Notes

References

[1] GB 15629.11-2003. Information technology–Telecommunications and information
exchange between systems–Local and metropolitan area networks–Specific
requirements–Part 11: Wireless LANMedium access control (MAC) and Physical
Layer(PHY) Specifications, 2003.

[2] GB 15629.11-2003-XG1-2006. Information technology–Telecommunications
and information exchange between systems–Local and metropolitan area
networks–Specific requirements–Part 11:Wireless LAN Medium Access Control(
MAC) and Physical Layer(PHY) specifications Amendment 1, 2006.

[3] GB 15629.1102-2003. Information technology–Telecommunications and information
exchange between systems–Local and metropolitan area networks–
Specific requirements–Part 11: Wireless LAN Medium Access Control (MAC)
and Physical Layer(PHY) Specifications: Higher-Speed Physical Layer Extension
in the 2.4 GHz Band, 2003.

[4] M. Abadi, B. Blanchet, and C. Fournet. Just fast keying in the pi calculus. In
D. A. Schmidt, editor, Programming Languages and Systems, 13th European
Symposium on Programming, ESOP 2004, volume 2986 of Lecture Notes in
Computer Science, pages 340–354. Springer, 2004.

[5] M. Abadi and A. D. Gordon. A calculus for cryptographic protocols: The spi
calculus. In ACM Conference on Computer and Communications Security,
pages 36–47, 1997.

[6] M. Abadi and P. Rogaway. Reconciling two views of cryptography (the computational
soundness of formal encryption). Journal of Cryptology, 15(2):103–
127, 2002.

[7] M. Abdalla, E. Bresson, O. Chevassut, and D. Pointcheval. Password-based
group key exchange in a constant number of rounds. In M. Yung, editor, Pro-
ceedings of the 9th International Workshop on Practice and Theory in Public
Key Cryptography, volume 3958 of Lecture Notes in Computer Science, pages
427–442. Springer, 2006.

[8] M. Abdalla, O. Chevassut, and D. Pointcheval. One-time verifier-based encrypted
key exchange. In V. Serge, editor, Proceedings of the 8th International
Workshop on Theory and Practice in Public Key, volume 3386 of Lecture Notes
in Computer Science, pages 47–64. Springer, 2005.

[9] M. Abdalla, P.-A. Fouque, and D. Pointcheval. Password-based authenticated
key exchange in the three-party setting. In V. Serge, editor, Proceedings of the
8th International Workshop on Theory and Practice in Public Key, volume
3386 of Lecture Notes in Computer Science, pages 65–84. Springer, 2005.

[10] M. Abdalla and D. Pointcheval. Simple password-based encrypted key exchange
protocols. In A. Menezes, editor, Topics in Cryptology — CT-RSA
2005, volume 3376 of Lecture Notes in Computer Science, pages 191–208.
Springer, 2005.

[11] G. Agnew, R. Mullin, and S. Vanstone. An interactive data exchange protocol
based on discrete exponentiation. In Advances in Cryptology — EU-
ROCRYPT 1988, volume 330 of Lecture Notes in Computer Science, pages
159–166. Springer, 1988.

[12] L. Ahn, M. Blum, N. Hopper, and J. Langford. CAPTCHA: Using hard
AI problems for security. In E. Biham, editor, Advances in Cryptology —
EUROCRYPT 2003, volume 2656 of Lecture Notes in Computer Science, pages
294–311. Springer, 2003.

[13] W. Aiello, S. M. Bellovin, M. B., R. Canetti, J. Ioannidis, A. D. Keromytis,
and O. Reingold. Just fast keying: Key agreement in a hostile internet. ACM
Trans. Inf. Syst. Secur., 7(2):242–273, 2004.

[14] WAPI Alliance. WAPI Implementation Plan. http://www.wapia.org, 2003.

[15] R. Anderson and T. Lomas. Fortifying key negotiation schemes with poorly
chosen passwords. Electronics Letters, 30(13):1040–1041, 1994.

[16] G. Ateniese, M. Steiner, and G. Tsudik. Authenticated group key agreement
and friends. In Proceedings of the 5th ACM conference on Computer and
communications security, pages 17–26. ACM Press, 1998.

[17] M. Backes and B. Pfitzmann. Relating symbolic and cryptographic secrecy. In
2005 IEEE Symposium on Security and Privacy, pages 171–182. IEEE Computer
Society, 2005.

[18] S. Bakhtiari, R. Safavi-Naini, and J. Pieprzyk. On password-based authenticated
key exchange using collisionful hash functions. In J. Pieprzyk and
J. Seberry, editors, Information Security and Privacy, First Australasian Con-
ference, ACISP’96, volume 1172 of Lecture Notes in Computer Science, pages
299–310. Springer, 1996.

[19] G. Barthe, J. Cederquist, and S. Tarento. A machine-checked formalization of
the generic model and the random oracle model. In Automated Reasoning —
Second International Joint Conference, IJCAR 2004, volume 3097 of Lecture
Notes in Computer Science, pages 385–399. Springer, 2004.

[20] R. Bauer, T. Berson, and R. Feiertag. A key distribution protocol using event
markers. ACM Trans. Comput. Syst., 1(3):249–255, 1983.

[21] J. A. Beachy and W. D. Blair. Abstract Algebra. Waveland Press, Inc., 3
edition, 2005.

[22] M. Bellare, A. Boldyreva, and A. Palacio. An uninstantiable random-oraclemodel
scheme for a hybrid-encryption problem. In C. Cachin and J. Camenisch,
editors, Advances in Cryptology — EUROCRYPT 2004, volume 3027
of Lecture Notes in Computer Science, pages 171–188. Springer, 2004.

[23] M. Bellare, R. Canetti, and H. Krawczyk. Keying hash functions for message
authentication. In N. Koblitz, editor, Advances in Cryptology — CRYPTO
1996, volume 1109 of Lecture Notes in Computer Science, pages 1–15. Springer,
1996.

[24] M. Bellare, R. Canetti, and H. Krawczyk. A modular approach to the design
and analysis of authentication and key exchange protocols (extended abstract).
In Proceedings of the thirtieth annual ACM symposium on Theory of comput-
ing, pages 419–428, 1998.

[25] M. Bellare, A. Desai, D. Pointcheval, and P. Rogaway. Relations among notions
of security for public-key encryption schemes. In H. Krawczyk, editor,
Advances in Cryptology — CRYPTO 1998, volume 1462 of Lecture Notes in
Computer Science, pages 26–45. Springer, 1998.

[26] M. Bellare and S. Goldwasser. Encapsulated key-escrow. Technical Report
MIT/LCS/TR-688, MIT LCS, 1996.

[27] M. Bellare and A. Palacio. The knowledge-of-exponent assumptions and 3-
round zero-knowledge protocols. In M. K. Franklin, editor, Advances in Cryp-
tology — CRYPTO 2004, volume 3152 of Lecture Notes in Computer Science,
pages 273–289. Springer, 2004.

[28] M. Bellare, D. Pointcheval, and P. Rogaway. Authenticated key exchange
secure against dictionary attacks. In B. Preneel, editor, Advances in Cryptology
— EUROCRYPT 2000, volume 1807 of Lecture Notes in Computer Science,
pages 139–155, 2000.

