathcal{S}_{1}$ does not abort in Step 0; $\mathcal{M}$ is not allowed to corrupt $\hat{A}$ and $\hat{B}$, make SessionStateReveal and SessionKeyReveal queries to the $i$-th session of $\hat{A}$, so $\mathcal{S}_{1}$ does not abort in Step 1, 2, 9, 10, 11. Therefore, $\mathcal{S}_{1}$ simulates $\mathcal{M}$’s environment perfectly. Thus, if $\mathcal{M}$ wins with non-negligible probability in this case, the success probability of $\mathcal{S}_{1}$ is bounded by

$Pr(\mathcal{S}_{1})\geq\frac{1}{3n^{2}k}Pr(\mathcal{M})$.

$\hfill\blacksquare$ ∎

7.1.2 Analysis of Case 2

Recall that the test session is denoted by $(sc,\hat{A},\hat{B},X_{0},Y_{0})$. We divide Case 2 of the forging attack into the following four subcases according to the generation of $Y_{0}$:

1. C1.

$Y_{0}$ was generated by $\hat{B}$ in a session matching the test session, i.e., in session $(sc,\hat{B},\hat{A},Y_{0},X_{0})$. 2. C2.

$Y_{0}$ was generated by $\hat{B}$ in a session message-matching the test session, i.e., in session $(sc^{\prime},\hat{B},\hat{A},Y_{0},X_{0})$ with $sc^{\prime}\neq sc$. 3. C3.

$Y_{0}$ was generated by $\hat{B}$ in a session $(sc^{\prime},\hat{B},\hat{A}^{*},Y_{0},X^{*})$ with $(\hat{A}^{*},X^{*})\neq(\hat{A},X_{0})$. 4. C4.

$Y_{0}$ did not appear in any completed sessions activated at $\hat{B}$, i.e., $Y_{0}$ was never output by $\hat{B}$ as its outgoing ephemeral public key in any sessions, or $\hat{B}$ did output $Y_{0}$ as its outgoing ephemeral public key for some session $s$ but it never completed $s$ by computing the session key.

If $\mathcal{M}$ succeeds in Case 2 in its forging attack with non-negligible probability then there is at least one of the above four subcases happens with non-negligible probability in the successful runs of $\mathcal{M}$. We proceed to analyze these subcases separately.

Analysis of Subcase C1. For this subcase, we build a GDH solver $\mathcal{S}_{2}$ with the following property: if $\mathcal{M}$ succeeds with non-negligible probability in this subcase, then $\mathcal{S}_{2}$ succeeds with non-negligible probability in solving the GDH problem. $\mathcal{S}_{2}$ takes as input a pair $(X_{0},Y_{0})$, creates an experiment which includes $n$ honest parties and the attacker $\mathcal{M}$, and is given access to a DDH oracle $DDH$. All parties compute their keys normally. $\mathcal{S}_{2}$ randomly selects two party $\hat{A}$ and $\hat{B}$ and randomly selects two integers $i,j\in[1,...,k]$. The simulation for $\mathcal{M}$’s environment proceeds as follows:

$\mathcal{S}_{2}$ models $\mathsf{ephem}_{P}()$ for all parties following the description in Section 5. $\mathcal{M}$ sets the type of all long-term keys. If the type of $A$ and $B$ is not $\mathsf{TPM\_ALG\_ECMQV}$, $\mathcal{S}_{2}$ aborts. $\mathcal{S}_{2}$ can create oracles modeling the two-phase key exchange functionalities for each party normally as it possesses the long-term private keys of all parties. 2. 1.

Initiate$(sc,\hat{P_{1}},\hat{P_{2}})$: $\hat{P_{1}}$ executes the Initiate() activation of the protocol. However, if the session being created is the $i$-th session at $\hat{A}$ (or the $j$-th session at $\hat{B}$), $\mathcal{S}_{2}$ checks whether $sc=\mathsf{TPM\_ALG\_ECMQV}$ and $\hat{P_{2}}=\hat{B}$ (or $\hat{P_{2}}=\hat{A}$). If so, $\mathcal{S}_{2}$ sets the ephemeral public key to be $X_{0}$ (or $Y_{0}$), else $\mathcal{S}_{2}$ aborts. 3. 2.

Respond$(sc,\hat{P_{1}},\hat{P_{2}},Y)$: $\hat{P_{1}}$ executes the Respond() activation of the protocol. However, if the session being created is the $i$-th session at $\hat{A}$ (or the $j$-th session at $\hat{B}$), $\mathcal{S}_{2}$ checks whether $sc=\mathsf{TPM\_ALG\_ECMQV}$, $\hat{P_{2}}=\hat{B}$ (or $\hat{P_{2}}=\hat{A}$), and $Y=Y_{0}$ (or $Y=X_{0}$). If so, $\mathcal{S}_{2}$ sets the ephemeral public key to be $X_{0}$ (or $Y_{0}$), else $\mathcal{S}_{2}$ aborts. 4. 3.

Complete$(sc,\hat{P_{1}},\hat{P_{2}},X,Y)$: $\hat{P_{1}}$ executes the Complete() activation of the protocol. However, if the session is the $i$-th session at $\hat{A}$ (or the $j$-th session at $\hat{B}$), $\mathcal{S}_{2}$ completes the session without computing a session key. 5. 4.

SessionStateReveal($s$): $\mathcal{S}_{2}$ returns to $\mathcal{M}$ the session state of session $s$. However, if $s$ is the $i$-th session at $\hat{A}$ (or the $j$-th session at $\hat{B}$), $\mathcal{S}_{2}$ aborts. 6. 5.

SessionKeyReveal($s$): $\mathcal{S}_{2}$ returns to $\mathcal{M}$ the session key of $s$. If $s$ is the $i$-th session at $\hat{A}$ (or the $j$-th session at $\hat{B}$), $\mathcal{S}_{2}$ aborts. 7. 6.

Corruption($\hat{P}$): $\mathcal{S}_{2}$ gives $\mathcal{M}$ the handle of the long-term key $P$. If $\mathcal{M}$ tries to corrupt $\hat{A}$ or $\hat{B}$, $\mathcal{S}_{2}$ aborts. 8. 7.

$H_{2}(\sigma)$ function for some $\sigma=(Z,\hat{P_{1}},\hat{P_{2}})$ proceeds as follows:

1. (a)

If $\hat{P_{1}}=\hat{A}$, $\hat{P_{2}}=\hat{B}$, and $DDH(X_{0}A^{d},Y_{0}B^{e},Z^{1/h})=1$ where $d=avf(X_{0})$ and $e=avf(Y_{0})$, then $\mathcal{S}_{2}$ aborts $\mathcal{M}$ and succeeds by outputting CDH($X_{0},Y_{0})=\frac{Z^{1/h}}{X_{0}^{eb}Y_{0}^{da}g^{deab}}$. 2. (b)

If the value of the function on input $\sigma$ has been defined previously, return it. 3. (c)

Pick a random key $k\in_{R}\{0,1\}^{\lambda}$, and define $H_{2}(\sigma)=k$. 9. 8.

$H_{1}()$, $avf()$, and $avf^{\prime}()$ are simulated as random oracles in the usual way.

Proof.

The probability that $\mathcal{M}$ sets the type of $A$ and $B$ to be $\mathsf{TPM\_ALG\_ECMQV}$ and selects the $i$-th session of $\hat{A}$ and the $j$-th session of $\hat{B}$ as the test session and its matching session is at least $\frac{1}{3}\times\frac{1}{3}\times\frac{2}{(nk)^{2}}=\frac{2}{9(nk)^{2}}$. Suppose that this is indeed the case: the type of $A$ and $B$ is $\mathsf{TPM\_ALG\_ECMQV}$, so $\mathcal{S}_{2}$ does not abort in Step 0; $\mathcal{M}$ is not allowed to corrupt $\hat{A}$ and $\hat{B}$, make SessionStateReveal and SessionKeyReveal queries to the $i$-th session of $\hat{A}$ or the $j$-th session of $\hat{B}$, so $\mathcal{S}_{2}$ does not abort in Step 1, 2, 4, 5, 6. Therefore, $\mathcal{S}_{2}$ simulates $\mathcal{M}$’s environment perfectly. Thus, if $\mathcal{M}$ wins with non-negligible probability in this case, the success probability of $\mathcal{S}_{2}$ is bounded by

$Pr(\mathcal{S}_{2})\geq\frac{2}{9(nk)^{2}}Pr(\mathcal{M})$.

$\hfill\blacksquare$ ∎

Analysis of Subcase C2. For this subcase, we show that $\mathcal{M}$ can break the unforgeability of the MQV functionality proved in theorem 1 if it succeeds with non-negligible probability. We build a simulator $\mathcal{S}_{3}$ which simulates $\mathcal{M}$’s environment. $\mathcal{S}_{3}$ takes as input a challenge $X_{0}$, and creates an experiment which includes $n$ honest parties and the attacker $\mathcal{M}$. All parties compute their keys normally. $\mathcal{S}_{3}$ randomly selects two parties $\hat{A}$ and $\hat{B}$, and randomly selects two integers $i,j\in[1,...,k]$. The simulation for $\mathcal{M}$’s environment proceeds as follows:

$\mathcal{S}_{3}$ models $\mathsf{ephem}_{P}()$ for all parties following the description in Section 5. $\mathcal{M}$ sets the types for all long-term keys. If the type of $A$ is not $\mathsf{TPM\_ALG\_ECMQV}$ and the type of $B$ is $\mathsf{TPM\_ALG\_ECMQV}$, $\mathcal{S}_{3}$ aborts. $\mathcal{S}_{3}$ can create oracles modeling the two-phase key exchange functionalities for each party normally as it possesses the long-term private keys of all parties. 2. 1.

