SAS

Short Authenticated Strings

Three round mutual authentication protocol MA-3

f: enc, h: hmac

\[ \begin{align}\begin{aligned}Alice : (c, d) <- Com_{pk}(r_a, s), c = hash(r_a, s)\\Alice -> Bob: (m_a, c)\\Bob -> Alice: (r_b, m_b)\\Alice -> Bob: d = (r_a, s)\\Alice: k = f(r_a, r_b), check_a = h(m_a || m_b, k)\\Bob: c == hash(d) ? , k = f(r_a, r_b), check_b = h(m_a || m_b, k)\\Alice <-> Bob: check_a == check_b ?, accept m_a || m_b\end{aligned}\end{align} \]

doc

• Secure Communications over Insecure Channels Based on Short Authenticated Strings

• Efficient Mutual Data Authentication Using Manually Authenticated Strings

• sas

• SAS-based Authenticated Key Agreement

• SAS-Based Group Authentication and Key Agreement Protocols

• An Analysis of End-to-End Encryption and Authentication Ceremonies in Secure Messaging Systems