[29] M. Bellare and P. Rogaway. Entity authentication and key distribution. In
D. R. Stinson, editor, Advances in Cryptology — CRYPTO 1993, volume 773
of Lecture Notes in Computer Science, pages 110–125. Springer, 1993.

[30] M. Bellare and P. Rogaway. Random oracles are practical: a paradigm for
designing efficient protocols. In Proceedings of the 1st ACM conference on
Computer and communications security, pages 62–73. ACM Press, 1993.

[31] M. Bellare and P. Rogaway. Provably secure session key distribution: the three
party case. In Proceedings of the Twenty-Seventh Annual ACM Symposium
on Theory of Computing, pages 57–66. ACM Press, 1995.

[32] M. Bellare and P. Rogaway. Code-based game-playing proofs and the security
of triple encryption. Cryptology ePrint Archive: Report 2004/331, 2004.

[33] M. Beller, L. Chang, and Y. Yacobi. Security for personal communications
services: public-key vs. private key approaches. In Proceedings of the 3rd In-
ternational Symposium on personal, indoor and mobile radio communications,
pages 26–31. IEEE Press, 1992.

[34] M. Beller, L. Chang, and Y. Yacobi. Privacy and authentication on a portable
communications system. IEEE Journal on Selected Areas in Communications,
11(6):821–829, 1993.

[35] M. Beller and Y. Yacobi. Batch Diffie-Hellman key agreement systems and
their application to portable communications. In R. Rueppel, editor, Advances
in Cryptology — EUROCRYPT 1992, volume 658 of Lecture Notes in Com-
puter Science, pages 208–220. Springer, 1992.

[36] M. Beller and Y. Yacobi. Fully-fledged two-way public key authentication and
key agreementfor low-cost terminals. Electronics Letters, 29(11):999–1001,
1993.

[37] S. M. Bellovin and M. Merritt. Encrypted key exchange: Password-based
protocols secure against dictionary attacks. In Proceedings of the IEEE Sym-
posium on Security and Privacy, pages 72–84. IEEE Computer Society, 1992.

[38] S. M. Bellovin and M. Merritt. Augmented encrypted key exchange: A
password-based protocol secure against dictionary attacks and password file
compromise. In Proceedings of the First ACM Conference on Computer and
Communications Security, pages 244–250, 1993.

[39] K. Bentahar, P. Farshim, J. Malone-Lee, and N.P. Smart. Generic constructions
of identity-based and certificateless KEMs. Cryptology ePrint Archive:
Report 2005/058, 2005.

[40] R. Bird, I. S. Gopal, A. Herzberg, P. A. Janson, S. Kutten, R. Molva, and
M. Yung. Systematic design of two-party authentication protocols. In Ad-
vances in Cryptology — CRYPTO 1991, pages 44–61. Springer, 1992.

[41] T. E. Bjørstad and A.W. Dent. Building better signcryption schemes with tagkems.
In M. Yung, Y. Dodis, A. Kiayias, and T. Malkin, editors, Proceedings
of the 9th International Conference on Theory and Practice of Public-Key
Cryptography, volume 3958 of Lecture Notes in Computer Science, pages 491–
507. Springer, 2006.

[42] J. Black, P. Rogaway, and T. Shrimpton. Black-box analysis of the blockcipher-
based hash-function constructions from PGV. In M. Yung, editor, Ad-
vances in Cryptology — CRYPTO 2002, volume 2442 of Lecture Notes in
Computer Science, pages 320–335. Springer, 2002.

[43] S. Blake-Wilson, D. Johnson, and A. Menezes. Key agreement protocols and
their security analysis. In M. Darnell, editor, Proceedings of Cryptography and
Coding, 6th IMA International Conference, volume 1355 of Lecture Notes in
Computer Science, pages 30–45. Springer, 1997.

[44] S. Blake-Wilson and A. Menezes. Entity authentication and authenticated
key transport protocols employing asymmetric techniques. In B. Christianson,
B. Crispo, T. Lomas, and M. Roe, editors, Proceedings of Security Proto-
cols, 5th International Workshop, volume 1361 of Lecture Notes in Computer
Science, pages 137–158. Springer, 1997.

[45] S. Blake-Wilson and A. Menezes. Authenticated diffie-hellman key agreement
protocols. In S. E. Tavares and H. Meijer, editors, Proceedings of the Selected
Areas in Cryptography, volume 1556 of Lecture Notes in Computer Science,
pages 339–361. Springer, 1999.

[46] S. Blake-Wilson and A. Menezes. Unknown key-share attacks on the Stationto-
Station (STS) protocol. In H. Imai and Y. Zheng, editors, Proceedings
of the Second International Workshop on Practice and Theory in Public Key
Cryptography, volume 1560 of Lecture Notes in Computer Science, pages 154–
170. Springer, 1999.

[47] B. Blanchet. A computationally sound mechanized prover for security protocols.
In 2006 IEEE Symposium on Security and Privacy, pages 140–154. IEEE
Computer Society, 2006.

[48] B. Blanchet and D. Pointcheval. Provably secure threshold passwordauthenticated
key exchange. In C. Dwork, editor, Advances in Cryptology
— CRYPTO 2006, volume 4117 of Lecture Notes in Computer Science, pages
537–554. Springer, 2006.

[49] D. Boneh, C. Gentry, B. Lynn, and H. Shacham. Aggregate and verifiably
encrypted signatures from bilinear maps. In E. Biham, editor, Advances in
Cryptology — EUROCRYPT 2003, volume 2656 of Lecture Notes in Computer
Science, pages 416–432. Springer, 2003.

[50] D. Boneh and M. Naor. Timed commitments. In M. Bellare, editor, Advances
in Cryptology — CRYPTO 2000, pages 236–254. Springer, 2000.

[51] C. Boyd. Towards a classification of key agreement protocols. In proceedings
of the Eighth IEEE Computer Security Foundations Workshop, pages 38–43.
IEEE Computer Society, 1995.

[52] C. Boyd. A class of flexible and efficient key management protocols. In pro-
ceedings of the Ninth IEEE Computer Security Foundations Workshop, pages
2–8. IEEE Computer Society, 1996.

[53] C. Boyd. On key agreement and conference key agreement. In V. Varadharajan,
J. Pieprzyk, and Y. Mu, editors, Information Security and Privacy,
Second Australasian Conference, ACISP’97, volume 1270 of Lecture Notes in
Computer Science, pages 294–302. Springer, 1997.

[54] C. Boyd and A. Mathuria. Protocols for Authentication and Key Establish-
ment. Springer, 2004.

[55] C. Boyd and D. Park. Public key protocols for wireless communications. In
Proceedings of the 1st International Conference on Information Security and
Cryptology, pages 47–57. Korea Institute of Information Security and Cryptology
(KIISC), 1998.

[56] V. Boyko, P. D. MacKenzie, and S. Patel. Provably secure passwordauthenticated
key exchange using diffie-hellman. In B. Preneel, editor, Ad-
vances in Cryptology — EUROCRYPT 2000, volume 1807 of Lecture Notes in
Computer Science, pages 156–171. Springer, 2000.

[57] E. Bresson and D. Catalano. Constant round authenticated group key agreement
via distributed computation. In F. Bao, R. H. Deng, and J. Zhou,
editors, Proceedings of the 7th International Workshop on Practice and The-
ory in Public Key Cryptography, volume 2947 of Lecture Notes in Computer
Science, pages 115–129. Springer, 2004.