Initiate$(sc,\hat{P_{1}},\hat{P_{2}})$: $\hat{P_{1}}$ executes the Initiate() activation of the protocol. However, if the session being created is the $i$-th session at $\hat{A}$, $\mathcal{S}_{3}$ checks whether $sc=\mathsf{TPM\_ALG\_ECMQV}$ and $\hat{P_{2}}=\hat{B}$. If so, $\mathcal{S}_{3}$ sets the ephemeral public key to be $X_{0}$, else $\mathcal{S}_{3}$ aborts. If the session being created is the $j$-th session at $\hat{B}$, $\mathcal{S}_{3}$ checks whether $sc\neq\mathsf{TPM\_ALG\_ECMQV}$ and $\hat{P_{2}}$ is $\hat{A}$. If so, $\mathcal{S}_{3}$ calls $\mathsf{ephem}_{B}()$ to create an ephemeral key, denoted by $Y_{0}$, and sets the outgoing ephemeral key of this session to be $Y_{0}$, else $\mathcal{S}_{3}$ aborts. 3. 2.

Respond$(sc,\hat{P_{1}},\hat{P_{2}},Y)$: $\hat{P_{1}}$ executes the Respond() activation of the protocol. However, if the session being created is the $i$-th session at $\hat{A}$, $\mathcal{S}_{3}$ checks whether $sc=\mathsf{TPM\_ALG\_ECMQV}$, $\hat{P_{2}}=\hat{B}$, and $Y=Y_{0}$. If so, $\mathcal{S}_{3}$ provides $\mathcal{M}$ with the value $X_{0}$, else $\mathcal{S}_{3}$ aborts. If the session being created is the $j$-th session at $\hat{B}$, $\mathcal{S}_{3}$ checks whether $sc\neq\mathsf{TPM\_ALG\_ECMQV}$, $\hat{P_{2}}=\hat{A}$, and $Y=X_{0}$. If so, $\mathcal{S}_{3}$ calls $\mathsf{ephem}_{B}()$ to create an ephemeral key, denoted by $Y_{0}$, and sets the outgoing ephemeral key of this session to be $Y_{0}$, else $\mathcal{S}_{3}$ aborts. 4. 3.

Complete$(sc,\hat{P_{1}},\hat{P_{2}},X,Y)$: $\hat{P_{1}}$ executes the Complete() activation of the protocol. However, if the session is the $i$-th session at $\hat{A}$, $\mathcal{S}_{3}$ completes the session without computing a session key. 5. 4.

SessionStateReveal($s$): $\mathcal{S}_{3}$ returns to $\mathcal{M}$ the session state of session $s$. However, if $s$ is the $i$-th session at $\hat{A}$, $\mathcal{S}_{3}$ aborts. 6. 5.

SessionKeyReveal($s$): $\mathcal{S}_{3}$ returns to $\mathcal{M}$ the session key of $s$. If $s$ is the $i$-th session at $\hat{A}$, $\mathcal{S}_{3}$ aborts. 7. 6.

Corruption($\hat{P}$): $\mathcal{S}_{3}$ gives $\mathcal{M}$ the handle of the long-term key $P$. If $\mathcal{M}$ tries to corrupt $\hat{A}$ or $\hat{B}$, $\mathcal{S}_{3}$ aborts. 8. 7.

$H_{1}()$, $H_{2}()$, $avf()$, and $avf^{\prime}()$ are simulated as random oracles in the usual way.

Proof.

The probability that $\mathcal{M}$ sets the type of $A$ to be $\mathsf{TPM\_ALG\_ECMQV}$ and the type of $B$ not to be $\mathsf{TPM\_ALG\_ECMQV}$ and selects the $i$-th session of $\hat{A}$ and the $j$-th session of $\hat{B}$ as the test session and its message-matching session is at least $\frac{1}{3}\times\frac{2}{3}\times\frac{1}{(nk)^{2}}=\frac{2}{9(nk)^{2}}$. Suppose that this is indeed the case: the type of $A$ is $\mathsf{TPM\_ALG\_ECMQV}$ and the type of $B$ is not $\mathsf{TPM\_ALG\_ECMQV}$, so $\mathcal{S}_{3}$ does not abort in Step 0; $\mathcal{M}$ is not allowed to corrupt $\hat{A}$ and $\hat{B}$, make SessionStateReveal and SessionKeyReveal queries to the $i$-th session of $\hat{A}$, so $\mathcal{S}_{3}$ does not abort in Step 1, 2, 4, 5, 6. Therefore, $\mathcal{S}_{2}$ simulates $\mathcal{M}$’s environment perfectly except with negligible probability. By the assumption, $\mathcal{M}$ correctly guesses the tuple $(Z=(Y_{0}B^{e})^{h(x_{0}+da)},\hat{A},\hat{B})$ of the test session where $d=avf(X_{0})$ and $e=avf(Y_{0})$. We now show that $(Y_{0},Z)$ is a valid forgery against $\mathcal{O}^{\mathsf{MQV}}_{B}$ on input $(X_{0},A)$ where $X_{0}$ is the challenge:

$(Y_{0},Z)$ is a valid return result of $\mathcal{O}^{\mathsf{MQV}}_{B}$ as $Z=(Y_{0}B^{e})^{h(x_{0}+da)}=(X_{0}A^{d})^{h(y_{0}+eb)}$. 2. 2.

$\mathcal{O}^{\mathsf{MQV}}_{B}$ never returns the result $(Y_{0},Z)$ on input $(X_{0},A)$ under $\mathcal{S}_{3}$: $\mathcal{O}^{\mathsf{MQV}}_{B}$ has never been created by $\mathcal{S}_{3}$ as the type of $B$ is not $\mathsf{TPM\_ALG\_ECMQV}$ in this subcase. 3. 3.

Since $\mathcal{M}$ is not allowed to corrupt $\hat{A}$ and $\hat{B}$, $\mathcal{M}$ does not know $a$ and $b$. So $\mathcal{M}$ does not know the private key pair $(a,x_{0})$. Thus, $\mathcal{M}$ is under the constraint described in theorem 1.

Finally we get: $Pr$($\mathcal{M}$ succeeds in forging $\mathcal{O}^{\mathsf{MQV}}_{B}$ under $\mathcal{S}_{3}$) \geq$$\frac{2}{9(nk)^{2}}Pr(\mathcal{M}). $\hfill\blacksquare$ ∎

Analysis of Subcases C3 and C4. For the two subcases, we show that $\mathcal{M}$ can break the unforgeability of the MQV functionality proved in theorem 1 if it succeeds with non-negligible probability. We build a simulator $\mathcal{S}_{4}$ which simulates $\mathcal{M}$’s environment. $\mathcal{S}_{4}$ takes as input a challenge $X_{0}$, and creates an experiment which includes $n$ honest parties and the attacker $\mathcal{M}$. All parties compute their keys normally. $\mathcal{S}_{4}$ randomly selects two parties $\hat{A}$ and $\hat{B}$, and randomly selects one integer $i\in[1,...,k]$. The simulation for $\mathcal{M}$’s environment proceeds as follows:

$\mathcal{S}_{4}$ models $\mathsf{ephem}_{P}()$ for all parties following the description in Section 5. $\mathcal{M}$ sets the type for all long-term keys. If the type of $A$ is not $\mathsf{TPM\_ALG\_ECMQV}$, $\mathcal{S}_{4}$ aborts. $\mathcal{S}_{4}$ can create oracles modeling the two-phase key exchange functionalities for each party normally as it possesses the long-term private keys of all the parties. 2. 1.

Initiate$(sc,\hat{P_{1}},\hat{P_{2}})$: $\hat{P_{1}}$ executes the Initiate() activation of the protocol. However, if the session being created is the $i$-th session at $\hat{A}$, $\mathcal{S}_{4}$ checks whether $sc=\mathsf{TPM\_ALG\_ECMQV}$ and $\hat{P_{2}}=\hat{B}$. If so, $\mathcal{S}_{4}$ sets the ephemeral public key to be $X_{0}$, else $\mathcal{S}_{4}$ aborts. 3. 2.

Respond$(sc,\hat{P_{1}},\hat{P_{2}},Y)$: $\hat{P_{1}}$ executes the Respond() activation of the protocol. However, if the session being created is the $i$-th session at $\hat{A}$, $\mathcal{S}_{4}$ checks whether $sc=\mathsf{TPM\_ALG\_ECMQV}$ and $\hat{P_{2}}=\hat{B}$. If so, $\mathcal{S}_{4}$ provides $\mathcal{M}$ with the value $X_{0}$, else $\mathcal{S}_{4}$ aborts. 4. 3.

Complete$(sc,\hat{P_{1}},\hat{P_{2}},X,Y)$: $\hat{P_{1}}$ executes the Complete() activation of the protocol. However, if the session is the $i$-th session at $\hat{A}$, $\mathcal{S}_{4}$ completes the session without computing a session key. 5. 4.

SessionStateReveal($s$): $\mathcal{S}_{4}$ returns to $\mathcal{M}$ the session state of session $s$. However, if $s$ is the $i$-th session at $\hat{A}$, $\mathcal{S}_{4}$ aborts. 6. 5.

SessionKeyReveal($s$): $\mathcal{S}_{4}$ returns to $\mathcal{M}$ the session key of $s$. If $s$ is the $i$-th session at $\hat{A}$, $\mathcal{S}_{4}$ aborts. 7. 6.

Corruption($\hat{P}$): $\mathcal{S}_{4}$ gives $\mathcal{M}$ the handle of the long-term key $P$. If $\mathcal{M}$ tries to corrupt $\hat{A}$ or $\hat{B}$, $\mathcal{S}_{4}$ aborts. 8. 7.

$H_{1}()$, $H_{2}()$, $avf()$, and $avf^{\prime}()$ are simulated as random oracles in the usual way.

Proof.

