YAK (cryptography)

Two parties, Alice and Bob, agree on a group ${\displaystyle G}$ with generator ${\displaystyle g}$ of prime order ${\displaystyle q}$ in which the discrete log problem is hard. Typically a Schnorr group is used. In general, YAK can use any prime order group that is suitable for public key cryptography, including elliptic curve cryptography. Let ${\displaystyle g^{a}}$ be Alice's long-term public key and ${\displaystyle g^{b}}$ be Bob's. The protocol executes in one round:

Alice selects ${\displaystyle x\in _{\text{R}}[0,q-1]}$ and sends out ${\displaystyle g^{x}}$ together with a zero-knowledge proof (using for example Schnorr non-interactive zero-knowledge proof as described in RFC 8235) for the proof of the exponent ${\displaystyle x}$. Similarly, Bob selects ${\displaystyle y\in _{\text{R}}[0,q-1]}$ and sends out ${\displaystyle g^{y}}$ together with a zero-knowledge proof for the proof of the exponent ${\displaystyle y}$. Here, the notation ${\displaystyle \in _{\text{R}}}$ denotes an element selected randomly with uniform probability.

The above communication can be completed in one round as neither party depends on the other. When it finishes, Alice and Bob verify the received zero-knowledge proofs. Alice then computes ${\displaystyle K=(g^{y}g^{b})^{x+a}=g^{(x+a)(y+b)}}$. Similarly, Bob computes ${\displaystyle K=(g^{x}g^{a})^{y+b}=g^{(x+a)(y+b)}}$. With the same keying material ${\displaystyle K}$, Alice and Bob can derive a session key using a cryptographic hash function: ${\displaystyle \kappa =H(K)}$.

The use of well-established zero-knowledge proof primitives such as Schnorr's scheme greatly simplifies the security proofs. Given that the underlying zero knowledge proof primitive is secure, the YAK protocol is claimed to provide the following properties, although it cannot be proven secure in any well-known security model for key exchange protocols. [3] [4]

1. Private key security – An attacker cannot learn the user's static private key even if he is able to learn all session-specific secrets in any compromised session.
2. Forward secrecy – Session keys that were securely established in the past uncorrupted sessions will remain incomputable in the future even when both users' static private keys are disclosed.
3. Session key security – An attacker cannot compute the session key if he impersonates a user but has no access to the user's private key.

Published cryptanalysis of YAK shows that it cannot be proven secure in any of the well-known security models for authenticated key exchange protocols [3] (to which Hao has a different opinion [5] which is in contradiction with recent peer-reviewed results that report the same problems and even more attacks [4]).