{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T15:42:49Z","timestamp":1785512569425,"version":"3.56.0"},"reference-count":81,"publisher":"Springer Science and Business Media LLC","issue":"3","license":[{"start":{"date-parts":[[2022,5,5]],"date-time":"2022-05-05T00:00:00Z","timestamp":1651708800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2022,5,5]],"date-time":"2022-05-05T00:00:00Z","timestamp":1651708800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Cryptol"],"published-print":{"date-parts":[[2022,7]]},"DOI":"10.1007\/s00145-022-09427-1","type":"journal-article","created":{"date-parts":[[2022,5,5]],"date-time":"2022-05-05T20:08:02Z","timestamp":1651781282000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":23,"title":["An Efficient and Generic Construction for Signal\u2019s Handshake (X3DH): Post-quantum, State Leakage Secure, and Deniable"],"prefix":"10.1007","volume":"35","author":[{"given":"Keitaro","family":"Hashimoto","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shuichi","family":"Katsumata","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kris","family":"Kwiatkowski","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Thomas","family":"Prest","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2022,5,5]]},"reference":[{"key":"9427_CR1","doi-asserted-by":"crossref","unstructured":"D.\u00a0Aharonov, O.\u00a0Regev, Lattice problems in NP cap coNP, in 45th FOCS (IEEE Computer Society Press, 2004), pp. 362\u2013371","DOI":"10.1109\/FOCS.2004.35"},{"key":"9427_CR2","doi-asserted-by":"crossref","unstructured":"J.\u00a0Alawatugoda, D.\u00a0Stebila, C.\u00a0Boyd, Modelling after-the-fact leakage for key exchange, in S.\u00a0Moriai, T.\u00a0Jaeger, K.\u00a0Sakurai, editors, ASIACCS 14 (ACM Press, 2014), pp. 207\u2013216","DOI":"10.1145\/2590296.2590317"},{"key":"9427_CR3","doi-asserted-by":"crossref","unstructured":"J.\u00a0Alwen, S.\u00a0Coretti, Y.\u00a0Dodis, The double ratchet: security notions, proofs, and modularization for the Signal protocol, in Y.\u00a0Ishai, V.\u00a0Rijmen, editors, EUROCRYPT\u00a02019, Part\u00a0I, volume 11476 of LNCS (Springer, Heidelberg, 2019), pp. 129\u2013158","DOI":"10.1007\/978-3-030-17653-2_5"},{"key":"9427_CR4","doi-asserted-by":"crossref","unstructured":"C.\u00a0Bader, D.\u00a0Hofheinz, T.\u00a0Jager, E.\u00a0Kiltz, Y.\u00a0Li, Tightly-secure authenticated key exchange, in Y.\u00a0Dodis, J.B. Nielsen, editors, TCC\u00a02015, Part\u00a0I, volume 9014 of LNCS (Springer, Heidelberg, 2015), pp. 629\u2013658","DOI":"10.1007\/978-3-662-46494-6_26"},{"key":"9427_CR5","doi-asserted-by":"crossref","unstructured":"M.\u00a0Bellare, New proofs for NMAC and HMAC: security without collision-resistance, in C.\u00a0Dwork, editor, CRYPTO\u00a02006, volume 4117 of LNCS (Springer, Heidelberg, 2006), pp. 602\u2013619","DOI":"10.1007\/11818175_36"},{"issue":"4","key":"9427_CR6","doi-asserted-by":"publisher","first-page":"844","DOI":"10.1007\/s00145-014-9185-x","volume":"28","author":"M Bellare","year":"2015","unstructured":"M.\u00a0Bellare, New proofs for NMAC and HMAC: security without collision resistance. J. Cryptol. 28(4), 844\u2013878 (2015)","journal-title":"J. Cryptol."},{"key":"9427_CR7","doi-asserted-by":"crossref","unstructured":"M.\u00a0Bellare, A.\u00a0Desai, D.\u00a0Pointcheval, P.\u00a0Rogaway, Relations among notions of security for public-key encryption schemes, in H.