The probability that $\mathcal{M}$ sets the type of $A$ to be $\mathsf{TPM\_ALG\_ECMQV}$ and selects the $i$-th session of $\hat{A}$ as the test session is at least $\frac{1}{3}\times\frac{1}{n^{2}k}=\frac{1}{3n^{2}k}$. Suppose that this is indeed the case: the type of $A$ is $\mathsf{TPM\_ALG\_ECMQV}$, so $\mathcal{S}_{4}$ does not abort in Step 0; $\mathcal{M}$ is not allowed to corrupt $\hat{A}$ and $\hat{B}$, make SessionStateReveal and SessionKeyReveal queries to the $i$-th session of $\hat{A}$, so $\mathcal{S}_{4}$ does not abort in Step 1, 2, 4, 5, 6. Therefore, $\mathcal{S}_{4}$ simulates $\mathcal{M}$’s environment perfectly. By the assumption, $\mathcal{M}$ correctly guesses the tuple $(Z=(Y_{0}B^{e})^{h(x_{0}+da)},\hat{A},\hat{B})$ of the test session where $d=avf(X_{0})$ and $e=avf(Y_{0})$. We now show that $(Y_{0},Z)$ is a valid forgery against $\mathcal{O}^{\mathsf{MQV}}_{B}$ on input $(X_{0},A)$ where $X_{0}$ is the challenge:

$(Y_{0},Z)$ is a valid return result of $\mathcal{O}^{\mathsf{MQV}}_{B}$ as $Z=(Y_{0}B^{e})^{h(x_{0}+da)}=(X_{0}A^{d})^{h(y_{0}+eb)}$. 2. 2.

We now show that $\mathcal{O}^{\mathsf{MQV}}_{B}$ never returns the result $(Y_{0},Z)$ on input $(X_{0},A)$ under $\mathcal{S}_{4}$:

1. (a)

If the type of $B$ is $\mathsf{TPM\_ALG\_ECDH}$ or $\mathsf{TPM\_ALG\_SM2}$, $\mathcal{O}^{\mathsf{MQV}}_{B}$ has never been created by $\mathcal{S}_{4}$. 2. (b)

If the type of $B$ is $\mathsf{TPM\_ALG\_ECMQV}$, $\mathcal{S}_{4}$ must create $\mathcal{O}^{\mathsf{MQV}}_{B}$ in step 0. However, if $\mathcal{O}^{\mathsf{MQV}}_{B}$ ever returned the result $(Y_{0},Z)$ for some $Z$ on input $(A,X_{0})$, $\hat{B}$ must have a session identified by $(sc=\mathsf{TPM\_ALG\_ECMQV},\hat{B},\hat{A},Y_{0},X_{0})$, which is exactly the matching session of the test session. This contradicts that the test session has no matching session in these two subcases. 3. 3.

Since $\mathcal{M}$ is not allowed to corrupt $\hat{A}$ and $\hat{B}$, $\mathcal{M}$ does not know $a$ and $b$. So $\mathcal{M}$ does not know the private key pair $(a,x_{0})$. Thus, $\mathcal{M}$ is under the constraint described in theorem 1.

Finally we get: $Pr$($\mathcal{M}$ succeeds in forging $\mathcal{O}^{\mathsf{MQV}}_{B}$ under $\mathcal{S}_{4}$) \geq$$\frac{1}{3n^{2}k}Pr(\mathcal{M}). $\hfill\blacksquare$ ∎

7.1.3 Analysis of Case 3

The analysis of Case 3 is similar to Case 2. It is easy to get a full proof by following the analysis in Section 7.1.2, so we omit the analysis of Case 3.

7.2 Infeasibility of Key-replication Attacks

If $\mathcal{M}$ successfully launches a key-replication attack against the test session $s=(sc,\hat{A},\hat{B},X_{0},Y_{0})$, he succeeds in establishing a session $s^{\prime}=(sc^{\prime},\hat{A}^{\prime},\hat{B}^{\prime},X^{\prime},Y^{\prime})$, which is different than $s$ and $(sc,\hat{B},\hat{A},Y_{0},X_{0})$ (the matching session of $s$) but has the same key as the test session $s$. The $sc$ of $s^{\prime}$ must fall under one of the following three cases. By demonstrating that key-replication attacks are impossible in any of the three cases, we prove that $\mathcal{M}$ cannot launch key-replication attacks.

$sc=\mathsf{TPM\_ALG\_ECDH}$. 2. 2.

$sc=\mathsf{TPM\_ALG\_ECMQV}$. 3. 3.

$sc=\mathsf{TPM\_ALG\_SM2}$.

7.2.1 Analysis of Case 1

In this case, the session key of the test session is the value of the random oracle $H_{1}()$ on $\sigma=(Z_{1},Z_{2},\hat{A},\hat{B},X_{0},Y_{0})$. As the session key of the MQV or SM2 key exchange protocol is the value of the random oracle $H_{2}()$ on some 3-tuple $(Z,\hat{A},\hat{B})$, the session $s^{\prime}$ must belong to a party whose long-term key is the type of $\mathsf{TPM\_ALG\_ECDH}$. So the session identifier of $s^{\prime}$ must be $(sc,\hat{A},\hat{B},X_{0},Y_{0})$ or $(sc,\hat{B},\hat{A},Y_{0},X_{0})$ where $sc=\mathsf{TPM\_ALG\_ECDH}$, i.e., $s^{\prime}$ is the test session or its matching session, which contradicts that $s^{\prime}$ is different from $s$ and the matching session of $s$.

7.2.2 Analysis of Cases 2 and 3

We show that a key-replication attack is impossible by showing that a successful attacker would contradict the GDH assumption or break the unforgeability of MQV functionality or SM2 key exchange functionality.

Since $s^{\prime}$ has the same session key as the test session $s$, $s^{\prime}$ must have the same $\sigma$ as the test session. In all the subcases of Case 2 in Section 7.1.2, all the simulators ($\mathcal{S}_{2}$, $\mathcal{S}_{3}$, and $\mathcal{S}_{4}$) provide $\mathcal{M}$ with the session state of all exposed sessions. Therefore, $\mathcal{M}$ can obtain the 3-tuple of $s$ by exposing $s^{\prime}$ (this is allowed in the security model as $s^{\prime}$ is not the matching session of $s$). This means that $\mathcal{M}$ is able to launch forging attacks. However, we have shown that if $\mathcal{M}$ succeeds in a forging attack: $\mathcal{S}_{2}$ would succeed in solving the GDH problem, and under $\mathcal{S}_{3}$ and $\mathcal{S}_{4}$, there would exist an attacker breaking the unforgeability of the MQV functionality of $\mathsf{tpm.KE}$. By applying the above argument and replacing the unforgeability of the MQV functionality of $\mathsf{tpm.KE}$ with the unforgeability of the SM2 key exchange functionality of $\mathsf{tpm.KE}$, we directly get the analysis of Case 3.

8 Further Security Properties of $\mathsf{tpm.KE}$

Besides the basic security property defined by modern security models, it is desirable for AKE protocols to achieve the following two security properties. The key-compromise impersonation (KCI) resistance property: the knowledge of a party’s long-term private key does not enable the attacker to impersonate other uncorrupted parties to the party. The Perfect Forward Secrecy (PFS) property: the expired session keys established before the compromise of the long-term key cannot be recovered.

From the UKS attacks against MQV and SM2 key exchange protocols (A and B) we know that if the attacker is allowed to obtain the plaintext of the long-term key when he corrupts the corresponding party, these protocols will be unable to satisfy the basic security property defined by modern AKE security models. So the current version of $\mathsf{tpm.KE}$ can only achieve the security property defined by the security model in case that the attacker cannot obtain the plaintext of long-term keys (even he corrupts the parties). Since $\mathsf{tpm.KE}$ can only be proven secure in situations where the plaintext of long-term keys cannot be revealed to the attacker, which does not satisfy the definitions of KCI-resistance and wPFS properties, it cannot provide the KCI-resistance and wPFS properties. But $\mathsf{tpm.KE}$ can satisfy weak forms of the two properties: (1) constrained KCI-resistance; that is, the control of a party’s long-term key handle does not enable the attacker to impersonate other uncontrolled parties to the party; and (2) the constrained PFS property; that is, the expired session keys established before the attacker controls the handle of the long-term key cannot be recovered. To prove the above weak forms of the two properties, all needed is to note that the proof of $\mathsf{tpm.KE}$ in Section 7 still holds if we allow the attacker to corrupt $\hat{A}$ and $\hat{B}$ which are the related parties of the test session, i.e., all the simulators do not abort when $\hat{A}$ and $\hat{B}$ are corrupted. The proof remains valid since the abort operations are never used in the proof.

9 Suggestions on Usage of the Current Version of $\mathsf{tpm.KE}$

Although we formally prove that $\mathsf{tpm.KE}$ satisfies the basic security property defined by modern AKE models, this is achieved under the following conditions: first, all the long-term keys must be generated by the TPM, and the attacker cannot register arbitrary keys; second, the attacker cannot obtain the plaintext of the long-term key even he corrupts the party; third, the attacker cannot obtain the unhashed value of the Full UM protocol. These constraints require that engineers should deploy $\mathsf{tpm.KE}$ properly, otherwise $\mathsf{tpm.KE}$ would be unable to provide secure communications. In order to help engineers to use $\mathsf{tpm.KE}$ securely, we give the following suggestions:

For a network that plans to use $\mathsf{tpm.KE}$ to protect its communications, we suggest that all devices in the network should be equipped with the TPM and the CA should only issue certificates for keys that are generated by the TPM. This requires the CA to check the validity of the TPM, and this can be done by leveraging the Privacy CA protocol [51] or the direct anonymous attestation (DAA) protocol [52] if higher anonymity is required. 2. 2.

The network administrator should guarantee that all TPM chips are well protected against sophisticated physical attacks which can obtain the secrets inside the TPM, and the administrator should know that if one TPM chip is physically broken, the whole network may no longer be secure. 3. 3.