[58] E. Bresson, O. Chevassut, and D. Pointcheval. Dynamic group Diffie-Hellman
key exchange under standard assumptions. In L. R. Knudsen, editor, Ad-
vances in Cryptology — EUROCRYPT 2002, volume 2332 of Lecture Notes in
Computer Science, pages 321–336. Springer, 2002.

[59] E. Bresson, O. Chevassut, and D. Pointcheval. Group Diffie-Hellman key
exchange secure against dictionary attacks. In Y. Zheng, editor, Advances in
Cryptology — ASIACRYPT 2002, volume 2501 of Lecture Notes in Computer
Science, pages 497–514. Springer, 2002.

[60] E. Bresson, O. Chevassut, D. Pointcheval, and J.-J. Quisquater. Provably
authenticated group Diffie-Hellman key exchange. In Proceedings of the 8th
ACM Conference on Computer and Communications Security, pages 255–264.
ACM Press, 2001.

[61] M. Burmester and Y. Desmedt. A secure and efficient conference key distribution
system. In A. D. Santis, editor, Advances in Cryptology— EU-
ROCRYPT 1994, volume 950 of Lecture Notes in Computer Science, pages
275–286. Springer, 1994.

[62] M. Burmester and Y. Desmedt. A secure and efficient conference key distribution
system. In A. D. Santis, editor, Pre–Proceedings of EUROCRYPT 1994,
pages 279–290, 1994.

[63] M. Burmester and Y. Desmedt. A secure and scalable group key exchange
system. Inf. Process. Lett., 94(3):137–143, 2005.

[64] M. Burrows, M. Abadi, and R. Needham. A logic of authentication. In Proceed-
ings of the Twelfth ACM Symposium on Operating System Principles, pages
1–13, 1989.

[65] M. Burrows, M. Abadi, and R. Needham. A logic of authentication. ACM
Trans. Comput. Syst., 8(1):18–36, 1990.

[66] J. Byun and D. Lee. N-Party encrypted Diffie-Hellman key exchange using
different passwords. In J. Ioannidis, A. D. Keromytis, and M. Yung, editors,
Applied Cryptography and Network Security, Third International Conference,
Proceedings, volume 3531 of Lecture Notes in Computer Science, pages 75–90.
Springer, 2005.

[67] R. Canetti, S. Halevi, J. Katz, Y. Lindell, and P. D. MacKenzie. Universally
composable password-based key exchange. In R. Cramer, editor, Advances in
Cryptology — EUROCRYPT 2005, volume 3494 of Lecture Notes in Computer
Science, pages 404–421. Springer, 2005.

[68] R. Canetti and H. Krawczyk. Analysis of key-exchange protocols and their use
for building secure channels. In B. Pfitzmann, editor, Advances in Cryptology
— EUROCRYPT 2001, volume 2045 of Lecture Notes in Computer Science,
pages 453–474. Springer, 2001.

[69] U. Carlsen. Optimal privacy and authentication on a portable communications
system. Operating Systems Review, 28(3):16–23, 1994.

[70] J. Cathalo, B. Libert, and J.-J. Quisquater. Efficient and non-interactive
timed-release encryption. In S. Qing, W. Mao, J. Lopez, and G. Wang, editors,
Proceedings of the 7th International Conference on Information and Commu-
nications Security, volume 3783 of Lecture Notes in Computer Science, pages
291–303. Springer, 2005.

[71] A. C. F. Chan and I. F. Blake. Scalable, server-passive, user-anonymous timed
release cryptography. In Proceedings of the 25th IEEE International Confer-
ence on Distributed Computing Systems (ICDCS’05), pages 504–513. IEEE
Computer Society, 2005.

[72] D. Chaum and T. P. Pedersen. Wallet databases with observers. In E. F.
Brickell, editor, Advances in Cryptology — CRYPTO 1993, pages 89–105.
Springer, 1993.

[73] L. Chen, Z. Cheng, and N. Smart. Identity-based key agreement protocols
from pairings. Cryptology ePrint Archive: Report 2006/199, 2006.

[74] L. Chen, D. Gollmann, and C. J. Mitchell. Key distribution without individual
trusted authentification servers. In Proceedings of the Eighth IEEE Computer
Security Foundations Workshop, pages 30–36. IEEE Computer Society, 1995.

[75] L. Chen and C. Kudla. Identity based authenticated key agreement protocols
from pairings. In Proc. of the 16th IEEE Computer Security Foundations
Workshop, pages 219–233. IEEE Computer Society Press, 2003.

[76] L. Chen and Q. Tang. Bilateral unknown key-share attacks in key agreement
protocols. Cryptology ePrint Archive: Report 2007/209, 2007.

[77] J. Cheon and B. Jun. A polynomial time algorithm for the braid Diffie-
Hellman conjugacy problem. In D. Boneh, editor, Advances in Cryptology
— CRYPTO 2003, volume 2729 of Lecture Notes in Computer Science, pages
212–225. Springer, 2003.

[78] O. Chevassut, P. Fouque, P. Gaudry, and D. Pointcheval. The twist-augmented
technique for key exchange. In M. Yung, Y. Dodis, A. Kiayias, and T. Malkin,
editors, Proceedings of the 9th International Conference on Theory and Prac-
tice of Public-Key Cryptography, volume 3958 of Lecture Notes in Computer
Science, pages 410–426. Springer, 2006.

[79] K. Choi, J. Hwang, D. Lee, and I. Seo. Id-based authenticated key agreement
for low-power mobile devices. In C. Boyd and J. M. Gonz´alez Nieto, editors,
Information Security and Privacy, 10th Australasian Conference, Proceedings,
volume 3574 of Lecture Notes in Computer Science, pages 494–505. Springer,
2005.

[80] K. Y. Choi, J. Y. Hwang, and D. H. Lee. Efficient ID-based group key agreement
with bilinear maps. In F. Bao, R. Deng, and J. Y. Zhou, editors, Pro-
ceedings of the 2004 International Workshop on Practice and Theory in Public
Key Cryptography, volume 2947 of Lecture Notes in Computer Science, pages
130–144. Springer, 2004.

[81] K. R. Choo, C. Boyd, and Y. Hitchcock. Errors in computational complexity
proofs for protocols. In B. Roy, editor, Advances in Cryptology — ASI-
ACRYPT 2005, volume 3788 of Lecture Notes in Computer Science, pages
624–643. Springer, 2005.

[82] K. R. Choo, C. Boyd, and Y. Hitchcock. Examining indistinguishability-based
proof models for key establishment protocols. In B. Roy, editor, Advances in
Cryptology — ASIACRYPT 2005, volume 3788 of Lecture Notes in Computer
Science, pages 585–604. Springer, 2005.

[83] K. R. Choo and Y. Hitchcock. Security requirements for key establishment
proof models: Revisiting bellare-rogaway and Jeong-Katz-Lee protocols. In
C. Boyd and J. Nieto, editors, Information Security and Privacy, 10th Aus-
tralasian Conference, Proceedings, volume 3574 of Lecture Notes in Computer
Science, pages 429–442. Springer, 2005.

[84] R. Cramer and V. Shoup. Design and analysis of practical public-key encryption
schemes secure against adaptive chosen ciphertext attack. SIAM Journal
on Computing, 33(1):167–226, 2004.