\u00a0Krawczyk, editor, CRYPTO\u201998, volume 1462 of LNCS (Springer, Heidelberg, 1998), pp. 26\u201345","DOI":"10.1007\/BFb0055718"},{"key":"9427_CR8","doi-asserted-by":"crossref","unstructured":"M.\u00a0Bellare, A.\u00a0Palacio, Towards plaintext-aware public-key encryption without random oracles, in P.J. Lee, editor, ASIACRYPT\u00a02004, volume 3329 of LNCS (Springer, Heidelberg, 2004), pp. 48\u201362","DOI":"10.1007\/978-3-540-30539-2_4"},{"key":"9427_CR9","doi-asserted-by":"crossref","unstructured":"M.\u00a0Bellare, P.\u00a0Rogaway, Entity authentication and key distribution, in D.R. Stinson, editor, CRYPTO\u201993, volume 773 of LNCS (Springer, Heidelberg, 1994), pp. 232\u2013249","DOI":"10.1007\/3-540-48329-2_21"},{"key":"9427_CR10","doi-asserted-by":"crossref","unstructured":"M.\u00a0Bellare, P.\u00a0Rogaway, Optimal asymmetric encryption, in A.D. Santis, editor, EUROCRYPT\u201994, volume 950 of LNCS (Springer, Heidelberg, 1995), pp. 92\u2013111","DOI":"10.1007\/BFb0053428"},{"key":"9427_CR11","doi-asserted-by":"crossref","unstructured":"M.\u00a0Bellare, A.C. Singh, J.\u00a0Jaeger, M.\u00a0Nyayapati, I.\u00a0Stepanovs, Ratcheted encryption and key exchange: the security of messaging, in J.\u00a0Katz, H.\u00a0Shacham, editors, CRYPTO\u00a02017, Part\u00a0III, volume 10403 of LNCS (Springer, Heidelberg, 2017), pp. 619\u2013650","DOI":"10.1007\/978-3-319-63697-9_21"},{"key":"9427_CR12","doi-asserted-by":"crossref","unstructured":"D.J. Bernstein, Curve25519: new Diffie\u2013Hellman speed records, in M.\u00a0Yung, Y.\u00a0Dodis, A.\u00a0Kiayias, T.\u00a0Malkin, editors, PKC\u00a02006, volume 3958 of LNCS (Springer, Heidelberg, 2006), pp. 207\u2013228","DOI":"10.1007\/11745853_14"},{"key":"9427_CR13","doi-asserted-by":"crossref","unstructured":"W.\u00a0Beullens, S.\u00a0Katsumata, F.\u00a0Pintore, Calamari and Falafl: logarithmic (linkable) ring signatures from isogenies and lattices, in S.\u00a0Moriai, H.\u00a0Wang, editors, ASIACRYPT\u00a02020, Part\u00a0II, volume 12492 of LNCS (Springer, Heidelberg, 2020), pp. 464\u2013492","DOI":"10.1007\/978-3-030-64834-3_16"},{"key":"9427_CR14","doi-asserted-by":"crossref","unstructured":"W.\u00a0Beullens, T.\u00a0Kleinjung, F.\u00a0Vercauteren, CSI-FiSh: efficient isogeny based signatures through class group computations, in S.D. Galbraith, S.\u00a0Moriai, editors, ASIACRYPT\u00a02019, Part\u00a0I, volume 11921 of LNCS (Springer, Heidelberg, 2019), pp. 227\u2013247","DOI":"10.1007\/978-3-030-34578-5_9"},{"key":"9427_CR15","doi-asserted-by":"crossref","unstructured":"S.\u00a0Blake-Wilson, D.\u00a0Johnson, A.\u00a0Menezes, Key agreement protocols and their security analysis, in M.\u00a0Darnell, editor, 6th IMA International Conference on Cryptography and Coding, volume 1355 of LNCS (Springer, Heidelberg, 1997), pp. 30\u201345","DOI":"10.1007\/BFb0024447"},{"key":"9427_CR16","doi-asserted-by":"crossref","unstructured":"S.\u00a0Blake-Wilson, A.\u00a0Menezes, Unknown key-share attacks on the station-to-station (STS) protocol, in H.\u00a0Imai, Y.\u00a0Zheng, editors, PKC\u201999, volume 1560 of LNCS (Springer, Heidelberg, 1999), pp. 154\u2013170","DOI":"10.1007\/3-540-49162-7_12"},{"key":"9427_CR17","doi-asserted-by":"crossref","unstructured":"X.\u00a0Bonnetain, A.\u00a0Schrottenloher, Quantum security analysis of CSIDH, in A.\u00a0Canteaut, Y.