The software running on the host which derives the session key from the return results of the TPM should be well protected. For example, run the software in the secure execution environment provided by the Intel SGX [53, 54] or ARM TrustZone [7] technologies and delete the return results of the TPM (especially $Z_{1}$ of the Full UM protocol) immediately after the session key is derived.

10 Revision of $\mathsf{tpm.KE}$

A real-world network may contain various kinds of devices, and it is common that some devices are protected by the TPM and the others are not. Moreover, there exist physical attacks that can access all keys inside the TPM [55]. So it is hard for real-world networks to satisfy the conditions required to ensure $\mathsf{tpm.KE}$’s security. Therefore, the current version of $\mathsf{tpm.KE}$ puts a significant limitation on its application on real-world networks.

In order to make $\mathsf{tpm.KE}$ more applicable to real-world networks, we suggest revising TPM 2.0 specifications as follows: perform the session key derivation in the TPM rather than on the host, i.e., perform $H_{1}()$ and $H_{2}()$ in the TPM. The revision only adds a hash computation to the TPM, which is negligible compared to the elliptic curve scalar multiplication. This revision is inspired by the HMQV protocol, the first proven secure implicitly AKE protocol, which requires that its unhashed value $Z$ should be stored in the same secure environment as the long-term key and only the session key is output outside of the environment. We give concrete suggestions on how to revise TPM 2.0 specifications: the only change is to revise TPM2_ZGen_2Phase() command in the TPM 2.0 Command specification [6]. The command is revised to derive the session key inside the TPM and return the session key, while the original command returns the unhashed values $Z_{1}$ and $Z_{2}$. Figure 3 describes the changes to the input and response of the TPM2_ZGen_2Phase() command.

• •

Changes of input: add the identities of the owner and peer of the session.

• •

Changes of response: not return the unhashed values but the session key.

11 Preparation for the Security Analysis of the Revision

In this section, we do the preparation work for the security analysis of the revision of $\mathsf{tpm.KE}$ (denoted by $\mathsf{tpm.KE.rev}$), including the formal description of $\mathsf{tpm.KE.rev}$, the session state, and the attacker model.

11.1 Formal Description of $\mathsf{tpm.KE.rev}$

The first phase of $\mathsf{tpm.KE.rev}$ is the same as $\mathsf{tpm.KE}$, so we use the same $\mathsf{ephem()}_{A}$ to model the interface of the first phase of $\mathsf{tpm.KE.rev}$. As the TPM returns the session key in the second phase of $\mathsf{tpm.KE.rev}$, we modify the oracles $\mathcal{O}^{\mathsf{MQV}}_{A}$ and $\mathcal{O}^{\mathsf{SM2}}_{A}$ to return the session key. We get the formal description of $\mathsf{tpm.KE.rev}$ by using the modified oracles $\mathcal{O}^{\mathsf{MQV}}_{A}$ and $\mathcal{O}^{\mathsf{SM2}}_{A}$ to replace the original oracles of the formal description of $\mathsf{tpm.KE}$ in Section 5.

As our formal analysis of $\mathsf{tpm.KE.rev}$ contains parties that are not equipped with the TPM, we need to describe how the protocols are implemented in these parties. These parties also use the Initiate, Respond and Complete activations to construct protocol sessions. The three activations for these parties differ from the activations for $\mathsf{tpm.KE.rev}$ in that they do not leverage the interfaces of the TPM, i.e., $\mathsf{ephem()}_{A}$, $\mathcal{O}^{\mathsf{EC}}_{A}$, $\mathcal{O}^{\mathsf{MQV}}_{A}$, and $\mathcal{O}^{\mathsf{SM2}}_{A}$, but run following the specifications of the protocols.

11.2 Session State

The session state includes the information returned by the TPM. As the ephemeral key and unhashed values (such as $Z_{1}$ and $Z_{2}$) are stored inside the TPM, we specify that the session state only includes the session key.

11.3 Attacker Model for $\mathsf{tpm.KE.rev}$

The attacker model for $\mathsf{tpm.KE.rev}$ is used to capture realistic attack capabilities in real-world networks, which are much stronger than the attack capabilities captured by the model for $\mathsf{tpm.KE}$. In particular, the model for $\mathsf{tpm.KE.rev}$ allows the attacker to register arbitrary keys to the CA and obtain the plaintext of a long-term key by corrupting the party. To capture the above stronger attack capabilities, we add the EstablishParty query to the model for $\mathsf{tpm.KE}$ (Section 4) and modify the SessionStateReveal and Corruption queries.

• •

EstablishParty($\hat{P}$): this query is newly added to the model to allow the attacker to register a static public key on behalf of party $\hat{P}$.

• •

SessionStateReveal(s): $\mathcal{M}$ directly queries at session $s$ while still incomplete and learns the session state for $s$. The session state only includes the session key, while the session state in the model for $\mathsf{tpm.KE}$ includes the unhashed values.

• •

Corruption($\hat{P}$): this query allows $\mathcal{M}$ to learn the plaintext of the long-term private key of party $\hat{P}$, while this query in the model for $\mathsf{tpm.KE}$ only allows the attacker to obtain the black-box access of the long-term key.

12 Security Analysis of $\mathsf{tpm.KE.rev}$

In order to make our analysis be close to real-world networks as much as possible, we do not make any assumption whether the parties in the network are equipped with the TPM, including the owner and the peer of the test session.

Theorem 6**.**

Under the GDH assumption, with hash functions $H_{1}()$, $H_{2}()$, $avf()$, and $avf^{\prime}()$ modeled as random oracles, $\mathsf{tpm.KE.rev}$ is secure in the unified model.

The proof of the above theorem follows from the definition of secure key exchange protocols and the following two lemmas.

Lemma 7*.*

If two parties $\hat{A}$ and $\hat{B}$ complete matching sessions, their session keys are the same.

Lemma 8*.*

Under the GDH assumption, there is no feasible attacker that succeeds in distinguishing the session key of an unexposed session with non-negligible probability.

The proof of Lemma 7 is the same as Lemma 4, and we focus on the proof of Lemma 8. Let $\mathcal{M}$ be any attacker against $\mathsf{tpm.KE.rev}$. $\mathcal{M}$ can launch the forging attack or key-replication attack to distinguish the session key of the test session from a random value. We will show that if either of the attacks succeed with non-negligible probability, there exists a solver succeeding in solving the GDH problem with non-negligible probability.

12.1 Infeasibility of Forging Attacks

Let $(sc,\hat{A},\hat{B},X_{0},Y_{0})$ be the test session for whose tuple $\mathcal{M}$ outputs a correct guess. $sc$ can fall under one of the following three cases:

$sc=\mathsf{TPM\_ALG\_ECDH}$. 2. 2.

$sc=\mathsf{TPM\_ALG\_ECMQV}$. 3. 3.

$sc=\mathsf{TPM\_ALG\_SM2}$.

As $\mathcal{M}$ succeeds with non-negligible probability in the forging attack, there is at least one of the above three cases that occurs with non-negligible probability. We assume that $\mathcal{M}$ operates in an environment that involves at most $n$ parties and each party participates in at most $k$ sessions. We analyze the three cases separately in the following.

12.1.1 Analysis of Case 1

For this case, we build a GDH solver $\mathcal{S}_{5}$. It takes as input a pair $(A,B)$, creates an experiment which includes $n$ honest parties and the attacker $\mathcal{M}$, and is given access to a DDH oracle $DDH$. $\mathcal{S}_{5}$ randomly decides whether each party is protected by the TPM or not, randomly selects two parties $\hat{A}$ and $\hat{B}$ from the honest parties and sets their public keys to be $A$ and $B$ respectively. All the other parties compute their keys normally. Furthermore, $\mathcal{S}_{5}$ randomly selects an integer $i\in[1,...,k]$. The simulation for $\mathcal{M}$’s environment proceeds as follows.

$\mathcal{S}_{5}$ models $\mathsf{ephem}_{P}()$ following the description in Section 5 for all parties protected by the TPM. $\mathcal{M}$ sets the types of all long-term keys. If the type of $A$ is not $\mathsf{TPM\_ALG\_ECDH}$, $\mathcal{S}_{5}$ aborts. $\mathcal{S}_{5}$ creates oracles modeling the two-phase key exchange functionalities for parties protected by the TPM normally except parties $\hat{A}$ and $\hat{B}$. The procedures of $H_{1}()$ and $H_{2}()$ are described below. $avf()$ and $avf^{\prime}()$ are simulated as random oracles in the usual way. 2. 1.

Initiate$(sc,\hat{P_{1}},\hat{P_{2}})$: $\hat{P_{1}}$ executes the Initiate() activation of the protocol. However, if the session being created is the $i$-th session at $\hat{A}$, $\mathcal{S}_{5}$ checks whether $sc=\mathsf{TPM\_ALG\_ECDH}$ and $\hat{P_{2}}=\hat{B}$. If not, $\mathcal{S}_{5}$ aborts. 3. 2.

Respond$(sc,\hat{P_{1}},\hat{P_{2}},Y)$: With the exception of $\hat{A}$ and $\hat{B}$ (whose behaviors we explain below), $\hat{P_{1}}$ executes the Respond() activation of the protocol. However, if the session being created is the $i$-th session at $\hat{A}$, $\mathcal{S}_{5}$ checks whether $sc=\mathsf{TPM\_ALG\_ECDH}$ and $\hat{P_{2}}=\hat{B}$. If not, $\mathcal{S}_{5}$ aborts. 4. 3.

Complete$(sc,\hat{P_{1}},\hat{P_{2}},X,Y)$: With the exception of $\hat{A}$ and $\hat{B}$ (whose behaviors we explain below), $\hat{P_{1}}$ executes the Complete() activation of the protocol. However, if the session is the $i$-th session at $\hat{A}$, $\mathcal{S}_{5}$ completes the session without computing a session key. 5. 4.

