TBSAE: Tightly Secure One-Round SAE Variant for Securing Peer-to-Peer Networks

Password-authenticated key exchange (PAKE) allows involved participants to establish cryptographically strong keys over insecure channels by using a low-entropy password as credential. SAE as a widely deployed PAKE in Wi-Fi networks, has no tight security proof and requires the use of the Hash-to-Curve (H2C) function to map password into an elliptic curve point that is challenging to implement securely. To this end, in this paper, we present a tightly secure one-round SAE variant, called as TBSAE for Two-Basis Simultaneous Authentication of Equals. TBSAE can work in both multiplicative and elliptic curve additive groups, and it uses two random group elements as the common reference strings to circumvent the use of Hash-to-Group (Curve) function. In the elliptic curve setting, avoiding the use of H2C function will bring ease-of-implementation advantages over its predecessor SAE and some other H2C-based PAKE protocols since H2C is actually not easy to be implemented securely in practice over a commonly used elliptic curve additive group. TBSAE is peer-to-peer, supporting simultaneous initiation in the authenticated key exchange phase, which makes it also suitable for mesh networks besides the traditional client-server setting. It is secure against the tricky off-line dictionary attack, and further supports the intended forward secrecy. Moreover, we provide a tight formal security proof for TBSAE in the random oracle model using the Gap Computational Diffie-Hellman (GDH) security assumption, which implies that compared to non-tightly secure PAKE protocols, it can achieve the expected security level with relatively small parameters in practice, making it gain more practical performance advantages.