\u00a0Ishai, editors, EUROCRYPT\u00a02020, Part\u00a0II, volume 12106 of LNCS (Springer, Heidelberg, 2020), pp. 493\u2013522","DOI":"10.1007\/978-3-030-45724-2_17"},{"key":"9427_CR18","unstructured":"Z.\u00a0Brakerski, Y.T. Kalai, A framework for efficient signatures, ring signatures and identity based encryption in the standard model. Cryptology ePrint Archive, Report 2010\/086 (2010). https:\/\/eprint.iacr.org\/2010\/086"},{"key":"9427_CR19","doi-asserted-by":"crossref","unstructured":"J.\u00a0Brendel, R.\u00a0Fiedler, F.\u00a0G\u00fcnther, C.\u00a0Janson, D.\u00a0Stebila, Post-quantum asynchronous deniable key exchange and the signal handshake. Cryptology ePrint Archive, Report 2021\/769 (2021)","DOI":"10.1007\/978-3-030-97131-1_1"},{"key":"9427_CR20","doi-asserted-by":"crossref","unstructured":"J.\u00a0Brendel, M.\u00a0Fischlin, F.\u00a0G\u00fcnther, C.\u00a0Janson, D.\u00a0Stebila, Towards post-quantum security for signal\u2019s X3DH handshake, in O.\u00a0Dunkelman, M.J. Jacobson, Jr., C.\u00a0O\u2019Flynn, editors, Selected Areas in Cryptography (Springer, Cham, 2020), pp. 404\u2013430","DOI":"10.1007\/978-3-030-81652-0_16"},{"key":"9427_CR21","doi-asserted-by":"crossref","unstructured":"R.\u00a0Canetti, H.\u00a0Krawczyk, Analysis of key-exchange protocols and their use for building secure channels, in B.\u00a0Pfitzmann, editor, EUROCRYPT\u00a02001, volume 2045 of LNCS (Springer, Heidelberg, 2001), pp. 453\u2013474","DOI":"10.1007\/3-540-44987-6_28"},{"key":"9427_CR22","doi-asserted-by":"crossref","unstructured":"R.\u00a0Canetti, H.\u00a0Krawczyk, Security analysis of IKE\u2019s signature-based key-exchange protocol, in M.\u00a0Yung, editor, CRYPTO\u00a02002, volume 2442 of LNCS (Springer, Heidelberg, 2002), pp. 143\u2013161. https:\/\/eprint.iacr.org\/2002\/120\/","DOI":"10.1007\/3-540-45708-9_10"},{"key":"9427_CR23","doi-asserted-by":"crossref","unstructured":"D.\u00a0Cash, E.\u00a0Kiltz, V.\u00a0Shoup, The twin Diffie\u2013Hellman problem and applications, in N.P. Smart, editor, EUROCRYPT\u00a02008, volume 4965 of LNCS (Springer, Heidelberg, 2008), pp. 127\u2013145","DOI":"10.1007\/978-3-540-78967-3_8"},{"key":"9427_CR24","doi-asserted-by":"crossref","unstructured":"K.\u00a0Cohn-Gordon, C.\u00a0Cremers, B.\u00a0Dowling, L.\u00a0Garratt, D.\u00a0Stebila, A formal security analysis of the signal messaging protocol, in IEEE European Symposium on Security and Privacy (EuroS &P) (2017), pp. 451\u2013466","DOI":"10.1109\/EuroSP.2017.27"},{"issue":"4","key":"9427_CR25","doi-asserted-by":"publisher","first-page":"1914","DOI":"10.1007\/s00145-020-09360-1","volume":"33","author":"K Cohn-Gordon","year":"2020","unstructured":"K.\u00a0Cohn-Gordon, C.\u00a0Cremers, B.\u00a0Dowling, L.\u00a0Garratt, D.\u00a0Stebila, A formal security analysis of the signal messaging protocol. J. Cryptol. 33(4), 1914\u20131983 (2020)","journal-title":"J. Cryptol."},{"key":"9427_CR26","doi-asserted-by":"crossref","unstructured":"K.\u00a0Cohn-Gordon, C.\u00a0Cremers, K.\u00a0Gj\u00f8steen, H.\u00a0Jacobsen, T.\u00a0Jager, Highly efficient key exchange protocols with optimal tightness, in A.\u00a0Boldyreva, D.\u00a0Micciancio, editors, CRYPTO\u00a02019, Part\u00a0III, volume 11694 of LNCS (Springer, Heidelberg, 2019), pp. 767\u2013797","DOI":"10.1007\/978-3-030-26954-8_25"},{"key":"9427_CR27","doi-asserted-by":"crossref","unstructured":"C.