[85] G. D. Crescenzo, R. Ostrovsky, and S. Rajagopalan. Conditional oblivious
transfer and timed-release encryption. In J. Stern, editor, Advances in Cryp-
tology — EUROCRYPT 1999, volume 1592 of Lecture Notes in Computer
Science, pages 74–89. Springer, 1999.

[86] J. Daemen and V. Rijmen. The Design of Rijndael: AES — The Advanced
Encryption Standard. Springer, 2002.

[87] Ivan Damg°ard. Towards practical public key systems secure against chosen
ciphertext attacks. In J. Feigenbaum, editor, Advances in Cryptology —
CRYPTO 1991, volume 576 of Lecture Notes in Computer Science, pages 445–
456. Springer, 1991.

[88] D. Denning and G. Sacco. Timestamps in key distribution protocols. Commun.
ACM, 24(8):533–536, 1981.

[89] A. W. Dent. Hybrid signcryption schemes with outsider security. In J. Zhou,
J. Lopez, R. H. Deng, and F. Bao, editors, Proceedings of the 8th International
Information Security Conference, volume 3650 of Lecture Notes in Computer
Science, pages 203–217. Springer, 2005.

[90] A. W. Dent and Q. Tang. Revisiting the security model for timed-release
public-key encryption with pre-open capability. Cryptology ePrint Archive:
Report 2006/306, 2006.

[91] A. W. Dent and Q. Tang. Revisiting the security model for timed-release
encryption with pre-open capability. In J. A. Garay, A. K. Lenstra, M. Mambo,
and R. Peralta, editors, Information Security, 10th International Conference,
ISC 2007, volume 4779 of Lecture Notes in Computer Science, pages 158–174.
Springer, 2007.

[92] A. Desai. The security of all-or-nothing encryption: Protecting against exhaustive
key search. In M. Bellare, editor, Advances in Cryptology — CRYPTO
2000, volume 1880 of Lecture Notes in Computer Science, pages 359–375.
Springer, 2000.

[93] D.Harkins and D. Carrel. The Internet Key Exchange (IKEv2) Protocol. IETF
RFC 2409, 1998.

[94] T. Dierks and C. Allen. The TLS protocol version 1.0. IETF RFC 2246, 1999.

[95] W. Diffie andM. Hellman. New directions in cryptography. IEEE Transactions
on Information Theory, IT-22(6):644–654, 1976.

[96] W. Diffie, P. Oorschot, and M. Wiener. Authentication and authenticated key
exchanges. Des. Codes Cryptography, 2(2):107–125, 1992.

[97] X. J. Du, Y. Wang, J. H. Ge, and Y. M. Wang. ID-based authenticated
two round multiparty key agreement. Cryptology ePrint Archive: Report
2003/247, 2003.

[98] X. J. Du, Y. Wang, J. H. Ge, and Y. M. Wang. An improved ID-based authenticated
group key agreement scheme. Cryptology ePrint Archive, Report
2003/260, 2003.

[99] R. Dutta and R. Barua. Password-based Encrypted Group Key Agreement.
International Journal of Network Security, 3(1):30–41, 2006.

[100] C. Dwork and M. Naor. Pricing via processing or combatting junk mail. In
E. F. Brickell, editor, Advances in Cryptology — CRYPTO 1992, volume 740
of Lecture Notes in Computer Science, pages 139–147. Springer, 1992.

[101] S. Even and Y. Mansour. A construction of a cipher from a single pseudorandom
permutation. In H. Imai, R. L. Rivest, and T. Matsumoto, editors,
Advances in Cryptology — ASIACRYPT 1991, volume 739 of Lecture Notes
in Computer Science, pages 210–224. Springer, 1993.

[102] R. Gennaro and Y. Lindell. A framework for password-based authenticated
key exchange. In E. Biham, editor, Advances in Cryptology — EUROCRYPT
2003, volume 2656 of Lecture Notes in Computer Science, pages 524–543.
Springer, 2003.

[103] M. Girault. Self-certified public keys. In D. Davies, editor, Advances in Cryp-
tology — EUROCRYPT 1991, volume 547 of Lecture Notes in Computer Sci-
ence, pages 490–497. Springer, 1991.

[104] O. Goldreich. The Foundations of Cryptography, volume 2. Cambridge University
Press, 2004.

[105] O. Goldreich and Y. Lindell. Session-key generation using human passwords
only. In J. Kilian, editor, Advances in Cryptology — CRYPTO 2001, volume
2139 of Lecture Notes in Computer Science, pages 408–432. Springer, 2001.

[106] S. Goldwasser and Y. T. Kalai. On the (in)security of the Fiat-Shamir
paradigm. In Proceedings of the 44th Symposium on Foundations of Com-
puter Science, pages 102–115. IEEE Computer Society, 2003.

[107] S. Goldwasser and S. Micali. Probabilistic encryption and how to play mental
poker keeping secret all partial information. In Proceedings of the Fourteenth
Annual ACM Symposium on Theory of Computing, pages 365–377. ACM,
1982.

[108] L. Gong. Using one-way functions for authentication. SIGCOMM Comput.
Commun. Rev., 19(5):8–11, 1989.

[109] L. Gong. Increasing availability and security of an authentication service.
IEEE Journal on Selected Areas in Communications, 11(5):657–662, 1993.

[110] L. Gong. Lower bounds on messages and rounds for network authentication
protocols. In ACM Conference on Computer and Communications Security,
pages 26–37, 1993.

[111] L. Gong, T. Lomas, R. Needham, and J. Saltzer. Protecting poorly chosen
secrets from guessing attacks. IEEE Journal on Selected Areas in Communi-
cations, 11(5):648–656, 1993.

[112] C. G¨unther. An identity-based key-exchange protocol. In J. Quisquater and
J. Vandewalle, editors, Advances in Cryptology — EUROCRYPT 1989, volume
434 of Lecture Notes in Computer Science, pages 29–37. Springer, 1990.

[113] Y. Lee H. Lee, H. Lee. An authenticated group key agreement protocol on
braid groups. Cryptology ePrint Archive: Report 2003/018, 2005.

[114] S. Halevi and H. Krawczyk. Public-key cryptography and password protocols.
In ACM Conference on Computer and Communications Security, pages 122–
131, 1998.

[115] S. Halevi and H. Krawczyk. A plausible approach to computer-aided cryptographic
proofs. Cryptology ePrint Archive, Report 2005/181, 2005.

[116] L. Harn and H. Y. Lin. Authenticated key agreement without using oneway
hash functions. Electronics Letters, 37(10):1429–1431, 2001.

[117] J. Herranz and J. L. Villar. An Unbalanced Protocol for Group Key Exchange.
In TrustBus 2004, volume 3184 of Lecture Notes in Computer Science, pages
172–180. Springer, 2004.

[118] S. Hirose and S. Yoshida. An authenticated diffie-hellman key agreement
protocol secure against active attacks. In H. Imai and Y. Zheng, editors,
Proceedings of the first International Workshop on Practice and Theory in
Public Key Cryptography, volume 1431 of Lecture Notes in Computer Science,
pages 135–148. Springer, 1998.

[119] Y. Hitchcock, C. Boyd, and J. Nieto. Tripartite key exchange in the canettikrawczyk
proof model. In A. Canteaut and K. Viswanathan, editors, Advances
in Cryptology — INDOCRYPT 2003, volume 3348 of Lecture Notes in Com-
puter Science, pages 17–32. Springer, 2004.

