Universally composable contributory group key exchange

We treat the security of group key exchange (GKE) in the universal composability (UC) framework. Analyzing GKE protocols in the UC framework naturally addresses attacks by malicious insiders. We define an ideal functionality for GKE that captures contributiveness in addition to other desired security goals. We show that an efficient two-round protocol securely realizes the proposed functionality in the random oracle model. As a result, we obtain the most efficient UC-secure contributory GKE protocol known.

Modeling key compromise impersonation attacks on group key exchange protocols

A key exchange protocol allows a set of parties to agree upon a secret session key over a public network. Two-party key exchange (2PKE) protocols have been rigorously analyzed under various models considering different adversarial actions. However, the analysis of group key exchange (GKE) protocols has not been as extensive as that of 2PKE protocols. Particularly, the security attribute of key compromise impersonation (KCI) resilience has so far been ignored for the case of GKE protocols. We first model the security of GKE protocols addressing KCI attacks by both outsider and insider adversaries. We then show that a few existing protocols are not secure even against outsider KCI attacks. The attacks on these protocols demonstrate the necessity of considering KCI resilience for GKE protocols. Finally, we give a new proof of security for an existing GKE protocol under the revised model assuming random oracles.

What’s in a handshake? Exploring business-to-business relational exchange

Despite its importance in the development of competitive advantage, attempts to unify diverse classifications of business-to-business relational exchange have been largely unsuccessful. We used 18 semi-structured, in-depth interviews with managers from a wide range of industries to explain the business-to-business relational exchange construct. Analysis of the data revealed that business-to-business relational exchange comprises five key dimensions. These are communication, compatibility, commitment, trust and power symmetry. The research highlights the importance of personal interaction in business relationships and provided additional insights into the importance of affective commitment. In addition we reveal a number of negative consequences of affective commitment, which have been previously unexplored. A new conceptual model of business-to-business relational exchange is presented, which synthesises these findings and directs future research.

Efficient one-round key exchange in the standard model

We consider one-round key exchange protocols secure in the standard model. The security analysis uses the powerful security model of Canetti and Krawczyk and a natural extension of it to the ID-based setting. It is shown how KEMs can be used in a generic way to obtain two different protocol designs with progressively stronger security guarantees. A detailed analysis of the performance of the protocols is included; surprisingly, when instantiated with specific KEM constructions, the resulting protocols are competitive with the best previous schemes that have proofs only in the random oracle model.

Efficient one-round key exchange in the efficient one-round key exchange in the standard model

We consider one-round key exchange protocols secure in the standard model. The security analysis uses the powerful security model of Canetti and Krawczyk and a natural extension of it to the ID-based setting. It is shown how KEMs can be used in a generic way to obtain two different protocol designs with progressively stronger security guarantees. A detailed analysis of the performance of the protocols is included; surprisingly, when instantiated with specific KEM constructions, the resulting protocols are competitive with the best previous schemes that have proofs only in the random oracle model.

Efficient one-round key exchange in the standard model

We consider one-round key exchange protocols secure in the standard model. The security analysis uses the powerful security model of Canetti and Krawczyk and a natural extension of it to the ID-based setting. It is shown how KEMs can be used in a generic way to obtain two different protocol designs with progressively stronger security guarantees. A detailed analysis of the performance of the protocols is included; surprisingly, when instantiated with specific KEM constructions, the resulting protocols are competitive with the best previous schemes that have proofs only in the random oracle model.

The moment of exchange : risk, vulnerability, responsibility

Any cycle of production and exchange – be it economic, cultural or aesthetic – involves an element of risk. It involves uncertainty, unpredictability, and a potential for new insight and innovation (the boom) as well as blockages, crises and breakdown (the bust). In performance, the risks are plentiful – economic, political, social, physical and psychological. The risks people are willing to take depend on their position in the exchange (performer, producer, venue manager or spectator), and their aesthetic preferences. This paper considers the often uncertain, confronting or ‘risky’ moment of exchange between performer, spectator and culture in Live Art practices. Encompassing body art, autobiographical art, site-specific art and other sorts of performative intervention in the public sphere, Live Art eschews the artifice of theatre, breaking down barriers between art and life, artist and spectator, to speak back to the public sphere, and challenge assumptions about bodies, identities, memories, relationships and histories. In the process, Live Art frequently privileges an uncertain, confrontational or ‘risky’ mode of exchange between performer, spectator and culture, as a way of challenging power structures. This paper examines the moment of exchange in terms of risk, vulnerability, responsibility and ethics. Why the romance with ‘risky’ behaviours and exchanges? Who is really taking a risk? What risk? With whose permission (or lack thereof)? What potential does a ‘risky’ exchange hold to destabilise aesthetic, social or political norms? Where lies the fine line between subversive intervention in the public sphere and sheer self-indulgence? What are the social and ethical implications of a moment of exchange that puts bodies, beliefs or social boundaries at ‘risk’? In this paper, these questions are addressed with reference to historical and contemporary practices under the broadly defined banner of Live Art, from the early work of Abrovamic and Burden, through to contemporary Australian practitioners like Fiona McGregor.