\u00a0Cremers, Examining indistinguishability-based security models for key exchange protocols: the case of CK, CK-HMQV, and eCK, in B.S.N. Cheung, L.C.K. Hui, R.S. Sandhu, D.S. Wong, editors, ASIACCS 11 (ACM Press, 2011), pp. 80\u201391","DOI":"10.1145\/1966913.1966925"},{"key":"9427_CR28","doi-asserted-by":"crossref","unstructured":"C.J.F. Cremers, Session-state reveal is stronger than ephemeral key reveal: attacking the NAXOS authenticated key exchange protocol, in M.\u00a0Abdalla, D.\u00a0Pointcheval, P.-A. Fouque, D.\u00a0Vergnaud, editors, ACNS 09, volume 5536 of LNCS (Springer, Heidelberg, 2009), pp. 20\u201333","DOI":"10.1007\/978-3-642-01957-9_2"},{"key":"9427_CR29","doi-asserted-by":"crossref","unstructured":"C.J.F. Cremers, M.\u00a0Feltz, Beyond eCK: perfect forward secrecy under actor compromise and ephemeral-key reveal, in S.\u00a0Foresti, M.\u00a0Yung, F.\u00a0Martinelli, editors, ESORICS\u00a02012, volume 7459 of LNCS (Springer, Heidelberg, 2012), pp. 734\u2013751","DOI":"10.1007\/978-3-642-33167-1_42"},{"key":"9427_CR30","doi-asserted-by":"crossref","unstructured":"B.\u00a0de\u00a0Kock, K.\u00a0Gj\u00f8steen, M.\u00a0Veroni, Practical isogeny-based key-exchange with optimal tightness, in O.\u00a0Dunkelman, M.J. Jacobson, Jr., C.\u00a0O\u2019Flynn, editors, Selected Areas in Cryptography (Springer, Cham, 2020), pp. 451\u2013479","DOI":"10.1007\/978-3-030-81652-0_18"},{"key":"9427_CR31","doi-asserted-by":"crossref","unstructured":"C.\u00a0de Saint Guilhem, M.\u00a0Fischlin, B.\u00a0Warinschi, Authentication in key-exchange: definitions, relations and composition, in L.\u00a0Jia, R.\u00a0K\u00fcsters, editors, CSF 2020 Computer Security Foundations Symposium (IEEE Computer Society Press, 2020), pp. 288\u2013303","DOI":"10.1109\/CSF49147.2020.00028"},{"key":"9427_CR32","doi-asserted-by":"crossref","unstructured":"M.\u00a0Di Raimondo, R.\u00a0Gennaro, H.\u00a0Krawczyk, Deniable authentication and key exchange, in A.\u00a0Juels, R.N. Wright, S.\u00a0De Capitani di Vimercati, editors, ACM CCS 2006 (ACM Press, 2006), pp. 400\u2013409","DOI":"10.1145\/1180405.1180454"},{"issue":"2","key":"9427_CR33","doi-asserted-by":"publisher","first-page":"107","DOI":"10.1007\/BF00124891","volume":"2","author":"W Diffie","year":"1992","unstructured":"W.\u00a0Diffie, P.C. Van\u00a0Oorschot, M.J. Wiener, Authentication and authenticated key exchanges. Des. Codes Cryptogr. 2(2), 107\u2013125 (1992)","journal-title":"Des. Codes Cryptogr."},{"key":"9427_CR34","unstructured":"S.\u00a0Dobson, S.D. Galbraith, Post-quantum signal key agreement with SIDH. Cryptology ePrint Archive, Report 2021\/1187 (2021). https:\/\/ia.cr\/2021\/1187"},{"key":"9427_CR35","doi-asserted-by":"crossref","unstructured":"Y.\u00a0Dodis, J.\u00a0Katz, A.\u00a0Smith, S.\u00a0Walfish, Composability and on-line deniability of authentication, in O.\u00a0Reingold, editor, TCC\u00a02009, volume 5444 of LNCS (Springer, Heidelberg, 2009), pp. 146\u2013162","DOI":"10.1007\/978-3-642-00457-5_10"},{"key":"9427_CR36","doi-asserted-by":"crossref","unstructured":"F.B. Durak, S.\u00a0Vaudenay, Bidirectional asynchronous ratcheted key agreement with linear complexity, in N.\u00a0Attrapadung, T.\u00a0Yagi, editors, IWSEC 19, volume 11689 of LNCS (Springer, Heidelberg, 2019), pp. 343\u2013362","DOI":"10.1007\/978-3-030-26834-3_20"},{"key":"9427_CR37","doi-asserted-by":"crossref","unstructured":"M.F. Esgin, R.\u00a0Steinfeld, J.K. Liu, D.