Key Agreement Protocol

Forward secrecy (or perfect forward secrecy) ensures that the compromise of a party's long-term private key does not allow an adversary to decrypt past session keys. This property is critical for long-lived systems, as it limits the blast radius of a key compromise.

• Mechanism: Achieved by using ephemeral key pairs for each session, where the private key is deleted after use.
• Example: The Diffie-Hellman Ephemeral (DHE) and Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) key exchange methods provide forward secrecy.
• Importance in Federated Learning: Protects historical model update transmissions even if a client's device is later compromised.

Mutual authentication guarantees that all participating parties in the protocol can cryptographically verify each other's identities before establishing a shared secret. This prevents man-in-the-middle (MitM) attacks.

• Implementation: Typically combines the key agreement (e.g., Diffie-Hellman) with a digital signature scheme or pre-shared keys.
• Common Standard: The Signal Protocol, used in secure messaging, exemplifies mutual authentication integrated with key agreement.
• Role in Secure Aggregation: In federated learning, the server must authenticate clients, and clients should authenticate the server to prevent aggregation with a malicious entity.

Key confirmation is the property that allows parties to explicitly verify that their peer has derived the same shared secret key. This ensures there was no active adversary manipulating the exchange.

• Process: After the key is derived, parties exchange a short message (a confirmation tag) encrypted or hashed with the new key. Successful decryption/verification confirms synchronization.
• Distinction from Authentication: Authentication verifies identity; key confirmation verifies the successful, identical computation of the session key.
• System Integrity: In distributed systems, this property is essential for ensuring all participants are in a consistent state before proceeding with encrypted communication.

Known key security ensures that the compromise of one session key does not help an adversary compromise the keys of other sessions. Each session key is cryptographically independent.

• Requirement: The protocol must be designed so that learning a past shared secret g^(ab) does not make it easier to compute a future secret g^(cd).
• Failure Example: A flawed protocol where nonces are reused could violate this property.
• Impact: This is a baseline expectation for modern protocols, ensuring that attacks do not scale across time or sessions.

This property prevents a scenario where an adversary E can make party A believe it has established a key with party B, while B believes it is sharing a key with E. A and B have different views of their peer.

• The Vulnerability: Arises from inadequate binding between the key agreement messages and the identities of the parties.
• Mitigation: Strong mutual authentication and explicit inclusion of identities in the key derivation function are standard defenses.
• Protocol Design: The MQV and HMQV protocols were specifically designed to be resistant to such attacks.

Implicit key authentication is the guarantee that only an identified party (or parties) could possibly compute the established shared secret. It is a slightly weaker guarantee than mutual authentication, as it does not require an active proof.

• Key Distinction: With implicit authentication, you know who could know the key, but you don't get an active confirmation that they do know it (that's key confirmation).
• Foundation: Many authenticated key agreement (AKA) protocols provide implicit authentication as a core property.
• Use Case: Suitable for scenarios where a lightweight initial handshake is needed, with confirmation deferred or handled at a higher protocol layer.

A cryptographic technique where a secret value (e.g., a model update) is split into multiple shares that sum to the original secret. No subset of shares reveals any information unless all are combined. It is a fundamental building block for Secure Aggregation protocols.

• Mechanism: A client's private value v is split into shares s1, s2, ... sn such that v = s1 + s2 + ... + sn.
• Application: Used in protocols like the Bonawitz Protocol for federated learning, where shares are distributed so the server can only compute the sum.

A specific cryptographic technique used in Secure Aggregation where each client adds a secret mask to their update, shared with another client. When all masked updates are summed, the masks cancel out, revealing only the aggregate.

• Key Agreement Role: Key Agreement Protocols are used to establish the shared secret masks between each pair of clients securely.
• Dropout Tolerance: Designed to be robust, so if a client drops out, its mask can be cancelled by the server using Verifiable Secret Sharing techniques, preventing data loss.

A standard security model (also called semi-honest) where participants follow the protocol specification correctly but may attempt to learn additional information from all messages they observe. Key Agreement Protocols and Secure Aggregation schemes are designed to be secure under this assumption.

• Contrast with Malicious Model: A stronger Malicious Adversary Model allows participants to arbitrarily deviate from the protocol.
• Practicality: Many production Federated Learning systems initially target this model as it balances strong privacy with practical efficiency.

Often termed the Practical Secure Aggregation protocol, this is a specific federated learning scheme that uses Pairwise Masking and Additive Secret Sharing to enable a server to compute the sum of client model updates without learning any individual contribution.

• Core Steps: 1) Key Agreement establishes pairwise secrets. 2) Clients mask their updates. 3) The server sums masked vectors. 4) Surviving masks cancel out to reveal the true aggregate.
• Key Feature: Provides formal security guarantees and is tolerant to client dropouts during the round.