Specification of FSU
version 1.0
NTT Secure Platform Laboratories,NTT Corporation
March 2, 2015

1Introduction

This document provides the specification of ID-based authenticated key exchange protocol FSU[4] that is an extension of FSU (Fujioka-Suzuki-Ustaoglu) protocol standardized in ISO/IEC
11770-3 [5].
This document uses the following notations and functions: elliptic curve parameter E in[1], pairing e in [2], and functions HashingToPoint, GroupMembershipTest, MGF1,ECP2OSP, OS2ECPP, FE2OSP in [3].

2

FSU system parameters

The system parameters consist of the followings.
• Let R be a point compression type specifically Compressed, Uncompressed or Hybird.
• Let G1 , G2 , and GT be cyclic groups with generators G1 , G2 , and e(G1 , G2 ) of prime orderq, respectively, and e : G1 × G2 → GT be asymmetric pairing. Gv is specified by elliptic
curve parameter Ev (v = 1, 2) in [1], and pairing e is specified as in [2].
• Hash functions Hv : {0, 1}∗ → Gv are defined as Hv (M ) = HashingToPoint(Ev , “FSU”||ECP2OSP(Z1 , R)||ECP2OSP(Z2 , R)||M ) (v = 1, 2). HashingToPoint is specified asin [3]. Key derivation function H : {0, 1}∗ → {0, 1}n is defined as H(M ) = MGF1(“FSU”||ECP2OSP(Z1 , R)||ECP2OSP(Z2 , R)||M, n). MGF1 is specified as in [3]. Here, Zv ∈ Gv
(v = 1, 2) are master public keys.
The master secret and public keys are generated as following.
• KGC randomly selects master secret key z ∈ Zq , and computes master public keys Zv =zGv ∈ Gv (v = 1, 2).
The static secret keys are generated as following.
• For user Ui with identity IDi , KGC generates static secret keys Di,v = zQi,v ∈ Gv (v =1, 2), where Qi,v = Hv (IDi )(= qi,v Gv ) ∈ Gv (v = 1, 2).

3

FSU protocol

UA has identity IDA and static secret key DA,1 = zQA,1 = zH1 (IDA )(= zqA,1 G1 ) ∈ G1 .
UB has identity IDB and static secret key DB,2 = zQB,2 = zH2 (IDB )(= zqB,2 G2 ) ∈ G2 .
Initiater UA and responder UB perform the following authenticated key exchange protocol.
GroupMembershipTest is specified as in [3].
1. UA selects a random ephemeral secret key xA ∈U Zq , computes the ephemeral public key
XA,v = xA Gv (v = 1, 2), computes X̂A,v = ECP2OSP(XA,v , R) (v = 1, 2), and sends(IDA , IDB , X̂A,1 , X̂A,2 ) to UB .
2. Upon receiving (IDA , IDB , X̂A,1 , X̂A,2 ), UB computes XA,v = OS2ECPP(X̂A,v ) (v =1, 2), verifies GroupMembershipTest(Ev , XA,v ) = 1 (v = 1, 2) and e(XA,1 , g2 ) = e(g1 , XA,2 ),and aborts if not.
UB selects a random ephemeral secret key xB ∈U Zq , computes the ephemeral public key
XB,v = xB Gv (v = 1, 2), computes X̂B,v = ECP2OSP(XB,v , R) (v = 1, 2), and sends(IDB , IDA , X̂B,1 , X̂B,2 ) to UA .
2