Multi-factor password-authenticated key exchange

We consider a new form of authenticated key exchange which we call multi-factor password-authenticated key exchange, where session establishment depends on successful authentication of multiple short secrets that are complementary in nature, such as a long-term password and a one-time response, allowing the client and server to be mutually assured of each other's identity without directly disclosing private information to the other party. Multi-factor authentication can provide an enhanced level of assurance in higher-security scenarios such as online banking, virtual private network access, and physical access because a multi-factor protocol is designed to remain secure even if all but one of the factors has been compromised. We introduce a security model for multi-factor password-authenticated key exchange protocols, propose an efficient and secure protocol called MFPAK, and provide a security argument to show that our protocol is secure in this model. Our security model is an extension of the Bellare-Pointcheval-Rogaway security model for password-authenticated key exchange and accommodates an arbitrary number of symmetric and asymmetric authentication factors.

The knowledge exchange intermediary as service provider : a discussion and an Australian case

The critical impact of innovation on national and the global economies has been discussed at length in the literature. Economic development requires the diffusion of innovations into markets. It has long been recognised that economic growth and development depends upon a constant stream of innovations. Governments have been keenly aware of the need to ensure this flow does not dry to a trickle and have introduced many and varied industry policies and interventions to assist in seeding, supporting and diffusing innovations. In Australia, as in many countries, Government support for the transfer of knowledge especially from publicly funded research has resulted in the creation of knowledge exchange intermediaries. These intermediaries are themselves service organisations, seeking innovative service offerings for their markets. The choice for most intermediaries is generally a dichotomous one, between market-pull and technology-push knowledge exchange programmes. In this article, we undertake a case analysis of one such innovative intermediary and its flagship programme. We then compare this case with other successful intermediaries in Europe. We put forward a research proposition that the design of intermediary programmes must match the service type they offer. That is, market-pull programmes require market-pull design, in close collaboration with industry, whereas technology programmes can be problem-solving innovations where demand is latent. The discussion reflects the need for an evolution in knowledge transfer policies and programmes beyond the first generation ushered in with the US Bayh-Dole Act (1980) and Stevenson-Wydler Act (1984). The data analysed is a case study comparison of market-pull and technology-push programmes, focusing on primary and secondary socio-economic benefits (using both Australian and international comparisons).

One-time-password-authenticated key exchange

To reduce the damage of phishing and spyware attacks, banks, governments, and other security-sensitive industries are deploying one-time password systems, where users have many passwords and use each password only once. If a single password is compromised, it can be only be used to impersonate the user once, limiting the damage caused. However, existing practical approaches to one-time passwords have been susceptible to sophisticated phishing attacks. ---------- We give a formal security treatment of this important practical problem. We consider the use of one-time passwords in the context of password-authenticated key exchange (PAKE), which allows for mutual authentication, session key agreement, and resistance to phishing attacks. We describe a security model for the use of one-time passwords, explicitly considering the compromise of past (and future) one-time passwords, and show a general technique for building a secure one-time-PAKE protocol from any secure PAKE protocol. Our techniques also allow for the secure use of pseudorandomly generated and time-dependent passwords.

Predicate-based key exchange

We provide the first description of and security model for authenticated key exchange protocols with predicate-based authentication. In addition to the standard goal of session key security, our security model also provides for credential privacy: a participating party learns nothing more about the other party's credentials than whether they satisfy the given predicate. Our model also encompasses attribute-based key exchange since it is a special case of predicate-based key exchange.---------- We demonstrate how to realize a secure predicate-based key exchange protocol by combining any secure predicate-based signature scheme with the basic Diffie-Hellman key exchange protocol, providing an efficient and simple solution.

