5G serves as a catalyst for transformative digital innovation by enabling convergence with various services in our daily lives. The success of this paradigm shift undeniably hinges on robust security measures, with primary authentication— securing access to the 5G network—being paramount. Two protocols, 5G Authentication and Key Agreement (5G-AKA) and the Extensible Authentication Protocol for Authentication and Key Agreement Prime (EAP-AKA’), have been standardized for this purpose, with the former designed for 3rd Generation Partnership Project (3GPP) devices and the latter for non-3GPP devices. However, recent studies have exposed vulnerabilities in the 5G-AKA protocol, rendering it susceptible to security breaches, including linkability attacks. Furthermore, the advent of quantum computing poses significant quantum threats, underscoring the urgent need for the adoption of quantum-resistant cryptographic mechanisms. Although post-quantum cryptography (PQC) is being standardized, the lack of real-world deployment limits its proven robustness. In contrast, conventional cryptographic schemes have demonstrated reliability over decades of practical application. To address this gap, the Internet Engineering Task Force (IETF) has initiated the standardization of hybrid PQC algorithms (HPQC), combining classical and quantum-resistant techniques. Consequently, ensuring forward secrecy and resilience to quantum threats in the 5G-AKA protocol is critical. To address these security challenges, we propose the 5G-AKA-HPQC protocol. Our protocol is designed to maintain compatibility with existing standards while enhancing security by combining keys negotiated via the Elliptic Curve Integrated Encryption Scheme (ECIES) with those derived from a PQC-Key Encapsulation Mechanism (KEM). To rigorously and comprehensively validate the security of 5G-AKA-HPQC, we employ formal verification tools such as SVO Logic and ProVerif. The results confirm the protocol’s security and correctness. Furthermore, performance evaluations highlight the computational and communication overheads inherent to 5G-AKA-HPQC. With only average of 56.5 millisecond(+112.32%) on a total authentication time, proposed protocol provides its advantages. Also, on a environment of multiple UE registration, compared to single UE registration, the difference of increased rate of average authentication time is only 0.01%. The negligible difference 0.01% indicates that the addition of PQC does not lead to increased overhead in multi-UE registration environments, demonstrating its scalability and practical feasibility. In conclusion, our research provides significant insights into the design of secure, quantum-safe authentication protocols and lays the groundwork for the future standardization of secure authentication and key agreement protocols for mobile telecommunications.

PSA (Platform Security Architecture) Certified is a security certification scheme for IoT hardware, software, and devices. The scheme is composed of security certification (PSA Certified Level 1/2/3) and functional API certification (PSA Certified Functional API). Up to now, this scheme has been adopted by many chip manufacturers, system/software developers, and OEMs (Original Equipment Manufacturers). In this paper, we investigate the PSA security certification and PSA functional API (Cryptography API, Storage API, and Attestation API) with its reference implementation. Also, we analyze the source code of the reference implementation by using Polyspace Bug Finder. Specifically, we found 1,385 coding defects in the PSA functional API reference implementation where high, medium, and low impact defects take up 44, 90, and 1,251, respectively. Then, we compare the PSA functional API and its reference implementation in several aspects. Throughout this paper, we explain the obtained analysis results and our findings in detail.

In this paper, we revisit the simplified PWIBS-AKE (Sim-PWIBS) protocol [7] constructed from password authentication and identity-based signature. First, we show that the Sim-PWIBS protocol is insecure meaning that a malicious KGC (Key Generation Center) can find out session keys and all clients' passwords by impersonating the server. Then, we propose two secure simplified PWIBS-AKE (called, PAKEwIBS1 and PAKEwIBS2) protocols that prevents such malicious KGC's passive/active attacks. Also, we show that there is a trade-off between the PAKEwIBS1 and PAKEwIBS2 protocols in terms of computation costs of client and communication costs.

A PAKR (Password-Authenticated Key Retrieval) protocol and its multi-server system allow one party (say, client), who has a memorable password, to retrieve a long-term static key in an exchange of messages with at least one other party (say, server) that has a private key associated with the password. In this paper, we analyze the only PAKR (named as PKRS-1) standardized in IEEE 1363.2 [9] and its multi-server system (also, [12] ) by showing that any passive/active attacker can find out the client’s password and the static key with off-line dictionary attacks. This result contradicts the security claims made for PKRS-1 (see Clause 10.2 of IEEE 1363.2 [9] ).

Authenticated Key Exchange (AKE) protocol is one of the ways for establishing secure channels between two parties where they authenticate each other and share a common session key. In particular, some AKE protocols using passwords and high-entropy secrets (i.e., two-factor AKE) are preferable since they provide stronger authentication than one-factor authentication. However, existing two-factor AKE protocols never equip ability to distinguish on-line dictionary attacks from other events, such as client's password mis-typing and communication errors. This problem submerges a critical symptom of high-entropy-secret-leakage (since without it adversaries cannot perform the on-line dictionary attacks) or it forces the users inconvenience by letting them change their passwords frequently to reset the entropy of it that might be guessed partially by the on-line dictionary attacks. In this paper, we propose two general methods to distinguish online dictionary attacks (performed by an attacker) from other harmless events in the two-factor AKE protocols.

In this paper, we investigate the notion of partnership as found in security models for key exchange protocols. Several different approaches have been pursued to define partnership, with varying degrees of success. We aim to provide an overview and criticism of the various definitions and point out some pitfalls that can be encountered when trying to define partnership. As a result, we propose an intuitive way of defining partnership directly from equality of session keys. In addition, we show that authentication can be captured using a definition of partnership by equality of partner identifiers, and give proofs that both definitions achieve what we expect from them.

