Hdkem secures private key exchange with new deniability method
HDKEM: Authentication Allocation for Deniable Hybrid Key Exchange
Cryptography and Security
Summary
Secure communication often requires proving you took part in creating a shared secret key, but this proof can sometimes be used against you later. The authors study ways to exchange keys that don't leave such proof, focusing on a method that uses a special kind of signature called a ring signature. They create a new protocol called HDKEM that mixes different cryptographic tools to keep communications both secure and deniable. Their tests show the method works efficiently and protects privacy even against strong attackers.
What this means in practice
- •For security engineers: Implement key exchange protocols that allow secure, deniable communication useful in sensitive or private messaging systems.
- •For cryptographic software developers: Develop efficient and privacy-preserving authentication modules that combine classical, quantum, and information-theoretic components for enhanced key security.
Authors
Kazi Hassan Shakib, Muhammad Asfand Hafeez, Arslan Munir
Abstract
Deniable authenticated key exchange (DAKE) establishes a shared key without leaving transferable evidence that a party participated. We study DAKE protocols that authenticate each fresh session with one ring signature and show that their deniability mechanisms fall into three authentication allocations: sharing an authentication witness, hiding the signing witness under a fixed ring, or varying the verified ring between real and simulated executions. For fixed-ring protocols, witness hiding yields a necessary relation between the ring signature's witness-indistinguishability gap and the protocol's $(μ,δ)$ deniability parameters. We instantiate witness hiding in HDKEM, a three-slot hybrid that combines ML-KEM-768, X25519, and an optional pairwise information-theoretic source through a split-key PRF. HDKEM binds all public session values, including a QKD key identifier when present, into authentication and key derivation. Under the stated component models, it achieves eCK key indistinguishability, forward secrecy, and strong local deniability. We evaluate HDKEM with FalconRS and Gandalf. Across 2,000 primitive operations, median signing/verification times are 9.20/1.02 ms for FalconRS and 18.61/0.97 ms for Gandalf in our reference environment. In source-backed mode, the corresponding TCP-application costs are 8,607 B and 8,555 B per handshake. A separate 500-session server experiment exercises the complete FalconRS source-backed path and reports a median server time of 16.29 ms including local I/O.