[Paper Review] The Hsu-Harn-Mu-Zhang-Zhu group key establishment protocol is insecure

Chris J. Mitchell|arXiv (Cornell University)|Mar 14, 2018

Security in Wireless Sensor Networks2 references3 citations

TL;DR

This paper demonstrates a critical security vulnerability in the Hsu-Harn-Mu-Zhang-Zhu (HHMZZ) group key establishment protocol, showing that a malicious insider can forge a group key of their choice and trick a victim into accepting it. The attack exploits the protocol's reliance on a single, malleable authentication tag, rendering its claimed security properties—key confidentiality and authentication—entirely broken.

ABSTRACT

A significant security vulnerability in a recently published group key establishment protocol is described. This vulnerability allows a malicious insider to fraudulently establish a group key with an innocent victim, with the key chosen by the attacker. This shortcoming is sufficiently serious that the protocol should not be used.

Motivation & Objective

• To identify and analyze a fundamental security vulnerability in the HHMZZ group key establishment protocol.
• To demonstrate that the protocol fails to provide key authentication and confidentiality under a malicious insider threat model.
• To show that the protocol's security claims are invalid due to a malleability issue in the authentication tag mechanism.
• To caution against the deployment of the HHMZZ protocol in practice due to its critical flaws.
• To highlight the broader issue of insufficient formal security modeling in cryptographic protocol design, especially in group key establishment.

Proposed method

• The attack assumes a malicious insider user $U_m$ who can intercept and modify the final broadcast from the Key Generation Centre (KGC) to a victim user $U_v$.
• The attacker intercepts the KGC's broadcast containing the authentication tag $\text{Auth}$, $r_0$, and group key shares $u_i$.
• The attacker selects a desired group key $S^*$ and recomputes the victim's share as $u_v^* = u_v - S + S^*$ to maintain consistency.
• The attacker forges a new authentication tag $\text{Auth}^*$ using $S^*$ and $u_v^*$, while keeping all other inputs unchanged.
• The modified broadcast is sent to the victim, who verifies $\text{Auth}^*$ and computes the forged key $S^*$, which is accepted as valid.
• The attack succeeds because the verification process does not bind the key $S$ to the individual user's secret $x_i$ in a way that prevents key substitution.

Experimental results

Research questions

• RQ1 Can a malicious insider in the HHMZZ protocol forge a group key of their choice while remaining undetected?
• RQ2 Does the protocol's authentication mechanism prevent key substitution attacks by insiders?
• RQ3 Why does the protocol fail to achieve key authentication despite its claimed security properties?
• RQ4 What specific design flaw in the authentication tag construction allows for key malleability?
• RQ5 To what extent do the absence of a formal security model and rigorous proof contribute to the protocol's vulnerabilities?

Key findings

• A malicious insider can completely replace the group key with any value of their choice, and the victim will accept it as valid.
• The attack succeeds because the authentication tag $\text{Auth}$ is computed over a linear combination of values, making it malleable under key substitution.
• The protocol's claim of key authentication is invalid, as an insider can forge a valid tag for a different key without knowledge of any user's long-term secret.
• The protocol fails to provide key confidentiality, as the attacker can force the victim to use a key they control.
• The vulnerability arises from the lack of binding between the group key $S$ and the individual user's secret $x_i$ in the authentication mechanism.
• The absence of a formal security model and rigorous proof in the original protocol design allowed this fundamental flaw to remain undetected.