[120] Y. Hitchcock, C. Boyd, and J. Manuel Gonz´alez Nieto. Modular proofs for
key exchange: rigorous optimizations in the canetti-krawczyk model. Appl.
Algebra Eng. Commun. Comput., 16(6):405–438, 2006.

[121] C. A. R. Hoare. Communicating sequential processes. Commun. ACM,
21(8):666–677, 1978.

[122] G. Horn, K.M.Martin, and C. J.Mitchell. Authentication protocols for mobile
network environment value-added services. IEEE Transactions on Vehicular
Technology, 51(2):383–392, 2002.

[123] G. Horn and B. Preneel. Authentication and payment in future mobile systems.
Journal of Computer Security, 8(2/3), 2000.

[124] M. S. Hwang, J. W. Lo, and S. C. Lin. An efficient user identification scheme
based on ID-based cryptosystem. Computer Standards & Interfaces, 26:565–
569, 2004.

[125] Y. Hwang, D. Yum, and P. Lee. Timed-release encryption with pre-open
capability and its application to certified e-mail system. In J. Zhou, J. Lopez,
R. Deng, and F. Bao, editors, Proceedings of the 8th International Information
Security Conference, volume 3650 of Lecture Notes in Computer Science, pages
344–358. Springer, 2005.

[126] I. Ingemarsson, D. Tang, and C. Wong. A conference key distribution system.
IEEE Transactions on Information Theory, 28(5):714–720, 1982.

[127] Institute of Electrical and Electronics Engineers, Inc. IEEE P1363.2 draft
D20, Standard Specifications for Password-Based Public-Key Cryptographic
Techniques, March 2005.

[128] International Organization for Standardization. ISO/IEC 9797–2, Informa-
tion technology – Security techniques – Message Authentication Codes (MACs)
– Part 2: Mechanisms using a dedicated hash-function, 1999.

[129] International Organization for Standardization. ISO/IEC 11770–4, Informa-
tion technology — Security techniques — Key management — Part 4: Mech-
anisms based on weak secrets, 2006.

[130] D. P. Jablon. Strong password-only authenticated key exchange. Computer
Communication Review, 26(5):5–26, 1996.

[131] D. P. Jablon. Extended password key exchange protocols immune to dictionary
attack. In Proceedings of the 1997 Workshop on Enterprise Security, pages
248–255, 1997.

[132] M. Jakobsson and D. Pointcheval. Mutual authentication for low-power mobile
devices. In P. F. Syverson, editor, Financial Cryptography, 5th International
Conference, volume 2339 of Lecture Notes in Computer Science, pages 178–
195. Springer, 2001.

[133] P. Janson and G. Tsudik. Secure and minimal protocols for authenticated key
distribution. Computer Communications, 18(9):645–653, 1995.

[134] ´E. Jaulmes, A. Joux, and F. Valette. On the security of randomized CBC-MAC
beyond the birthday paradox limit: A new construction. In J. Daemen and
V. Rijmen, editors, Fast Software Encryption, 9th International Workshop,
volume 2365 of Lecture Notes in Computer Science, pages 237–251. Springer,
2002.

[135] I. Jeong, J. Katz, and D. Lee. One-round protocols for two-party authenticated
key exchange. In M. Jakobsson, M. Yung, and J. Zhou, editors, Applied
Cryptography and Network Security, Second International Conference, volume
3089 of Lecture Notes in Computer Science, pages 220–232. Springer, 2004.

[136] J. E. Johnson, D. E. Langworthy, L. Lamport, and F. H. Vogt. Formal specification
of a web services protocol. Electr. Notes Theor. Comput. Sci., 105:147–
158, 2004.

[137] A. M. Johnston and P. Gemmell. Authenticated key exchange provably secure
against the man-in-the-middle attack. Journal of Cryptology, 15(2):139–148,
2002.

[138] A. Joux. A one round protocol for tripartite diffie-hellman. Journal of Cryp-
tology, 17(4):263–276, 2004.

[139] M. J. Jacobson Jr., R. Scheidler, and H. C. Williams. An improved
real-quadratic-field-based key exchange procedure. Journal of Cryptology,
19(2):211–239, 2006.

[140] A. Juels and J. Brainard. Client puzzles: A cryptographic defense against connection
depletion. Networks and Distributed Security Systems (NDSS 1999),
pages 1168–1177, 1999.

[141] M. Just and S. Vaudenay. Authenticated multi-party key agreement. In K. Kim
and T. Matsumoto, editors, Advances in Cryptology — ASIACRYPT 1996,
volume 1163 of Lecture Notes in Computer Science, pages 36–49. Springer,
1996.

[142] J. Katz, P. D. MacKenzie, G. Taban, and V. D. Gligor. Two-server passwordonly
authenticated key exchange. In J. Ioannidis, A. D. Keromytis, and
M. Yung, editors, Applied Cryptography and Network Security, Third Inter-
national Conference, Proceedings, volume 3531 of Lecture Notes in Computer
Science, pages 1–16, 2005.

[143] J. Katz, R. Ostrovsky, and M. Yung. Efficient password-authenticated key
exchange using human-memorable passwords. In B. Pfitzmann, editor, Ad-
vances in Cryptology — EUROCRYPT 2001, volume 2045 of Lecture Notes in
Computer Science, pages 475–494. Springer, 2001.

[144] J. Katz and J. Shin. Modeling insider attacks on group key-exchange protocols.
Cryptology ePrint Archive: Report 2005/163, 2005.

[145] J. Katz and M. Yung. Scalable protocols for authenticated group key exchange.
In D. Boneh, editor, Advances in Cryptology — CRYPTO 2003, volume 2729
of Lecture Notes in Computer Science, pages 110–125. Springer, 2003.

[146] S. Kent. IP Authentication Header. IETF RFC 4302, 2005.

[147] S. Kent. IP Encapsulating Security Payload (ESP). IETF RFC 4303, 2005.

[148] J. Kilian and P. Rogaway. How to protect DES against exhaustive key search
(an analysis of DESX). Journal of Cryptology, 14(1):17–35, 2001.

[149] K. Ko, S. Lee, J. Cheon, J. Han, J. Kang, and C. Park. New public-key
cryptosystem using braid groups. In M. Bellare, editor, Advances in Cryptology
— CRYPTO 2000, volume 1880 of Lecture Notes in Computer Science, pages
166–183. Springer, 2000.

[150] N. Koblitz. Elliptic curve cryptosystems. Mathematics of Computation,
48:203–207, 1987.

[151] K. Koyama. Secure conference key distribution schemes for conspiracy attack.
In R. Rueppel, editor, Advances in Cryptology — EUROCRYPT 1992, volume
330 of Lecture Notes in Computer Science, pages 449–453. Springer, 1992.

[152] K. Koyama and K. Ohta. Identity-based conference key distribution systems.
In C. Pomerance, editor, Advances in Cryptology — CRYPTO 1987, volume
283 of Lecture Notes in Computer Science, pages 175–184. Springer, 1988.

[153] K. Koyama and K. Ohta. Security of improved identity-based conference key
distribution systems. In C. G¨unther, editor, Advances in Cryptology — EU-
ROCRYPT 1988, volume 330 of Lecture Notes in Computer Science, pages
11–19. Springer, 1988.