Establish$(\hat{P},P)$: $\mathcal{S}_{5}$ creates the party $\hat{P}$ whose public key is $P$ and marks $\hat{P}$ as corrupted. 6. 5.

If $\hat{A}$ is protected by the TPM, with the input $(sc,keyA,ctr_{x},P,Y)$, $\mathcal{S}_{5}$ creates the oracle $\mathcal{O}^{\mathsf{EC}}_{A}$ as follows: compute the session key $k=H_{spec}(\hat{A},\hat{P},X,Y)$. $H_{spec}()$ is simulated as a random oracle. 7. 6.

Respond$(sc,\hat{A},\hat{P},Y)$:

1. (a)

If $\hat{A}$ is protected by the TPM, $\mathcal{S}_{5}$ simulates this session activation with the help of $\mathsf{ephem}_{A}()$ and $\mathcal{O}^{\mathsf{EC}}_{A}$. 2. (b)

If $\hat{A}$ is not protected by the TPM, $\mathcal{S}_{5}$ generates an ephemeral key pair $(x,X=g^{x})$, outputs $X$, and computes the session key $k=H_{spec}(\hat{A},\hat{B},X,Y)$. 8. 7.

Complete$(sc,\hat{A},\hat{P},X,Y)$:

1. (a)

If $\hat{A}$ is protected by the TPM, $\mathcal{S}_{5}$ simulates this session activation with the help of $\mathsf{ephem}_{A}()$ and $\mathcal{O}^{\mathsf{EC}}_{A}$. 2. (b)

If $\hat{A}$ is not protected by the TPM, $\mathcal{S}_{5}$ computes the session key $k=H_{spec}(\hat{A},\hat{P},X,Y)$. 9. 8.

If $\hat{B}$ is protected by the TPM, with the input $(sc,keyB,ctr_{y},P,X)$, $\mathcal{S}_{5}$ creates the oracle modeling the two-phase key exchange functionality for party $\hat{B}$: recover the ephemeral key pair $(y,Y=g^{y})$ by $ctr_{y}$, and compute the session key $k=H_{spec}(\hat{B},\hat{P},Y,X)$. 10. 9.

Respond$(sc,\hat{B},\hat{P},X)$:

1. (a)

If $\hat{B}$ is protected by the TPM, $\mathcal{S}_{5}$ simulates this session activation with the help of $\mathsf{ephem}_{B}()$ and the oracle for $\hat{B}$ (Step 8). 2. (b)

If $\hat{B}$ is not protected by the TPM, $\mathcal{S}_{5}$ simulates this session activation as follows: generate an ephemeral key pair $(y,Y=g^{y})$, output $Y$, and compute the session key $k=H_{spec}(\hat{B},\hat{P},Y,X)$. 11. 10.

Complete$(sc,\hat{B},\hat{P},Y,X)$:

1. (a)

If $\hat{B}$ is protected by the TPM, $\mathcal{S}_{5}$ simulates this session activation with the help of $\mathsf{ephem}_{B}()$ and the oracle for $\hat{B}$ (Step 8). 2. (b)

If $\hat{B}$ is not protected by the TPM, $\mathcal{S}_{5}$ sets the session key to be $k=H_{spec}(\hat{B},\hat{P},Y,X)$. 12. 11.

SessionStateReveal($s$): $\mathcal{S}_{5}$ returns to $\mathcal{M}$ the session state of session $s$. However, if $s$ is the $i$-th session at $\hat{A}$, $\mathcal{S}_{5}$ aborts. 13. 12.

SessionKeyReveal($s$): $\mathcal{S}_{5}$ returns to $\mathcal{M}$ the session key of $s$. If $s$ is the $i$-th session at $\hat{A}$, $\mathcal{S}_{5}$ aborts. 14. 13.

Corruption($\hat{P}$): $\mathcal{S}_{5}$ gives $\mathcal{M}$ the long-term key pair of $\hat{P}$. If $\mathcal{M}$ tries to corrupt $\hat{A}$ or $\hat{B}$, $\mathcal{S}_{5}$ aborts. 15. 14.

$H_{1}(\sigma)$ function for some $\sigma=(Z_{1},Z_{2},\hat{P_{1}},\hat{P_{2}},X,Y)$ proceeds as follows:

1. (a)

If $\hat{P_{1}}=\hat{A}$, $\hat{P_{2}}=\hat{B}$, and $DDH(A,B,Z_{1})=1$, $\mathcal{S}_{5}$ aborts $\mathcal{M}$ and succeeds by outputting CDH$(A,B)=Z_{1}$. 2. (b)

If the value of the function on input $\sigma$ has been defined previously, return it. 3. (c)

If the value of $H_{spec}()$ on input $(\hat{P_{1}},\hat{P_{2}},X,Y)$ has been defined previously, return it. 4. (d)

Pick a random key $k\in_{R}\{0,1\}^{\lambda}$, and define $H_{1}(\sigma)=k$. 16. 15.

$H_{2}(\sigma)$ function for some $\sigma=(Z,\hat{P_{1}},\hat{P_{2}})$ proceeds as follows:

1. (a)

If the value of the function on input $\sigma$ has been defined previously, return it. 2. (b)

If not defined, go over all the previous calls to $H_{spec}()$ and for each previous call of the form $H_{spec}(\hat{P_{1}},\hat{P_{2}},X,Y)=v$ proceed as follows according to the type of $P_{1}$.

1. i.

Case $\mathsf{TPM\_ALG\_ECMQV}$: check if $DDH(XP_{1}^{d},YP_{2}^{e},Z^{1/h})=1$ where $d=avf(X)$ and $e=avf(Y)$; if the condition holds, return $v$. 2. ii.

Case $\mathsf{TPM\_ALG\_SM2}$: check if $DDH(P_{1}X^{d},P_{2}Y^{e},Z^{1/h})=1$ where $d=avf^{\prime}(X)$ and $e=avf^{\prime}(Y)$; if the condition holds, return $v$. 3. (c)

If no previous calls of that form are found, pick a random key $w$ and define $H_{2}(Z,\hat{P_{1}},\hat{P_{2}})=w$. 17. 16.

$H_{spec}(\hat{P_{1}},\hat{P_{2}},X,Y)$ function proceeds as follows:

1. (a)

If the value of the function on that input has been defined previously, return it. 2. (b)

If not defined, proceed as follows according to the type of $P_{1}$.

1. i.

Case $\mathsf{TPM\_ALG\_ECDH}$: go over all the previous calls to $H_{1}()$ and for each previous call of the form $H_{1}(Z_{1},Z_{2},\hat{P_{1}},\hat{P_{2}},X,Y)=v$ check if $DDH(P_{1},P_{2},Z_{1})=1$; if the condition holds, return $v$. 2. ii.

Case $\mathsf{TPM\_ALG\_ECMQV}$: go over all the previous calls to $H_{2}()$ and for each previous call of the form $H_{2}(Z,\hat{P_{1}},\hat{P_{2}})=v$ check if $DDH(XP_{1}^{d},YP_{2}^{e},Z^{1/h})=1$ where $d=avf(X)$ and $e=avf(Y)$; if the condition holds, return $v$. 3. iii.

Case $\mathsf{TPM\_ALG\_SM2}$: go over all the previous calls to $H_{2}()$ and for each previous call of the form $H_{2}(Z,\hat{P_{1}},\hat{P_{2}})=v$ check if $DDH(P_{1}X^{d},P_{2}Y^{e},Z^{1/h})=1$ where $d=avf^{\prime}(X)$ and $e=avf^{\prime}(Y)$; if the condition holds, return $v$. 3. (c)

If not found, pick a random key $w$, define $H_{spec}(\hat{P_{1}},\hat{P_{2}},X,Y)=w$.

Proof.

The probability that $\mathcal{M}$ sets the type of $A$ to be $\mathsf{TPM\_ALG\_ECDH}$ and selects the $i$-th session at $\hat{A}$ and the peer of the test session is party $\hat{B}$ is at least $\frac{1}{3n^{2}k}$. Suppose that this indeed the case: the type of $A$ is $\mathsf{TPM\_ALG\_ECDH}$, so $\mathcal{S}_{5}$ does not abort in Step 0; $\mathcal{M}$ is not allowed to corrupt $\hat{A}$ and $\hat{B}$, make SessionStateReveal and SessionKeyReveal queries to the $i$-th session at $\hat{A}$, so $\mathcal{S}_{5}$ does not abort in Step 1, 2, 11, 12, 13. Therefore, $\mathcal{S}_{5}$ simulates $\mathcal{M}$’s environment perfectly. Thus, if $\mathcal{M}$ wins with non-negligible probability in this case, the success probability of $\mathcal{S}_{5}$ is bounded by

$Pr(\mathcal{S}_{5})\geq\frac{1}{3n^{2}k}Pr(\mathcal{M})$.

$\hfill\blacksquare$ ∎

12.1.2 Analysis of Case 2

We build a GDH solver $\mathcal{S}_{6}$ for this case. $\mathcal{S}_{6}$ takes as input a pair $(X_{0},B)$, creates an experiment which includes $n$ honest parties and the attacker $\mathcal{M}$, and is given access to a DDH oracle $DDH$. $\mathcal{S}_{6}$ randomly decides whether each party is protected by the TPM or not, randomly selects a party and sets its public key to be $B$. All the other parties compute their keys normally. Furthermore, $\mathcal{S}_{6}$ randomly selects an integer $i\in[1,...,k]$. The simulation for $\mathcal{M}$’s environment proceeds as follows.

$\mathcal{S}_{6}$ models $\mathsf{ephem}_{P}()$ following the description in Section 5 for all parties protected by the TPM. $\mathcal{M}$ sets the types of all long-term keys. If the type of $B$ is not $\mathsf{TPM\_ALG\_ECMQV}$, $\mathcal{S}_{6}$ aborts. $\mathcal{S}_{6}$ creates oracles modeling the two-phase key exchange functionalities for parties protected by the TPM normally except $\hat{B}$. The procedures of $H_{1}()$ and $H_{2}()$ are described below. $avf()$ and $avf^{\prime}()$ are simulated as random oracles in the usual way. 2. 1.