Role of corporate governance in mitigating the selective disclosure of executive stock option information

We examine the nature and extent of statutory executive stock option (ESO) disclosures by Australian listed companies over the 2001 to 2004 period, and the influence of corporate governance mechanisms on these disclosures. Our results show a progressive increase in overall compliance from 2001 to 2004. However, despite the improved compliance, the results reveal managements’ continued reluctance to disclose more sensitive ESO information. Factors associated with good internal governance, including board independence, audit committee independence and effectiveness, and compensation committee independence and effectiveness are found to contribute to improved compliance. Similarly, certain external governance factors are associated with improved disclosure, including external auditor quality, shareholder activism (as proxied by companies identified as poor performers by the Australian Shareholders’ Association), and regulatory intervention.

Is there timing ability in currency markets? Evidence from ADR issuances

Is there timing ability in the exchange rate markets? We address this question by examining foreign firms' decisions to issue American Depositary Receipts (ADRs). Specifically, we test whether foreign firms consider currency market conditions in their ADR issuance decisions and, in doing so, display some ability to time their local exchange rate market. We study ADR issuances in the U.S. stock market between 1976 and 2003. We find that foreign firms tend to issue ADRs after their local currency has been abnormally strong against the U.S. dollar and before their local currency becomes abnormally weak. This evidence is statistically significant even after controlling for local and U.S. past and future stock market performance and predicable exchange rate movements. Currency market timing is especially significant i) for value companies, relatively small (yet absolutely large) companies issuing relatively large amounts of ADRs, companies with higher currency exposure, manufacturing companies, and emerging market companies, ii) during currency crises (when mispricings are rife) and after the integration of the issuer's local financial market with the world capital markets, iii) when the ADR issue raises capital for the issuing firm (Level III ADR), and iv) regardless of the identity of the underwriting investment bank. Currency market timing is also economically significant since it translates into total savings for the issuing firms of about $646 million (or 1.86% of the total capital-raising ADR issue volume). In contrast, we find no evidence of currency timing ability in a control sample made of non-capital raising ADRs (Level II ADRs). These findings suggest that some companies may have, at least occasionally, private information about foreign exchange.

Attribute-based authenticated key exchange

We introduce the concept of attribute-based authenticated key exchange (AB-AKE) within the framework of ciphertext policy attribute-based systems. A notion of AKE-security for AB-AKE is presented based on the security models for group key exchange protocols and also taking into account the security requirements generally considered in the ciphertext policy attribute-based setting. We also extend the paradigm of hybrid encryption to the ciphertext policy attribute-based encryption schemes. A new primitive called encapsulation policy attribute-based key encapsulation mechanism (EP-AB-KEM) is introduced and a notion of chosen ciphertext security is de�ned for EP-AB-KEMs. We propose an EP-AB-KEM from an existing attribute-based encryption scheme and show that it achieves chosen ciphertext security in the generic group and random oracle models. We present a generic one-round AB-AKE protocol that satis�es our AKE-security notion. The protocol is generically constructed from any EP-AB-KEM that satis�es chosen ciphertext security. Instantiating the generic AB-AKE protocol with our EP-AB-KEM will result in a concrete one-round AB-AKE protocol also secure in the generic group and random oracle models.

Generic one round group key exchange in the standard model

Minimizing complexity of group key exchange (GKE) protocols is an important milestone towards their practical deployment. An interesting approach to achieve this goal is to simplify the design of GKE protocols by using generic building blocks. In this paper we investigate the possibility of founding GKE protocols based on a primitive called multi key encapsulation mechanism (mKEM) and describe advantages and limitations of this approach. In particular, we show how to design a one-round GKE protocol which satisfies the classical requirement of authenticated key exchange (AKE) security, yet without forward secrecy. As a result, we obtain the first one-round GKE protocol secure in the standard model. We also conduct our analysis using recent formal models that take into account both outsider and insider attacks as well as the notion of key compromise impersonation resilience (KCIR). In contrast to previous models we show how to model both outsider and insider KCIR within the definition of mutual authentication. Our analysis additionally implies that the insider security compiler by Katz and Shin from ACM CCS 2005 can be used to achieve more than what is shown in the original work, namely both outsider and insider KCIR.