UB computes shared values
σ1 = e(QA,1 , DB,2 ), σ2 = e(QA,1 + XA,1 , DB,2 + xB Z2 ), σ3 = xB XA,1 , σ4 = xB XA,2 ,computes σ̂i = FE2OSP(σi ) (i = 1, 2) and σ̂i = ECP2OSP(σi , R) (i = 3, 4), computes thesession key K = H(σ̂1 ||σ̂2 ||σ̂3 ||σ̂4 ||sid), where sid = (IDA ||IDB ||X̂A,1 ||X̂A,2 ||X̂B,1 ||X̂B,2 ),and completes the session.
3. Upon receiving (IDB , IDA , X̂B,1 , X̂B,2 ), UA computes XB,v = OS2ECPP(X̂B,v ) (v =1, 2), verifies GroupMembershipTest(Ev , XB,v ) = 1 (v = 1, 2) and e(XB,1 , g2 ) = e(g1 , XB,2 ),and aborts if not.
UA computes shared values
σ1 = e(DA,1 , QB,2 ), σ2 = e(DA,1 + xA Z1 , QB,2 + XB,2 ), σ3 = xA XB,1 , σ4 = xA XB,2 ,computes σ̂i = FE2OSP(σi ) (i = 1, 2) and σ̂i = ECP2OSP(σi , R) (i = 3, 4), computes thesession key K = H(σ̂1 ||σ̂2 ||σ̂3 ||σ̂4 ||sid), where sid = (IDA ||IDB ||X̂A,1 ||X̂A,2 ||X̂B,1 ||X̂B,2 ),and completes the session.
Both parties compute the same shared values
σ1 = e(G1 , G2 )zqA,1 qB,2 , σ2 = e(G1 , G2 )z(qA,1 +xA )(qB,2 +xB ) , σ3 = xA xB G1 , σ4 = xA xB G2 ,and compute the same session key K.

Appendix
ASample Parameter

Sample parameter of FSU is as follows:
R = Compressed,
Hash = SHA-256,
n = 32,hashLen = 32,
E1 = “Fp254BNp”,
E2 = “Fp254n2BNp”.
The details of the Elliptic curve parameter Fp254BNp [1] is as follows:• Carve-ID = Fp254BNp• pb = 0x2523648240000001ba344d80000000086121000000000013a700000000000013• pe = u ∈ Fpb [u]
• A=0
• B=2
• x = 0x2523648240000001ba344d80000000086121000000000013a7000000000000123• y=1• q = 0x2523648240000001ba344d8000000007ﬀ9f800000000010a10000000000000d• h=1
Elliptic curve parameter Fp254n2BNp [1] is as follows:• Carve-ID = Fp254n2BNp• pb = 0x2523648240000001ba344d80000000086121000000000013a700000000000013• pe = u2 + 1 ∈ Fpb [u]• A=0• B=1+ (0x2523648240000001ba344d80000000086121000000000013a700000000000012)u• x = 0x061a10bb519eb62feb8d8c7e8c61edb6a4648bbb4898bf0d91ee4224c803fb2b+ (0x0516aaf9ba737833310aa78c5982aa5b1f4d746bae3784b70d8c34c1e7d54cf3)u• y = 0x021897a06baf93439a90e096698c822329bd0ae6bdbe09bd19f0e07891cd2b9a+ (0x0ebb2b0e7c8b15268f6d4456f5f38d37b09006ﬀd739c9578a2d1aec6b3ace9b)u• q = 0x2523648240000001ba344d8000000007ﬀ9f800000000010a10000000000000d• h = 0x2523648240000001ba344d8000000008c2a2800000000016ad00000000000019

References[1] K. Kasamatsu, S. Kanno, T. Kobayashi and Y. Kawahara: Barreto-Naehrig Curves draftKasamatsu-bncurves-01. Network Working Group Internet-Draft: (2014).
[2] K. Kasamatsu, S. Kanno, T. Kobayashi and Y. Kawahara: Optimal Ate Pairing draftkasamatsu-optimal-ate-pairings-00. Network Working Group Internet-Draft: to apper.
[3] NTT Secure Platform Laboratories: Specification of Data Types and Conversions version
0. ¡https://info.isl.ntt.co.jp/crypt/index.html¿.
[4] Atsushi Fujioka, Fumitaka Hoshino, Tetsutaro Kobayashi, Koutarou Suzuki, Berkant Ustaoglu, Kazuki Yoneyama: id-eCK Secure ID-Based Authenticated Key Exchange on Symmetric and Asymmetric Pairing. IEICE Transactions 96-A(6): 1139-1155 (2013).
[5] ISO/IEC 11770-3:2014 Information technology – Security techniques – Key management –Part 3: Mechanisms using asymmetric techniques.

4