Anonymity and specifically sender anonymity have become essential requirements for many privacy-related applications (e.g. net counselling and whistle blowing). On the other hand, anonymity may be abused for various malicious activities (e.g. redistribution of copy-righted contents and illegal drug trading). In this paper, we address both by proposing protocols for authenticated anonymous communications channels. In such channels, the client can authenticate the authentication server while the latter can only authenticate the fact that the client is one of the qualified members that are eligible to use the network (e.g. WLAN hot spots, WiMAX). Our protocols are based on an efficient anonymous password-based authenticated key exchange protocol and on an anonymous IP address assignment and have the following advantages: (1) they can restrict the usage of the established anonymous channels to certain fair purposes; (2) they do not involve rerouting of the packets through a chain of intermediate nodes; (3) they are available right after registration of a normal password to an authentication server as for a classical non-anonymous authentication (e.g. EAP-TTLS and PEAP) and do not require any special registration procedures that would reveal initially to the authentication server that the client belongs to a small list of users of anonymous services. Each protocol fits in a different authentication framework (IEEE802.1x and PANA) and is different with respect to providing controlled IP address assignment.

The concept of personal networks is very user- centric and representative for the next generation networks. However, the present security mechanism is not considering at all what happens whenever a mobile node (device) is compromised, lost or stolen. This kinds of leakage of stored secrets has been a great danger in the field of communication security since it sometimes leads to the complete breakdown of the intended security level. In order to solve the problem, we propose a 3-way leakage-resilient and forward-secure authenticated key exchange (3LRFS-AKE) protocol and its security architecture for personal networks. The 3LRFS-AKE protocol guarantees not only forward secrecy of the shared key between device and its server but also a new additional layer of security against leakage of stored secrets. The security architecture includes two different types of communications: PN wide communication and communication between P-PANs of two different users.

A private-personal area network (P-PAN) is the very user-centric and basis component of personal networks. However, the current security mechanism is not robust against leakage of stored secrets that can happen when a mobile node (device) is compromised, lost or stolen. This results in unauthorized accesses to other devices and services. For that, this paper introduces a leakage-resilient and forward secure authenticated key exchange (LRFS-AKE) protocol and its usage in the relation to P-PANs. The LRFS-AKE protocol guarantees not only security against classical attacks but also a new additional layer of security against leakage of stored secrets

Network mobility introduces far more complexity than host mobility. To address the extensions needed for network mobility, the IETF NEMO working group has recently standardized the network mobility basic support protocol in RFC 3963. However, in this RFC, it is not mentioned how authentication authorization and accounting (AAA) issues are handled in NEMO environment. Also the use of IPsec to secure NEMO procedures does not provide robustness against leakage of stored secrets. To address this security issue and to achieve AAA with mobility, we propose new handover procedures to be performed by mobile routers and by visiting mobile nodes. These new handover procedures are based on leakage resilient-authenticated key establishment (LR-AKE) protocol.

Network mobility introduces far more complexity than host mobility. Therefore, host mobility protocols such as Mobile IPv6 (MIPv6) need to be extended to support this new type of mobility. To address the extensions needed for network mobility, the IETF NEMO working group has recently standardized the network mobility basic support protocol in RFC 3963. However, in this RFC, it is not mentioned how authentication authorization and accounting (AAA) issues are handled in NEMO environment. Also, the use of IPsec to secure NEMO procedures does not provide robustness against leakage of stored secrets. To address this security issue and to achieve AAA with mobility, we propose new handover procedures to be performed by mobile routers and by visiting mobile nodes. This new handover procedure is based on leakage resilient-authenticated key establishment (LR-AKE) protocol. Using analytical models, we evaluate the proposed handover procedure in terms of handover delay which affects the session continuity. Our performance evaluation is based on transmission, queueing and encryption delays over wireless links

Authenticated key exchange (AKE) protocols are designed to allow mutual authentication and generation of a cryptographically-secure session key. We revisit the conventional AKE protocols employed in IEEE 802.1x for wireless security considering the following situation: (1) a user has some insecure devices with built-in memory capacity; (2) the counterpart server is not perfectly secure; (3) neither PKI (public key infrastructure) nor TRM (tamper-resistant module) is available. In addition, the paper introduces a new kind of AKE protocol, which is secure against an active attacker in the above-mentioned situation, in order to enhance the overall security level and usability of passwords. For authenticity, the user's password is combined with an additional secret stored on insecure mobile devices. Nevertheless, the user remembers only one relatively short password while maintaining its connections with a variety of different servers.

The coupling of mobility and quality-of-service with security is a challenge that should be addressed in future wireless overlay systems. The mobility of a node can disrupt or even intermittently disconnect an ongoing real-time session because a secure handover must be performed to ensure continuous connectivity. The duration of the such interruptions is called disruption time or handover delay and can heavily affect the user satisfaction. The handover procedure needs to protect its integrity and confidentiality-otherwise, the packets may be rerouted to a malicious node and the legitimate handover may not be performed. The security procedure to ensure this should not lengthen significantly the handover delay to provide good quality real-time services. In this paper, we focus on the network-layer mobility, specifically, on Mobile Internet protocol version 6 (MIPv6) since it is the natural candidate for providing such mobility in future systems. To solve the problem of on-path attackers and prevent leakage of secrets, we propose a security architecture for MIPv6 based on leakage resilient-authenticated key establishment (LR-AKE) protocol and its cooperation with public key infrastructure. The proposed architecture prevents against on-path attackers which was not addressed in the specifications of MIPv6, and also provides robustness against leakage of secret values. Using analytical models, we evaluate MIPv6 handover delay for real-time services. We identify the crucial factors affecting the handover delay among transmission delays of MIPv6, security and LR-AKE messages, queueing delays and en/decryption delays.