Initiate$(sc,\hat{P_{1}},\hat{P_{2}})$: $\hat{P_{1}}$ executes the Initiate() activation of the protocol. However, if the session being created is the $i$-th session at $\hat{A}$, $\mathcal{S}_{6}$ checks whether $sc=\mathsf{TPM\_ALG\_ECMQV}$ and $\hat{P_{2}}=\hat{B}$. If so, $\mathcal{S}_{6}$ sets the ephemeral public key to be $X_{0}$, else $\mathcal{S}_{6}$ aborts. 3. 2.

Respond$(sc,\hat{P_{1}},\hat{P_{2}},Y)$: With the exception of $\hat{B}$ (whose behaviors we explain below), $\hat{P_{1}}$ executes the Respond() activation of the protocol. However, if the session being created is the $i$-th session at $\hat{A}$, $\mathcal{S}_{6}$ checks whether $sc=\mathsf{TPM\_ALG\_ECMQV}$ and $\hat{P_{2}}=\hat{B}$. If so, $\mathcal{S}_{6}$ sets the ephemeral public key to be $X_{0}$ and does not compute the session key, else $\mathcal{S}_{6}$ aborts. 4. 3.

Complete$(sc,\hat{P_{1}},\hat{P_{2}},X,Y)$: With the exception of $\hat{B}$, $\hat{P_{1}}$ executes the Complete() activation of the protocol. However, if the session is the $i$-th session at $\hat{A}$, $\mathcal{S}_{6}$ completes the session without computing a session key. 5. 4.

Establish$(\hat{P},P)$: $\mathcal{S}_{6}$ creates the party $\hat{P}$ whose public key is $P$, and marks $\hat{P}$ as corrupted. 6. 5.

If $\hat{B}$ is protected by the TPM, with the input $(sc,keyB,ctr_{y},P,X)$, $\mathcal{S}_{6}$ creates the oracle modeling the two-phase key exchange functionality for party $\hat{B}$: recover the ephemeral key pair $(y,Y=g^{y})$ by $ctr_{y}$, and compute the session key $k=H_{spec}(\hat{B},\hat{P},Y,X)$. 7. 6.

Respond$(sc,\hat{B},\hat{P},X)$:

1. (a)

If $\hat{B}$ is protected by the TPM, $\mathcal{S}_{6}$ simulates this session activation with the help of $\mathsf{ephem}_{B}()$ and the oracle for $\hat{B}$ (Step 5). 2. (b)

If $\hat{B}$ is not protected by the TPM, $\mathcal{S}_{6}$ simulates this session activation as follows: generate an ephemeral key pair $(y,Y=g^{y})$, output $Y$, and compute the session key $k=H_{spec}(\hat{B},\hat{P},Y,X)$. 8. 7.

Complete$(sc,\hat{B},\hat{P},Y,X)$:

1. (a)

If $\hat{B}$ is protected by the TPM, $\mathcal{S}_{6}$ simulates this session activation with the help of $\mathsf{ephem}_{B}()$ and the oracle for $\hat{B}$ (Step 5). 2. (b)

If $\hat{B}$ is not protected by the TPM, $\mathcal{S}_{6}$ sets the session key to be $k=H_{spec}(\hat{B},\hat{P},Y,X)$. 9. 8.

SessionStateReveal($s$): $\mathcal{S}_{6}$ returns to $\mathcal{M}$ the session state of session $s$. However, if $s$ is the $i$-th session at $\hat{A}$ or the matching session of it (if such a session exists), $\mathcal{S}_{6}$ aborts. 10. 9.

SessionKeyReveal($s$): $\mathcal{S}_{6}$ returns to $\mathcal{M}$ the session key of $s$. If $s$ is the $i$-th session at $\hat{A}$ or the matching session of it (if such a session exists), $\mathcal{S}_{6}$ aborts. 11. 10.

Corruption($\hat{P}$): $\mathcal{S}_{6}$ gives $\mathcal{M}$ the long-term key pair of $\hat{P}$. If $\mathcal{M}$ tries to corrupt $\hat{A}$ or $\hat{B}$, $\mathcal{S}_{6}$ aborts. 12. 11.

$H_{1}(\sigma)$ function for some $\sigma=(Z_{1},Z_{2},\hat{P_{1}},\hat{P_{2}},X,Y)$ proceeds as follows:

1. (a)

If the value of the function on input $\sigma$ has been defined previously, return it. 2. (b)

If the value of $H_{spec}()$ on input $(\hat{P_{1}},\hat{P_{2}},X,Y)$ has been defined previously, return it. 3. (c)

Pick a random key $k\in_{R}\{0,1\}^{\lambda}$, and define $H_{1}(\sigma)=k$. 13. 12.

$H_{2}(\sigma)$ function for some $\sigma=(Z,\hat{P_{1}},\hat{P_{2}})$ proceeds as follows:

1. (a)

If the value of the function on input $\sigma$ has been defined previously, return it. 2. (b)

If not defined, go over all the previous calls to $H_{spec}()$ and for each previous call of the form $H_{spec}(\hat{P_{1}},\hat{P_{2}},X,Y)=v$ proceed as follows according to the type of $P_{1}$.

1. i.

Case $\mathsf{TPM\_ALG\_ECMQV}$: check if $DDH(XP_{1}^{d},YP_{2}^{e},Z^{1/h})=1$ where $d=avf(X)$ and $e=avf(Y)$; if the condition holds, return $v$. 2. ii.

Case $\mathsf{TPM\_ALG\_SM2}$: check if $DDH(P_{1}X^{d},P_{2}Y^{e},Z^{1/h})=1$ where $d=avf^{\prime}(X)$ and $e=avf^{\prime}(Y)$; if the condition holds, return $v$. 3. (c)

If not found, pick a random key $w$ and define $H_{2}(Z,\hat{P_{1}},\hat{P_{2}})=w$. 14. 13.

$H_{spec}(\hat{P_{1}},\hat{P_{2}},X,Y)$ function proceeds as follows:

1. (a)

If the value of the function on that input has been defined previously, return it. 2. (b)

If not defined, proceed as follows according to the type of $P_{1}$.

1. i.

Case $\mathsf{TPM\_ALG\_ECDH}$: go over all the previous calls to $H_{1}()$ and for each previous call of the form $H_{1}(Z_{1},Z_{2},\hat{P_{1}},\hat{P_{2}},X,Y)=v$ check if $DDH(P_{1},P_{2},Z_{1})=1$; if the condition holds, return $v$. 2. ii.

Case $\mathsf{TPM\_ALG\_ECMQV}$: go over all the previous calls to $H_{2}()$ and for each previous call of the form $H_{2}(Z,\hat{P_{1}},\hat{P_{2}})=v$ check if $DDH(XP_{1}^{d},YP_{2}^{e},Z^{1/h})=1$ where $d=avf(X)$ and $e=avf(Y)$; if the condition holds, return $v$. 3. iii.

Case $\mathsf{TPM\_ALG\_SM2}$: go over all the previous calls to $H_{2}()$ and for each previous call of the form $H_{2}(Z,\hat{P_{1}},\hat{P_{2}})=v$ check if $DDH(P_{1}X^{d},P_{2}Y^{e},Z^{1/h})=1$ where $d=avf^{\prime}(X)$ and $e=avf^{\prime}(Y)$; if the condition holds, return $v$. 3. (c)

If not found, pick a random key $w$ and define $H_{spec}(\hat{P_{1}},\hat{P_{2}},X,Y)=w$.

Proof.

The probability that $\mathcal{M}$ sets the type of $A$ to be $\mathsf{TPM\_ALG\_ECMQV}$ and selects the $i$-th session at $\hat{A}$ as the test session is at least $\frac{1}{3}\times\frac{1}{n^{2}k}=\frac{1}{3n^{2}k}$. Suppose that this is indeed the case: the type of $A$ is $\mathsf{TPM\_ALG\_ECMQV}$, so $\mathcal{S}_{6}$ does not abort in Step 0; $\mathcal{M}$ is not allowed to corrupt $\hat{A}$ and $\hat{B}$, make SessionStateReveal and SessionKeyReveal queries to the $i$-th session at $\hat{A}$ or its matching session (if such a session exists), so $\mathcal{S}_{6}$ does not abort in Step 1, 2, 8, 9, 10. Therefore, $\mathcal{S}_{6}$ simulates $\mathcal{M}$’s environment perfectly. If $\mathcal{M}$ wins the forging attack, he computes the 3-tuple $(Z,\hat{A},\hat{B})$. Without the knowledge of the private key $y$ of $Y$, $\mathcal{S}_{6}$ is unable to compute $CDH(X_{0},B)$. $\mathcal{S}_{6}$ computes $T=\frac{Z^{1/h}}{B^{a}Y_{0}^{ae}}$ where $d=avf(X_{0})$ and $e=avf(Y_{0})$.

Following the Forking Lemma [50] approach, $\mathcal{S}_{6}$ runs $\mathcal{M}$ on the same input and same coin flips but with carefully modified answers to the $avf()$ queries. Note that $\mathcal{M}$ must have queried $avf(Y_{0})$ in its first run because otherwise $\mathcal{M}$ would be unable to compute $Z$ of the test session. For the second run of $\mathcal{M}$, $\mathcal{S}_{6}$ responds to $avf(Y_{0})$ with a value $e^{\prime}\neq e$ selected uniformly at random. If $\mathcal{M}$ succeeds in the second run, $\mathcal{S}_{6}$ computes $T^{\prime}=\frac{Z^{1/h}}{B^{a}Y_{0}^{ae^{\prime}}}$. And thereafter $\mathcal{S}_{6}$ computes $CDH(X_{0},B)=(T^{\prime}/T)^{e-e^{\prime}}$. Thus, if $\mathcal{M}$ wins with non-negligible probability in this case, the success probability of $\mathcal{S}_{6}$ is bounded by:

$Pr(\mathcal{S}_{6})\geq\frac{C}{3n^{2}k}Pr(\mathcal{M})$

where $C$ is a constant arising from the use of the Forking Lemma. $\hfill\blacksquare$ ∎

12.1.3 Analysis of Case 3

The analysis of Case 3 is similar to Case 2. It is easy to get a full proof by following the analysis in Section 12.1.2, so we omit the analysis of Case 3.