\u00a0Liu, Lattice-based zero-knowledge proofs: new techniques for shorter and faster constructions and applications, in A.\u00a0Boldyreva, D.\u00a0Micciancio, editors, CRYPTO\u00a02019, Part\u00a0I, volume 11692 of LNCS (Springer, Heidelberg, 2019), pp. 115\u2013146","DOI":"10.1007\/978-3-030-26948-7_5"},{"key":"9427_CR38","doi-asserted-by":"crossref","unstructured":"M.F. Esgin, R.\u00a0Steinfeld, A.\u00a0Sakzad, J.K. Liu, D.\u00a0Liu, Short lattice-based one-out-of-many proofs and applications to ring signatures, in R.H. Deng, V.\u00a0Gauthier-Uma\u00f1a, M.\u00a0Ochoa, M.\u00a0Yung, editors, ACNS 19, volume 11464 of LNCS (Springer, Heidelberg, 2019), pp. 67\u201388","DOI":"10.1007\/978-3-030-21568-2_4"},{"key":"9427_CR39","doi-asserted-by":"crossref","unstructured":"M.F. Esgin, R.K. Zhao, R.\u00a0Steinfeld, J.K. Liu, D.\u00a0Liu, MatRiCT: efficient, scalable and post-quantum blockchain confidential transactions protocol, in L.\u00a0Cavallaro, J.\u00a0Kinder, X.\u00a0Wang, J.\u00a0Katz, editors, ACM CCS 2019 (ACM Press, 2019), pp. 567\u2013584","DOI":"10.1145\/3319535.3354200"},{"key":"9427_CR40","doi-asserted-by":"crossref","unstructured":"M.\u00a0Fischlin, Communication-efficient non-interactive proofs of knowledge with online extractors, in V.\u00a0Shoup, editor, CRYPTO\u00a02005, volume 3621 of LNCS (Springer, Heidelberg, 2005), pp. 152\u2013168","DOI":"10.1007\/11535218_10"},{"key":"9427_CR41","doi-asserted-by":"crossref","unstructured":"P.-A. Fouque, D.\u00a0Pointcheval, S.\u00a0Zimmer, HMAC is a randomness extractor and applications to TLS, in M.\u00a0Abe, V.\u00a0Gligor, editors, ASIACCS 08 (ACM Press, 2008), pp. 21\u201332","DOI":"10.1145\/1368310.1368317"},{"key":"9427_CR42","doi-asserted-by":"crossref","unstructured":"E.S.V. Freire, D.\u00a0Hofheinz, E.\u00a0Kiltz, K.G. Paterson, Non-interactive key exchange, in K.\u00a0Kurosawa, G.\u00a0Hanaoka, editors, PKC\u00a02013, volume 7778 of LNCS (Springer, Heidelberg, 2013), pp. 254\u2013271","DOI":"10.1007\/978-3-642-36362-7_17"},{"key":"9427_CR43","doi-asserted-by":"crossref","unstructured":"A.\u00a0Fujioka, K.\u00a0Suzuki, K.\u00a0Xagawa, K.\u00a0Yoneyama, Strongly secure authenticated key exchange from factoring, codes, and lattices, in M.\u00a0Fischlin, J.\u00a0Buchmann, M.\u00a0Manulis, editors, PKC\u00a02012, volume 7293 of LNCS (Springer, Heidelberg, 2012), pp. 467\u2013484","DOI":"10.1007\/978-3-642-30057-8_28"},{"key":"9427_CR44","doi-asserted-by":"crossref","unstructured":"A.\u00a0Fujioka, K.\u00a0Suzuki, K.\u00a0Xagawa, K.\u00a0Yoneyama, Practical and post-quantum authenticated key exchange from one-way secure key encapsulation mechanism, in K.\u00a0Chen, Q.\u00a0Xie, W.\u00a0Qiu, N.\u00a0Li, W.-G. Tzeng, editors, ASIACCS 13 (ACM Press, 2013), pp. 83\u201394","DOI":"10.1145\/2484313.2484323"},{"key":"9427_CR45","doi-asserted-by":"crossref","unstructured":"K.\u00a0Gj\u00f8steen, T.\u00a0Jager, Practical and tightly-secure digital signatures and authenticated key exchange, in H.\u00a0Shacham, A.\u00a0Boldyreva, editors, CRYPTO\u00a02018, Part\u00a0II, volume 10992 of LNCS Springer, Heidelberg, 2018), pp. 95\u2013125","DOI":"10.1007\/978-3-319-96881-0_4"},{"key":"9427_CR46","doi-asserted-by":"crossref","unstructured":"S.\u00a0Guo, P.\u00a0Kamath, A.\u00a0Rosen, K.\u00a0Sotiraki, Limits on the efficiency of (ring) LWE based non-interactive key exchange, in A.\u00a0Kiayias, M.\u00a0Kohlweiss, P.\u00a0Wallden, V.