[154] H. Krawczyk. Skeme: a versatile secure key exchange mechanism for internet.
In Proceedings of the 1996 Symposium on Network and Distributed System
Security, pages 114–127. IEEE Computer Society, 1996.

[155] H. Krawczyk. HMQV: A high-performance secure diffie-hellman protocol. In
Victor Shoup, editor, Advances in Cryptology — CRYPTO 2005, volume 3621
of Lecture Notes in Computer Science, pages 546–566. Springer, 2005.

[156] H. Krawczyk, M. Bellare, and R. Canetti. HMAC: Keyed-Hashing for Message
Authentication. IETF RFC 2104, 1997.

[157] C. Kudla and K. G. Paterson. Modular security proofs for key agreement
protocols. In B. K. Roy, editor, Advances in Cryptology — ASIACRYPT 2005,
volume 3788 of Lecture Notes in Computer Science, pages 549–565. Springer,
2005.

[158] T. Kwon. Practical authenticated key agreement using passwords. In K. Zhang
and Y. Zheng, editors, Proceedings of the 7th Information Security Conference,
volume 3225 of Lecture Notes in Computer Science, pages 1–12. Springer, 2004.

[159] T. Kwon and J. Song. Efficient and secure password-based authentication
protocols against guessing attacks. Computer Communications, 21(9):853–
861, 1998.

[160] T. Kwon and J. Song. Efficient key exchange and authentication protocols
protecting weak secrets. IEICE Transactions Fundamentals, E81-A(1):156–
163, 1998.

[161] T. Kwon and J. Song. Secure agreement scheme for gxy via password authentication.
Electronics Letters, 35(11):892–893, 1999.

[162] C. S. Laih, L. Ding, and Y. M. Huang. Password-only authenticated key
establishment protocol without public key cryptography. Electronics Letters,
41(4):185–186, 2005.

[163] P. Laud. Handling encryption in an analysis for secure information flow. In
P. Degano, editor, Proceedings of the 12th European Symposium on Program-
ming, volume 2618 of Lecture Notes in Computer Science, pages 159–173.
Springer, 2003.

[164] P. Laud. Symmetric encryption in automatic analyses for confidentiality
against active adversaries. In 2004 IEEE Symposium on Security and Pri-
vacy, pages 71–85. IEEE Computer Society, 2004.

[165] K. Lauter and A. Mityagin. Security analysis of KEA authenticated key exchange
protocol. In M. Yung, Y. Dodis, A. Kiayias, and T. Malkin, editors,
Proceedings of the 9th International Conference on Theory and Practice of
Public-Key Cryptography, volume 3958 of Lecture Notes in Computer Science,
pages 378–394. Springer, 2006.

[166] H. Lee, K. Ha, and K. Ku. ID-based multi-party authenticated key agreement
protocols from multilinear forms. In J. Zhou, J. Lopez, R. H. Deng,
and F. Bao, editors, Information Security, 8th International Conference Pro-
ceedings, volume 3650 of Lecture Notes in Computer Science, pages 104–117.
Springer, 2005.

[167] H. Lee, D. Won, K. Sohn, and H. Yang. Efficient 3-pass password-based key
exchange protocol with low computational cost for client. In J. Song, editor,
Information Security and Cryptology — ICISC 1999, volume 1787 of Lecture
Notes in Computer Science, pages 147–155. Springer, 1999.

[168] W. B. Lee and K. C. Liao. Constructing identity-based cryptosystems for
discrete logarithm based cryptosystems. Journal of Network and Computer
Applications, 27:191–199, 2004.

[169] X. Li, S. Moon, and J. Ma. On the security of the authentication module
of chinese WLAN standard implementation plan. In J. Zhou, M. Yung, and
F. Bao, editors, Applied Cryptography and Network Security, 4th International
Conference, Proceedings, volume 3989 of Lecture Notes in Computer Science,
pages 340–348, 2006.

[170] C. Lim and P. Lee. Several practical protocols for authentication and key
exchange. Inf. Process. Lett., 53(2):91–96, 1995.

[171] C. Lin, H. Sun, and T. Hwang. Three-party encrypted key exchange: Attacks
and a solution. Operating Systems Review, 34(4):12–20, 2000.

[172] T. Lomas, L. Gong, J. Saltzer, and R. Needham. Reducing risks from poorly
chosen keys. ACM SIGOPS Operating Systems Review, 23(5):14–18, 1989.

[173] T. Lomas, L. Gong, J. Saltzer, and R. Needham. Reducing risks from poorly
chosen keys. In Proceedings of the Twelfth ACM Symposium on Operating
System Principles, pages 14–18, 1989.

[174] G. Lowe. An attack on the needham-schroeder public-key authentication protocol.
Inf. Process. Lett., 56(3):131–133, 1995.

[175] G. Lowe. Breaking and fixing the Needham-Schroeder public-key protocol
using FDR. In T. Margaria and B. Steffen, editors, Tools and Algorithms
for Construction and Analysis of Systems, Second International Workshop,
volume 1055 of Lecture Notes in Computer Science, pages 147–166. Springer,
1996.

[176] G. Lowe. Some new attacks upon security protocols. In Ninth IEEE Com-
puter Security Foundations Workshop, pages 162–169. IEEE Computer Society,
1996.

[177] S. Lu and S. A. Smolka. Model checking the secure electronic transaction
(SET) protocol. In Proceedings of the 7th International Symposium on Mod-
eling, Analysis and Simulation of Computer and Telecommunication Systems,
pages 358–365. IEEE Computer Society, 1999.

[178] S. Lucks. Open key exchange: How to defeat dictionary attacks without encrypting
public keys. In B. Christianson, B. Crispo, T. Lomas, and M. Roe,
editors, Proceedings of the 5th International Workshop on Security Protocols,
pages 79–90. Springer, 1997.

[179] P. MacKenzie. More efficient password-authenticated key exchange. In D. Naccache,
editor, Topics in Cryptology — CT-RSA 2001, volume 2020 of Lecture
Notes in Computer Science, pages 361–377. Springer, 2001.

[180] P. MacKenzie. On the security of the SPEKE password-authenticated key
exchange protocol. http://eprint.iacr.org/2001/057, 2001.

[181] P. MacKenzie, S. Patel, and R. Swaminathan. Password-authenticated key
exchange based on RSA. In T. Okamoto, editor, Advances in Cryptology —
ASIACRYPT 2000, volume 1976 of Lecture Notes in Computer Science, pages
599–613. Springer, 2000.

[182] P. D. MacKenzie, T. Shrimpton, and M. Jakobsson. Threshold passwordauthenticated
key exchange. Journal of Cryptology, 19(1):27–66, 2006.

[183] M. Mambo and H. Shizuya. A note on the complexity of breaking okamototanaka
ID-based key exchange scheme. In Proceedings of the First Interna-
tional Workshop on Practice and Theory in Public Key Cryptography, pages
258–262. Springer, 1998.

[184] M. Mambo and H. Shizuya. A note on the complexity of breaking okamototanaka
ID-based key exchange scheme. IEICE Trans. Commun., E82-
A(61):77–80, 2000.

[185] K. Matsuura and H. Imai. Modification of internet key exchange resistant
against denial-of-service. In Pre-Proc. of Internet Workshop 2000, pages 167–
174, 2000.

[186] T. May. Time-release crypto, 1993.

