{'fraction_non_alphanumeric': 0.020364415862808145, 'fraction_numerical': 0.0, 'mean_word_length': 5.161716171617162, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Secret-Key Authentication Beyond the Challenge-Response Paradigm : Definitional Issues and New Protocols

Secret-key authentication is the task of one party proving to another party that they share the same key. The problem has recently attracted widespread interest due to the existence of lightweight protocols amenable to implementation on simple architectures, such as RFID tags. This paper revisits and improves upon the large body of work on secret-key authentication in two different ways. On the definitional side, we show that the notion of active security, the strongest attained by existing lightweight protocols, is too weak and can be satisfied by protocols completely insecure with respect to seemingly much weaker notions. We provide new, more apt definitions of active security, and investigate relations among them, within a new general framework for fine-grained modeling of the security of secret-key authentication protocols of independent interest. Moreover, we prove that previous protocols following the so-called challenge-response paradigm remain secure with respect to our new definitions as long as they are actively secure with respect to the old one. In the second part of our paper, however, we also provide concrete evidence of the benefits of going beyond this paradigm: We present new generic constructions of authentication protocols which deviate from the challenge-response blueprint. On the one hand, we devise an actively-secure threeround protocol based on a very weak MAC which only needs to be secure against a forger on a random message when evaluated on random messages. The protocol admits efficient LPNand CDH-based instantiations. On the other hand, we provide a two-round generic construction of a Man-in-theMiddle secure protocol based on weak MACs which enjoys an efficient instantiation based on the qSDH assumption.