\u00a0Zikas, editors, PKC\u00a02020, Part\u00a0I, volume 12110 of LNCS (Springer, Heidelberg, 2020), pp. 374\u2013395","DOI":"10.1007\/978-3-030-45374-9_13"},{"key":"9427_CR47","doi-asserted-by":"crossref","unstructured":"K.\u00a0Hashimoto, S.\u00a0Katsumata, K.\u00a0Kwiatkowski, T.\u00a0Prest, An efficient and generic construction for signal\u2019s handshake (X3DH): post-quantum, state leakage secure, and deniable, in J.\u00a0Garay, editor, PKC\u00a02021, Part\u00a0II, volume 12711 of LNCS (Springer, Heidelberg, 2021), pp. 410\u2013440","DOI":"10.1007\/978-3-030-75248-4_15"},{"key":"9427_CR48","doi-asserted-by":"crossref","unstructured":"K.\u00a0H\u00f6velmanns, E.\u00a0Kiltz, S.\u00a0Sch\u00e4ge, D.\u00a0Unruh, Generic authenticated key exchange in the quantum random oracle model, in A.\u00a0Kiayias, M.\u00a0Kohlweiss, P.\u00a0Wallden, V.\u00a0Zikas, editors, PKC\u00a02020, Part\u00a0II, volume 12111 of LNCS (Springer, Heidelberg, 2020), pp. 389\u2013422","DOI":"10.1007\/978-3-030-45388-6_14"},{"key":"9427_CR49","doi-asserted-by":"crossref","unstructured":"T.\u00a0Jager, E.\u00a0Kiltz, D.\u00a0Riepel, S.\u00a0Sch\u00e4ge, Tightly-secure authenticated key exchange, revisited, in A.\u00a0Canteaut, F.-X. Standaert, editors, EUROCRYPT\u00a02021, Part\u00a0I, volume 12696 of LNCS (Springer, Heidelberg, 2021), pp. 117\u2013146","DOI":"10.1007\/978-3-030-77870-5_5"},{"key":"9427_CR50","doi-asserted-by":"crossref","unstructured":"D.\u00a0Jost, U.\u00a0Maurer, M.\u00a0Mularczyk, Efficient ratcheting: almost-optimal guarantees for secure messaging, in Y.\u00a0Ishai, V.\u00a0Rijmen, editors, EUROCRYPT\u00a02019, Part\u00a0I, volume 11476 of LNCS (Springer, Heidelberg, 2019), pp. 159\u2013188","DOI":"10.1007\/978-3-030-17653-2_6"},{"key":"9427_CR51","doi-asserted-by":"crossref","unstructured":"D.\u00a0Jost, U.\u00a0Maurer, M.\u00a0Mularczyk, A unified and composable take on ratcheting, in D.\u00a0Hofheinz, A.\u00a0Rosen, editors, TCC\u00a02019, Part\u00a0II, volume 11892 of LNCS (Springer, Heidelberg, 2019), pp. 180\u2013210","DOI":"10.1007\/978-3-030-36033-7_7"},{"key":"9427_CR52","doi-asserted-by":"crossref","unstructured":"T.\u00a0Kawashima, K.\u00a0Takashima, Y.\u00a0Aikawa, T.\u00a0Takagi, An efficient authenticated key exchange from random self-reducibility on CSIDH, in D.\u00a0Hong, editor, ICISC 20, volume 12593 of LNCS (Springer, Heidelberg, 2020), pp. 58\u201384","DOI":"10.1007\/978-3-030-68890-5_4"},{"key":"9427_CR53","doi-asserted-by":"crossref","unstructured":"H.\u00a0Krawczyk, HMQV: a high-performance secure Diffie\u2013Hellman protocol, in V.\u00a0Shoup, editor, CRYPTO\u00a02005, volume 3621 of LNCS (Springer, Heidelberg, 2005), pp. 546\u2013566","DOI":"10.1007\/11535218_33"},{"key":"9427_CR54","doi-asserted-by":"crossref","unstructured":"K.\u00a0Kurosawa, J.\u00a0Furukawa, 2-pass key exchange protocols from CPA-secure KEM, in J.\u00a0Benaloh, editor, CT-RSA\u00a02014, volume 8366 of LNCS (Springer, Heidelberg, 2014), pp. 385\u2013401","DOI":"10.1007\/978-3-319-04852-9_20"},{"key":"9427_CR55","unstructured":"K.\u00a0Kwiatkowski, An efficient and generic construction for signal\u2019s handshake (X3DH): post-quantum, state leakage secure, and deniable. proof of concept implementation (2020). https:\/\/github.com\/post-quantum-cryptography\/post-quantum-state-leakage-secure-ake"},{"key":"9427_CR56","unstructured":"K.