12.2 Infeasibility of Key-replication Attacks

If $\mathcal{M}$ successfully launches a key-replication attack against the test session $s=(sc,\hat{A},\hat{B},X_{0},Y_{0})$, he succeeds in establishing a session $s^{\prime}=(sc^{\prime},\hat{A}^{\prime},\hat{B}^{\prime},X^{\prime},Y^{\prime})$, which is different than $s$ and $(sc,\hat{B},\hat{A},Y_{0},X_{0})$ (the matching session of $s$) but has the same key as the test session $s$. The $sc$ of $s^{\prime}$ must fall under one of the following three cases. By demonstrating that key-replication attacks are impossible in any of the three cases, we prove that $\mathcal{M}$ cannot launch key-replication attacks.

$sc=\mathsf{TPM\_ALG\_ECDH}$. 2. 2.

$sc=\mathsf{TPM\_ALG\_ECMQV}$. 3. 3.

$sc=\mathsf{TPM\_ALG\_SM2}$.

12.2.1 Analysis of Case 1

The analysis of this case is the same as the analysis in Section 7.2.1 for $\mathsf{tpm.KE}$.

12.2.2 Analysis of Case 2

We prove that key-replication attacks are impossible in this case by showing that a successful key-replication attack would allow the attacker to launch forging attacks, contradicting the GDH assumption. We build a GDH solver $\mathcal{S}_{7}$ for this case. $\mathcal{S}_{7}$ takes as input a pair $(X_{0},B)$, simulates a similar environment for $\mathcal{M}$ as $\mathcal{S}_{6}$ does (Section 12.1.2) except the simulation of session activations at $\hat{B}$ and the SessionStateReveal query.

• •

If $\hat{B}$ is protected by the TPM, $\mathcal{S}_{7}$ models $\mathsf{ephem}_{B}()$ and $\mathcal{O}^{\mathsf{MQV}}_{B}$ as follows:

• –

$\mathcal{S}_{7}$ creates a Table $T$ and models $\mathsf{ephem}_{B}()$ as follows.

Randomly choose $e,s\in Z_{q}$. 2. 2.

Set $Y=g^{s}/B^{e}$ and $e=avf(Y)$. 3. 3.

Randomly choose an index $ctr$, and add a record $(ctr,e,s,Y,-)$ to $T$. 4. 4.

Return $ctr$ and $Y$.

• –

With the input $(sc,keyB,ctr_{y},P,X)$, $\mathcal{S}_{7}$ models $\mathcal{O}^{\mathsf{MQV}}_{B}$ as follows:

Check whether (1) $sc=\mathsf{TPM\_ALG\_ECMQV}$, (2) $P$ and $X$ are on the curve associated with $B$, and (3) the last element of the record in $T$ indexed by $ctr_{y}$ is ‘$-$’. If the above checks succeed, continue, else return an error. 2. 2.

Suppose the entry in $T$ indexed by $ctr_{y}$ is $(ctr_{y},e,s,Y,-)$, set $Z_{1}=(XP^{d})^{hs}$ where $d=avf(X)$, and set the last element of the entry to be $\times$. 3. 3.

Compute the session key $k=H_{2}(Z_{1},\hat{B},\hat{P})$, and return $k$.

• •

Initiate$(sc,\hat{B},\hat{P})$:

• –

If $\hat{B}$ is protected by the TPM, $\mathcal{S}_{7}$ simulates this session activation with the help of $\mathsf{ephem}_{B}()$.

• –

If $\hat{B}$ is not protected by the TPM, $\mathcal{S}_{7}$ simulates this session activation as follows with the help of a Table $T^{\prime}$:

Randomly choose $e,s\in Z_{q}$. 2. 2.

Set $Y=g^{s}/B^{e}$ and $e=avf(Y)$. 3. 3.

Add an entry $(e,s,Y,-)$ to $T^{\prime}$. 4. 4.

Output $Y$.

• •

Respond$(sc,\hat{B},\hat{P},X)$:

If $\hat{B}$ is protected by the TPM, $\mathcal{S}_{7}$ simulates this session activation with the help of $\mathsf{ephem}_{B}()$ and $\mathcal{O}^{\mathsf{MQV}}_{B}$. 2. 2.

If $\hat{B}$ is not protected by the TPM, $\mathcal{S}_{7}$ simulates this session activation as follows:

1. (a)

Randomly choose $e,s\in Z_{q}$. 2. (b)

Set $Y=g^{s}/B^{e}$ and $e=avf(Y)$. 3. (c)

Compute $Z_{1}=(XP^{d})^{hs}$ where $d=avf(X)$. 4. (d)

Output $Y$, and compute the session key $k=H_{2}(Z_{1},\hat{B},\hat{P})$.

• •

Complete$(sc,\hat{B},\hat{P},Y,X)$:

If $\hat{B}$ is protected by the TPM, $\mathcal{S}_{7}$ simulates this session activation with the help of $\mathsf{ephem}_{B}()$ and $\mathcal{O}^{\mathsf{MQV}}_{B}$. 2. 2.

If $\hat{B}$ is not protected by the TPM, $\mathcal{S}_{7}$ proceeds as follows:

1. (a)

Check whether (1) $sc=\mathsf{TPM\_ALG\_ECMQV}$, (2) $P$ and $X$ are on the curve associated with $B$, and (3) the last element of the record in $T^{\prime}$ indexed by $Y$ is ‘$-$’. If the above checks succeed, continue, else return an error. 2. (b)

Suppose the entry in $T^{\prime}$ indexed by $Y$ is $(e,s,Y,-)$, set $Z_{1}=(XP^{d})^{hs}$ where $d=avf(X)$, set the last element of the entry to be $\times$, and compute the session key $k=H_{2}(Z_{1},\hat{B},\hat{P})$.

• •

SessionStateReveal$(s)$: $\mathcal{S}_{7}$ returns $\mathcal{M}$ the session key of $s$. Besides, $\mathcal{S}_{7}$ also returns the 3-tuple $\sigma=(Z-1,\hat{P_{1}},\hat{P_{2}})$. The reason that $\mathcal{S}_{7}$ can return the 3-tuple $\sigma$ of $s$ to $\mathcal{M}$ is that in the above simulation of session activations at $\hat{B}$, we compute the 3-tuple $\sigma$ of each session, and for other parties, $\mathcal{S}_{7}$ is also able to compute the 3-tuple $\sigma$ of each session.

Proof.

As $\mathcal{S}_{7}$ provides $\mathcal{M}$ with the 3-tuple $\sigma$ of all exposed sessions, $\mathcal{M}$ can query $s^{\prime}$ to obtain the 3-tuple $\sigma^{\prime}$ of $s^{\prime}$ which equals $\sigma$ of the test session $s$. This means that $\mathcal{M}$ successfully gets the 3-tuple of the test session $s$ without exposing $s$ or its matching session, namely, $\mathcal{M}$ can launch the forging attack. We have proved that if $\mathcal{M}$ can launch forging attacks, we can build a GDH solver $\mathcal{S}_{6}$. So $\mathcal{S}_{7}$ can leverage $\mathcal{S}_{6}$ to solve the CDH problem: $CDH(X_{0},B)=\mathcal{S}_{6}(X_{0},B)$. $\hfill\blacksquare$ ∎

12.2.3 Analysis of Case 3

The analysis of Case 3 is similar to Case 2, and it can be easily completed following the analysis of Case 2.

13 Further Security Properties of $\mathsf{tpm.KE.rev}$

In this section, we analyze the KCI-resistance and weak PFS (wPFS) security properties of $\mathsf{tpm.KE.rev}$.

13.1 Resistance to KCI Attacks

The KCI-resistance property means that even if the attacker $\mathcal{M}$ has obtained the long-term key of party $\hat{A}$, he cannot impersonate other parties to $\hat{A}$. We show that the Full UM protocol cannot achieve this security property by the following attack: $\mathcal{M}$ generates an ephemeral key pair $(y,Y=g^{y})$ and initiates a session with $\hat{A}$ as the identity of $\hat{B}$; after receiving $Y$, $\hat{A}$ generates its ephemeral key pair $(x,X=g^{x})$ and computes its session key $k=H_{1}(B^{a},Y^{x},\hat{A},\hat{B},X,Y)$; $\mathcal{M}$ can also compute the session key of $\hat{A}$: $k=H_{1}(B^{a},X^{y},\hat{A},\hat{B},X,Y)$. We now prove that the MQV and SM2 key exchange protocols of $\mathsf{tpm.KE.rev}$ can achieve the KCI-resistance property.

Lemma 9*.*

Under the GDH assumption, the MQV and SM2 key exchange protocols of $\mathsf{tpm.KE.rev}$ resist KCI attacks.

Proof.

Lemma 9 can be easily proved by slightly modifying the proof of MQV and SM2 key exchange protocols in Section 12. The only change to the proof in Section 12 is that all GDH solvers used to prove the security of MQV and SM2 key exchange protocols do not abort when $\mathcal{M}$ corrupts $\hat{A}$. The proof remains valid because the above abort operations are not used in the proof (we add the abort of GDH solvers when $\hat{A}$ is corrupted for compliance with the notion of the session exposure in the security model). $\hfill\blacksquare$ ∎

13.2 Weak Perfect Forward Secrecy

Hrawczyk has proved that the implicitly AKE protocols cannot achieve the full PFS property and can only achieve weak PFS [17]: only the session keys that are established without the active involvement of the attacker enjoy PFS property.