[187] A. Mayer and M. Yung. Secure protocol transformation via “expansion”: from
two-party to groups. In Proceedings of the 6th ACM conference on Computer
and communications security, pages 83–92. ACM Press, 1999.

[188] C. Meadows and P. F. Syverson. A formal specification of requirements for
payment transactions in the SET protocol. In R. Hirschfeld, editor, Financial
Cryptography, Second International Conference, Proceedings, volume 1465 of
Lecture Notes in Computer Science, pages 122–140. Springer, 1998.

[189] A. J. Menezes, M. Qu, and S. A. Vanstone. Some new key agreement protocols
providing mutual implicit authentication. In Workshop on selected areas in
cryptography (SAC 1995), pages 22–32, 1995.

[190] A. J. Menezes, P. C. van Oorschot, and S. A. Vanstone. Handbook of Applied
Cryptography. CRC Press, 1997.

[191] R. C. Merkle. Secure communications over insecure channels. Commun. ACM,
21(4):294–299, 1978.

[192] R. C. Merkle. One way hash functions and DES. In G. Brassard, editor,
Advances in Cryptology — CRYPTO 1989, volume 435 of Lecture Notes in
Computer Science, pages 428–446. Springer, 1990.

[193] D. Micciancio and B. Warinschi. Soundness of formal encryption in the presence
of active adversaries. In M. Naor, editor, Proceedings of the First Theory
of Cryptography Conference, volume 2951 of Lecture Notes in Computer Sci-
ence, pages 133–151. Springer, 2004.

[194] V. S.Miller. Use of elliptic curves in cryptography. In Advances in cryptology—
CRYPTO 1985, volume 218 of Lecture Notes in Computer Science, pages 417–
426. Springer, 1986.

[195] C. J. Mitchell, M. Ward, and P. Wilson. On key control in key agreement
protocols. Electronics Letters, 34:980–981, 1998.

[196] M.Tatebayashi, N. Matsuzaki, and D. Newman Jr. Key distribution protocol
for digital mobile communication systems. In G. Brassard, editor, Advances
in Cryptology — CRYPTO 1989, volume 435 of Lecture Notes in Computer
Science, pages 324–334. Springer, 1989.

[197] R. Needham and M. Schroeder. Using encryption for authentication in large
networks of computers. Commun. ACM, 21(12):993–999, 1978.

[198] M. H. Nguyen and S. P. Vadhan. Simpler session-key generation from short
random passwords. In M. Noar, editor, Proceedings of the First Theory of
Cryptography Conference, volume 2951 of Lecture Notes in Computer Science,
pages 428–445. Springer, 2004.

[199] J. B. Nielsen. Separating random oracle proofs from complexity theoretic
proofs: The non-committing encryption case. In M. Yung, editor, Advances
in Cryptology — CRYPTO 2002, volume 2442 of Lecture Notes in Computer
Science, pages 111–126. Springer, 2002.

[200] E. Okamoto. Key distribution systems based on identification information. In
C. Pomerance, editor, Advances in Cryptology — CRYPTO 1987, volume 283
of Lecture Notes in Computer Science, pages 194–202. Springer, 1988.

[201] E. Okamoto and K. Tanaka. Key distribution system based on identification
information. IEEE Journal on Selected Areas in Communications, 8(1):4–11,
1990.

[202] H. Orman. The Oakley key determination protocol. IETF RFC 2412, 1998.

[203] B. Klein M. Otten and T. Beth. Conference key distribution protocols in
distributed systems. In P. G. Farrell, editor, Cryptography and Coding, 4th
IMA International Conference, Proceedings, pages 225–241. Springer, 1995.

[204] D. Otway and O. Rees. Efficient and timely mutual authentication. Operating
Systems Review, 21(1):8–10, 1987.

[205] C. Park. On certificate-based security protocols for the wireless mobile communication
systems. IEEE Networks, 11(9):50–55, 1997.

[206] S. Pasini and S. Vaudenay. SAS-Based authenticated key agreement. In
M. Yung, Y. Dodis, A. Kiayias, and T. Malkin, editors, Proceedings of the
9th International Conference on Theory and Practice of Public-Key Cryptog-
raphy, volume 3958 of Lecture Notes in Computer Science, pages 395–409.
Springer, 2006.

[207] S. Patel. Number theoretic attacks on secure password schemes. In Proceedings
of the 1997 IEEE Symposium on Security and Privacy, pages 236–247. IEEE
Computer Society, 1997.

[208] O. Pereira and J. J. Quisquater. A security analysis of the cliques protocols
suites. In Proceedings of the 14th IEEE Computer Security Foundations
Workshop, pages 73–81. IEEE Computer Society, 2001.

[209] J. Pieprzyk and C.-H. Li. Multiparty key agreement protocols. IEE Proceedings
- Computers and Digital Techniques, 147(4):229–236, 2000.

[210] G. Price. A general attack model on hash-based client puzzles. In K. G.
Paterson, editor, Cryptography and Coding, 9th IMA International Confer-
ence, Proceedings, volume 2898 of Lecture Notes in Computer Science, pages
319–331. Springer, 2003.

[211] M. Raimondo and R. Gennaro. Provably secure threshold passwordauthenticated
key exchange. In E. Biham, editor, Advances in Cryptology
— EUROCRYPT 2003, volume 2656 of Lecture Notes in Computer Science,
pages 507–523. Springer, 2003.

[212] R. L. Rivest, A. Shamir, and D. A. Wagner. Time-lock puzzles and timedrelease
crypto. Technical Report MIT/LCS/TR-684, MIT LCS, 1996.

[213] S. Saeednia. Identity-based and self-certified key-exchange protocols. In Pro-
ceedings of the Second Australasian Conference on Information Security and
Privacy, pages 303–313. Springer, 1997.

[214] S. Saeednia. Improvement of G¨unther’s identity-based key exchange protocol.
Electronics Letters, 36(18):1535–1536, 2000.

[215] M. Satyanarayanan. Integrating security in a large distributed system. ACM
Trans. Comput. Syst., 7(3):247–280, 1989.

[216] S. Shin, K. Kobara, and H. Imai. Efficient and leakage-resilient authenticated
key transport protocol based on RSA. In J. Ioannidis, A. D. Keromytis, and
M. Yung, editors, Applied Cryptography and Network Security, Third Inter-
national Conference, ACNS 2005, volume 3531 of Lecture Notes in Computer
Science, pages 269–284. Springer, 2005.

[217] V. Shoup. On formal models for secure key exchange. Technical report, IBM
Research Report RZ 3120, 1998.

[218] V. Shoup. Sequences of games: a tool for taming complexity in security proofs.
http://shoup.net/papers/, 2006.

[219] The SET standard Specification. SET Secure Electronic Transaction LLC.
http://www.setco.org, 1997.

[220] D. Steer, L. Strawczynski, W. Diffie, and M. Wiener. A secure audio teleconference
system. In H. Krawczyk, editor, Advances in Cryptology — CRYPTO
1998, volume 403 of Lecture Notes in Computer Science, pages 520–528.
Springer, 1998.

[221] M. Steiner, G. Tsudik, and M. Waidner. Refinement and extension of encrypted
key exchange. Operating Systems Review, 29(3):22–30, 1995.