\u00a0Kwiatkowski, PQ Crypto Catalog (2020). https:\/\/github.com\/kriskwiatkowski\/pqc"},{"key":"9427_CR57","unstructured":"LibTomCrypt. https:\/\/github.com\/libtom\/libtomcrypt"},{"key":"9427_CR58","doi-asserted-by":"crossref","unstructured":"B.A. LaMacchia, K.\u00a0Lauter, A.\u00a0Mityagin, Stronger security of authenticated key exchange, in W.\u00a0Susilo, J.K. Liu, Y.\u00a0Mu, editors, ProvSec 2007, volume 4784 of LNCS (Springer, Heidelberg, 2007), pp. 1\u201316","DOI":"10.1007\/978-3-540-75670-5_1"},{"key":"9427_CR59","doi-asserted-by":"crossref","unstructured":"Y.\u00a0Li, S.\u00a0Sch\u00e4ge, No-match attacks and robust partnering definitions: defining trivial attacks for security protocols is not trivial, in B.M. Thuraisingham, D.\u00a0Evans, T.\u00a0Malkin, D.\u00a0Xu, editors, ACM CCS 2017 (ACM Press, 2017), pp. 1343\u20131360","DOI":"10.1145\/3133956.3134006"},{"key":"9427_CR60","doi-asserted-by":"crossref","unstructured":"X.\u00a0Lu, M.H. Au, Z.\u00a0Zhang, Raptor: a practical lattice-based (linkable) ring signature, in R.H. Deng, V.\u00a0Gauthier-Uma\u00f1a, M.\u00a0Ochoa, M.\u00a0Yung, editors, ACNS 19, volume 11464 of LNCS (Springer, Heidelberg, 2019), pp. 110\u2013130","DOI":"10.1007\/978-3-030-21568-2_6"},{"key":"9427_CR61","unstructured":"V.\u00a0Lyubashevsky, L.\u00a0Ducas, E.\u00a0Kiltz, T.\u00a0Lepoint, P.\u00a0Schwabe, G.\u00a0Seiler, D.\u00a0Stehl\u00e9, S.\u00a0Bai, CRYSTALS-DILITHIUM. Technical report, National Institute of Standards and Technology (2020). available at https:\/\/csrc.nist.gov\/projects\/post-quantum-cryptography\/round-3-submissions"},{"key":"9427_CR62","unstructured":"M.\u00a0Marlinspike and T.\u00a0Perrin, The double ratchet algorithm (2016). https:\/\/signal.org\/docs\/specifications\/doubleratchet\/"},{"key":"9427_CR63","unstructured":"M.\u00a0Marlinspike, T.\u00a0Perrin, The X3DH key agreement protocol (2016). https:\/\/signal.org\/docs\/specifications\/x3dh\/"},{"key":"9427_CR64","doi-asserted-by":"crossref","unstructured":"S.\u00a0Myers, M.\u00a0Sergi, A.\u00a0shelat, Blackbox construction of a more than non-malleable CCA1 encryption scheme from plaintext awareness, in I.\u00a0Visconti, R.D. Prisco, editors, SCN 12, volume 7485 of LNCS (Springer, Heidelberg, 2012), pp. 149\u2013165","DOI":"10.1007\/978-3-642-32928-9_9"},{"key":"9427_CR65","doi-asserted-by":"crossref","unstructured":"C.\u00a0Paquin, D.\u00a0Stebila, G.\u00a0Tamvada, Benchmarking post-quantum cryptography in TLS, in J.\u00a0Ding, J.-P. Tillich, editors, Post-Quantum Cryptography\u201411th International Conference, PQCrypto 2020 (Springer, Heidelberg, 2020), pp. 72\u201391","DOI":"10.1007\/978-3-030-44223-1_5"},{"key":"9427_CR66","doi-asserted-by":"crossref","unstructured":"R.\u00a0Pass, On deniability in the common reference string and random oracle model, in D.\u00a0Boneh, editor, CRYPTO\u00a02003, volume 2729 of LNCS (Springer, Heidelberg, 2003), pp. 316\u2013337","DOI":"10.1007\/978-3-540-45146-4_19"},{"key":"9427_CR67","doi-asserted-by":"crossref","unstructured":"C.\u00a0Peikert, He gives C-sieves on the CSIDH, in A.\u00a0Canteaut, Y.\u00a0Ishai, editors, EUROCRYPT\u00a02020, Part\u00a0II, volume 12106 of LNCS (Springer, Heidelberg, 2020), pp. 463\u2013492","DOI":"10.1007\/978-3-030-45724-2_16"},{"key":"9427_CR68","unstructured":"T.\u00a0Perrin, The XEdDSA and VXEdDSA signature schemes (2016). https:\/\/signal.org\/docs\/specifications\/xeddsa\/"},{"key":"9427_CR69","doi-asserted-by":"crossref","unstructured":"B.