On the Risk of Opening Distributed Keys

We describe an insider known-key attack on key distribution systems which are based on public keys. This is of a general type and applies to the key distribution system presented by Yacobi at Crypto ’90, the Goss system, the Günther system presented at Eurocrypt ’89 and the key exchange version of COMSET, based on a system presented by Brandt et al. at Crypto ’89. The attack is primarily theoretical, in the sense that it assumes that some session keys are leaked or lost. Well designed systems will prevent this. However it could have practical consequences with certain applications (e.g. negotiation of contracts or poor implementations). We discuss the implications and ways to prevent the attack.