Lemma 10*.*

Under the CDH assumption, $\mathsf{tpm.KE.rev}$ provides weak PFS.

Proof.

Here we only outline the idea of the proof of Lemma 10, and the full proof can be completed following the proof in Section 12. We construct a CDH solver $\mathcal{S}_{8}$ if $\mathcal{M}$ successfully breaks the weak PFS security property. Let $X$ and $Y$ be the inputs to $\mathcal{S}_{8}$, and the goal of $\mathcal{S}_{8}$ is to compute $CDH(X,Y)$. $\mathcal{S}_{8}$ simulates the environment for $\mathcal{M}$ as follows: it sets all parties’ long-term keys and chooses a random guess for the test session of the distinguishing game. We call the guessed session the g-session, denote the owner and the peer of the test session by $\hat{A}$ and $\hat{B}$ respectively, and denote their long-term private keys by $a$ and $b$, respectively. $\mathcal{S}_{8}$ sets the incoming and outgoing messages in the g-session to be $X$ and $Y$. If $\mathcal{M}$ does choose the g-session as the test session and wins the distinguish game, he must compute the tuple $\sigma$ of the test session in his run. We proceed to show that no matter what the type of $A$ is, $\mathcal{S}_{8}$ can compute $CDH(X,Y)$, i.e., $g^{xy}$.

Case $\mathsf{TPM\_ALG\_ECDH}$: $\sigma$ equals $(Z_{1},Z_{2},\hat{A},\hat{B},X,Y)$ where $Z_{2}=g^{xy}$. 2. 2.

Case $\mathsf{TPM\_ALG\_ECMQV}$: $\sigma$ equals $(Z,\hat{A},\hat{B})$ where $Z=g^{h(x+da)(y+eb)}$; since $\mathcal{S}_{8}$ knows $a$ and $b$, he can compute $g^{xy}$. 3. 3.

Case $\mathsf{TPM\_ALG\_SM2}$: $\sigma$ equals $(Z,\hat{A},\hat{B})$ where $Z=g^{h(a+dx)(b+ey)}$; since $\mathcal{S}_{8}$ knows $a$ and $b$, he can compute $g^{xy}$.

$\hfill\blacksquare$ ∎

14 Conclusion

In this paper, we present a formal analysis of the secure communication interfaces of TPM 2.0 in a unified way. We construct a security model which takes account of the protections of the TPM on keys and protocols’ computation environments and eliminates group representation attacks existing in theory by measuring the entropy of the output of the $avf()$ and $avf^{\prime}()$ functions. The analysis results show that the current version of the key exchange primitive in TPM 2.0 can achieve the basic security property of modern security models, but its security is achieved under some impractical conditions: all devices in the network should be protected by the TPM, and security measures should be deployed to prevent sophisticated physical attacks, which can be used by attackers to obtain keys inside the TPM. Besides, the analysis results also show that the current version of the key exchange primitive in TPM 2.0 cannot achieve other security properties, such as KCI-resistance and weak PFS properties. We also give suggestions to engineers on how to use the key exchange primitive of TPM to implement key exchange protocols securely.

To eliminate the impractical conditions required by the TPM 2.0, we revise the key exchange primitive of TPM 2.0 and give a rigorous analysis of the revision. The analysis results show that our revision helps the key exchange primitive of TPM 2.0 not only enjoy the essential security property defined by modern AKE models in real-world networks but also achieve additional security properties: the MQV and SM2 key exchange protocols of TPM 2.0 enjoy the KCI-resistance property, and all the three protocols of TPM 2.0 enjoy the weak PFS property. Our revision only needs to modify one TPM command, and we give concrete suggestions on how to revise the TPM 2.0 specifications.

Acknowledgement

This work was supported by the National Natural Science Foundation of China (61802375, 61602325, 61876111, 61877040), the Project of Beijing Municipal Education Commission (KM20190028005), and the Open Research Fund of State Key Laboratory of Computer Architecture, ICT, CAS (CARCH201920).

Appendix A Kaliski’s UKS attack

We describe Kaliski’s UKS attack here to show how the attacker $\mathcal{M}$ successfully mounts the attack by cleverly computing its long-term private key $c$ and the ephemeral public key $X^{\prime}$.

$\hat{A}$ sends an ephemeral public key $X$ to $\hat{B}$. 2. 2.

$\mathcal{M}$ intercepts $X$. 3. 3.

$\mathcal{M}$ registers to the CA a key $C=g^{c}$ where $c$ is cleverly computed by the following steps:

1. (a)

Choose $u\in_{R}Z_{q}$; 2. (b)

Compute $d=avf(X)$, $X^{\prime}=XA^{d}g^{-u}$, $e=avf(X^{\prime})$, and $c=u/e$. 4. 4.

$\mathcal{M}$ sends $X^{\prime}$ to $\hat{B}$ as the identity of $\mathcal{M}$. 5. 5.

$\mathcal{M}$ relays the ephemeral key $Y$ from $\hat{B}$ to $\hat{A}$.

Note that $X^{\prime}C^{e}=XA^{d}$, and therefore the keys computed in sessions $(\hat{A},\hat{B},X,Y)$ and $(\hat{B},\mathcal{M},Y,X^{\prime})$ are identical.

Appendix B Xu’s attacks

Here we describe Xu’s two attacks on the SM2 key exchange protocol to show that in the first attack the attacker, $\mathcal{M}$ needs to register a specific long-term public key, and in the second attack, $\mathcal{M}$ needs to use the private key of $\hat{A}$ to perform some computations.

B.1 Attack I

$\mathcal{M}$ selects $u\in_{R}Z_{q}$, and registers a carefully computed public key $M=Ag^{u}$.

$\hat{A}$ sends an ephemeral public key $X$ to $\hat{B}$. 2. 2.

$\mathcal{M}$ intercepts $X$ and sends it to $\hat{B}$ as the identity of $\mathcal{M}$. 3. 3.

$\hat{B}$ sends its ephemeral public key $Y$ to $\mathcal{M}$, and computes $Z_{B}=(MX^{d})^{h(b+ey)}$ where $d=avf^{\prime}(X)$ and $e=avf^{\prime}(Y)$. 4. 4.

$\mathcal{M}$ forwards $Y$ to $\hat{A}$ as the identity of $\hat{B}$. $\hat{A}$ computes $Z_{A}=(BY^{e})^{h(a+dx)}$. 5. 5.

$\mathcal{M}$ corrupts $Z_{B}$ of session $(\hat{B},\mathcal{M},Y,X)$, and then $\mathcal{M}$ can compute $Z_{A}$ of session $(\hat{A},\hat{B},X,Y)$: $Z_{A}=Z_{B}/(BY^{e})^{hu}$, and $\mathcal{M}$ further derives the session key of $(\hat{A},\hat{B},X,Y)$.

Note that the above attack shows that the corruption of session $(\hat{B},\mathcal{M},Y,X)$ does affect the security of session $(\hat{A},\hat{B},X,Y)$, so the SM2 key exchange protocol cannot achieve the security defined by modern AKE security models.

B.2 Attack II

$\mathcal{M}$ first registers a legal key $M=g^{m}$.

$\hat{A}$ sends an ephemeral public key $X$ to $\hat{B}$. 2. 2.

$\mathcal{M}$ intercepts $X$ and sends $X^{\prime}=AX^{d}$ ($d=avf^{\prime}(X)$) to $\hat{B}$ as the identity of $\mathcal{M}$. 3. 3.

$\hat{B}$ sends an ephemeral public key $Y$ to $\mathcal{M}$ and computes $Z_{B}=(MX^{\prime d^{\prime}})^{h(b+ey)}$ where $d^{\prime}=avf^{\prime}(X^{\prime})$ and $e=avf^{\prime}(Y)$. 4. 4.

$\mathcal{M}$ forwards it to $\hat{A}$. $\hat{A}$ computes $Z_{A}=(BY^{e})^{h(a+dx)}$ where $d=avf^{\prime}(X)$ and $e=avf^{\prime}(Y)$. 5. 5.

$\mathcal{M}$ corrupts $Z_{B}$ of session $(\hat{B},\mathcal{M},Y,X^{\prime})$, computes $Z_{A}$ of session $(\hat{A},\hat{B},X,Y)$: $Z_{A}=(Z_{A}/(BY^{e})^{hm})^{d^{\prime-1}}$, and further derives the session key of $(\hat{A},\hat{B},X,Y)$.

Appendix C Group Representation Attack on MQV

For the benefit of the reader, we present the group representation attack on MQV here. Consider such a group $G$ that the representations of its elements satisfy that the $\lceil q/2\rceil$ LSBs of the representation of points’ $x$-coordinate are fixed. We use $c$ to denote the fixed value. In this case, the $Z$ value of MQV becomes $Z=g^{h(x+ca)(y+cb)}$. The attacker $\mathcal{M}$ can launch the following attack:

$\mathcal{M}$ randomly chooses $x^{*}\in_{R}Z_{q}$ and computes $X^{*}=g^{x^{*}}/A^{c}$. 2. 2.

$\mathcal{M}$ sends $X^{*}$ to $\hat{B}$ as the identity of $\hat{A}$. 3. 3.

$\hat{B}$ responds with $Y=g^{y}$, computes $Z=(X^{*}A^{c})^{h(y+cb)}$, and computes its session key $K=H_{2}(Z,\hat{A},\hat{B})$. 4. 4.

$\mathcal{M}$ can also compute the session key $K=H_{2}((YB^{c})^{hx^{*}},\hat{A},\hat{B})$.

The above attack shows that $\mathcal{M}$ can impersonate $\hat{A}$ without knowing the private key of $\hat{A}$ because of the special representations of the group elements.