[222] M. Steiner, G. Tsudik, and M. Waidner. Diffie-Hellman key distribution extended
to group communication. In Proceedings of the 3rd ACM conference
on Computer and communications security, pages 31–37. ACM Press, 1996.

[223] D. Stinson. Cryptography Theory and Practice. CRC Press, Inc., second edition,
2002.

[224] M. Strangio. Efficient diffie-hellmann two-party key agreement protocols based
on elliptic curves. In H. Haddad, L. Liebrock, A. Omicini, and R. Wainwright,
editors, Proceedings of the 2005 ACM Symposium on Applied Com-
puting, pages 324–331. ACM, 2005.

[225] M. Strangio. On the resilience of key agreement protocols to key compromise
impersonation. In A. Atzeni and A. Lioy, editors, Public Key Infrastructure,
Third European PKI Workshop: Theory and Practice, Proceedings, volume
4043 of Lecture Notes in Computer Science, pages 233–247. Springer, 2006.

[226] M. Strangio. An optimal round two-party password-authenticated key agreement
protocol. In Proceedings of the the First International Conference on
Availability, Reliability and Security, pages 216–223. IEEE Computer Society,
2006.

[227] Q. Tang. On the security of three versions of the WAI protocol in Chinese
WLAN implementation plan. Cryptology ePrint Archive: Report 2007/122,
2007.

[228] Q. Tang and L. Chen. Weaknesses in two group Diffie-Hellman key exchange
protocols. Cryptology ePrint Archive: Report 2005/197, 2005.

[229] Q. Tang and K. R. Choo. Secure password-based authenticated group key
agreement for data-sharing peer-to-peer networks. In J. Zhou, M. Yung, and
F. Bao, editors, Applied Cryptography and Network Security, 4th International
Conference, volume 3989 of Lecture Notes in Computer Science, pages 162–
177, 2006.

[230] Q. Tang and C. J. Mitchell. Rethinking the security of some authenticated
group key agreement schemes. Cryptology ePrint Archive: Report 2004/363,
2004.

[231] Q. Tang and C. J. Mitchell. Efficient compilers for authenticated group key
exchange. In Y. Hao, J. Liu, Y. Wang, Y. Cheung, H. Yin, L. Jiao, J. Ma,
and Y. Jiao, editors, Computational Intelligence and Security, International
Conference, volume 3802 of Lecture Notes in Computer Science, pages 192–
197. Springer, 2005.

[232] Q. Tang and C. J. Mitchell. Enhanced password-based key establishment
protocol. Cryptology ePrint Archive: Report 2005/141, 2005.

[233] Q. Tang and C. J. Mitchell. On the security of some password-based key
agreement schemes. Cryptology ePrint Archive: Report 2005/156, 2005.

[234] Q. Tang and C. J. Mitchell. On the security of some password-based key
agreement schemes. In Y. Hao, J. Liu, Y. Wang, Y. Cheung, H. Yin, L. Jiao,
J. Ma, and Y. Jiao, editors, Computational Intelligence and Security, Interna-
tional Conference, volume 3802 of Lecture Notes in Computer Science, pages
149–154. Springer, 2005.

[235] Q. Tang and C. J. Mitchell. Security properties of two authenticated conference
key agreement protocols. In S. Qing, W. Mao, J. Lopez, and G. Wang,
editors, Information and Communications Security, 7th International Con-
ference, volume 3783 of Lecture Notes in Computer Science, pages 304–314.
Springer, 2005.

[236] Q. Tang and C. J. Mitchell. Weaknesses in a leakage-resilient authenticated
key transport protocol. Cryptology ePrint Archive: Report 2005/173, 2005.

[237] Q. Tang and C. J. Mitchell. Cryptanalysis of a hybrid authentication protocol
for large mobile networks. Journal of Systems and Software, 79(4):496–501,
2006.

[238] Y. Tseng. A secure authenticated group key agreement protocol for resourcelimited
mobile devices. Comput. J., 50(1):41–52, 2007.

[239] G. Tsudik and E. Herreweghen. Some remarks on protecting weak keys and
poorly-chosen secrets from guessing attacks. In Symposium on Reliable Dis-
tributed Systems, pages 136–142, 1993.

[240] W. Tzeng. A practical and secure-fault-tolerant conferenc-key agreement protocol.
In H. Imai and Y. Zheng, editors, Proceedings of the third International
Workshop on Practice and Theory in Public Key Cryptosystems, pages 1–13.
Springer, 2000.

[241] W. Tzeng. A secure fault-tolerant conference-key agreement protocol. IEEE
Transactions on Computers, 51(4):373–379, 2002.

[242] W. Tzeng and Z. Tzeng. Round-efficient conference key agreement protocols
with provable security. In Advances in Cryptology — ASIACRYPT 2000, pages
614–628. Springer, 2000.

[243] X. Wang, X. Lai, D. Feng, H. Chen, and X. Yu. Cryptanalysis of the hash
functions MD4 and RIPEMD. In R. Cramer, editor, Advances in Cryptology
— EUROCRYPT 2005, volume 3494 of Lecture Notes in Computer Science,
pages 1–18. Springer, 2005.

[244] X. Wang, Y. L. Yin, and H. Yu. Finding collisions in the full SHA-1. In
V. Shoup, editor, Advances in Cryptology — CRYPTO 2005, volume 3621 of
Lecture Notes in Computer Science, pages 17–36. Springer, 2005.

[245] X. Wang and H. Yu. How to break MD5 and other hash functions. In
R. Cramer, editor, Advances in Cryptology — EUROCRYPT 2005, volume
3494 of Lecture Notes in Computer Science, pages 19–35. Springer, 2005.

[246] X. Wang, H. Yu, and Y. L. Yin. Efficient collision search attacks on SHA-0.
In V. Shoup, editor, Advances in Cryptology — CRYPTO 2005, volume 3621
of Lecture Notes in Computer Science, pages 1–16. Springer, 2005.

[247] R. Winternitz. A secure one-way hash function built from DES. In Proceedings
of the IEEE Symposium on Information Security and Privacy, pages 88–90.
IEEE Press, 1984.

[248] D. S. Wong and A. H. Chan. Efficient and mutually authenticated key exchange
for low power computing devices. In C. Boyd, editor, Advances in
Cryptology — ASIACRYPT 2001, pages 272–289. Springer, 2001.

[249] T. Wu. The secure remote password protocol. In Proceedings of the Network
and Distributed System Security Symposium, NDSS 1998, pages 97–111, 1998.

[250] Y. Yacobi. A key distribution “paradox”. In A. Menezes and S. Vanstone,
editors, Advances in Cryptology — CRYPTO 1990, volume 537 of Lecture
Notes in Computer Science, pages 268–273. Springer, 1990.

[251] Y. Yacobi and M. Beller. Batch Diffie-Hellman key agreement systems. Journal
of Cryptology, 10(2):89–96, 1997.

[252] S. Yen and M. Liu. High performance nounce-based authentication and key
distribution protocols against password guessing attacks. IEICE Transactions
Fundamentals, E80-A(11):2209–2217, 1997.

[253] F. G. Zhang and X. F. Chen. Attacks on two ID-based authenticated group
key agreement schemes. Cryptology ePrint Archive, Report 2003/259, 2003.

[254] H. Zhou, L. Fan, and J. Li. Remarks on unknown key-share attack on authenticated
multiple-key agreement protocol. Electronics Letters, 39(17):1248–1249,
2003.