\u00a0Poettering, P.\u00a0R\u00f6sler, Towards bidirectional ratcheted key exchange, in H.\u00a0Shacham, A.\u00a0Boldyreva, editors, CRYPTO\u00a02018, Part\u00a0I, volume 10991 of LNCS (Springer, Heidelberg, 2018), pp. 3\u201332","DOI":"10.1007\/978-3-319-96884-1_1"},{"key":"9427_CR70","doi-asserted-by":"crossref","unstructured":"D.\u00a0Pointcheval, O.\u00a0Sanders, Forward secure non-interactive key exchange, in M.\u00a0Abdalla, R.D. Prisco, editors, SCN 14, volume 8642 of LNCS (Springer, Heidelberg, 2014), pp. 21\u201339","DOI":"10.1007\/978-3-319-10879-7_2"},{"key":"9427_CR71","unstructured":"T.\u00a0Prest, P.-A. Fouque, J.\u00a0Hoffstein, P.\u00a0Kirchner, V.\u00a0Lyubashevsky, T.\u00a0Pornin, T.\u00a0Ricosset, G.\u00a0Seiler, W.\u00a0Whyte, Z.\u00a0Zhang, FALCON. Technical report, National Institute of Standards and Technology (2020). Available at https:\/\/csrc.nist.gov\/projects\/post-quantum-cryptography\/round-3-submissions"},{"key":"9427_CR72","unstructured":"Signal protocol: Technical documentation. https:\/\/signal.org\/docs\/"},{"key":"9427_CR73","doi-asserted-by":"crossref","unstructured":"N.\u00a0Unger, I.\u00a0Goldberg, Deniable key exchanges for secure messaging, in I.\u00a0Ray, N.\u00a0Li, C.\u00a0Kruegel, editors, ACM CCS 2015 (ACM Press, 2015), pp. 1211\u20131223","DOI":"10.1145\/2810103.2813616"},{"issue":"1","key":"9427_CR74","doi-asserted-by":"crossref","first-page":"21","DOI":"10.1515\/popets-2018-0003","volume":"2018","author":"N Unger","year":"2018","unstructured":"N.\u00a0Unger, I.\u00a0Goldberg, Improved strongly deniable authenticated key exchanges for secure messaging. PoPETs 2018(1), 21\u201366 (2018)","journal-title":"PoPETs"},{"key":"9427_CR75","doi-asserted-by":"crossref","unstructured":"N.\u00a0Vatandas, R.\u00a0Gennaro, B.\u00a0Ithurburn, H.\u00a0Krawczyk, On the cryptographic deniability of the signal protocol, in M.\u00a0Conti, J.\u00a0Zhou, E.\u00a0Casalicchio, A.\u00a0Spognardi, editors, ACNS 20, Part\u00a0II, volume 12147 of LNCS (Springer, Heidelberg, 2020), pp. 188\u2013209","DOI":"10.1007\/978-3-030-57878-7_10"},{"key":"9427_CR76","unstructured":"H.\u00a0Xue, M.H. Au, R.\u00a0Yang, B.\u00a0Liang, H.\u00a0Jiang, Compact authenticated key exchange in the quantum random oracle model. Cryptology ePrint Archive, Report 2020\/1282 (2020). https:\/\/eprint.iacr.org\/2020\/1282"},{"key":"9427_CR77","doi-asserted-by":"crossref","unstructured":"H.\u00a0Xue, X.\u00a0Lu, B.\u00a0Li, B.\u00a0Liang, J.\u00a0He, Understanding and constructing AKE via double-key key encapsulation mechanism, in T.\u00a0Peyrin, S.\u00a0Galbraith, editors, ASIACRYPT\u00a02018, Part\u00a0II, volume 11273 of LNCS (Springer, Heidelberg, 2018), pp. 158\u2013189","DOI":"10.1007\/978-3-030-03329-3_6"},{"key":"9427_CR78","doi-asserted-by":"crossref","unstructured":"Z.\u00a0Yang, Modelling simultaneous mutual authentication for authenticated key exchange, in J.L. Danger, M.\u00a0Debbabi, J.-Y. Marion, J.\u00a0Garcia-Alfaro, N.\u00a0Zincir\u00a0Heywood, editors, Foundations and Practice of Security (Springer, Cham, 2014), pp. 46\u201362","DOI":"10.1007\/978-3-319-05302-8_4"},{"key":"9427_CR79","doi-asserted-by":"crossref","unstructured":"Z.\u00a0Yang, Y.\u00a0Chen, S.\u00a0Luo, Two-message key exchange with strong security from ideal lattices, in N.P. Smart, editor, CT-RSA\u00a02018, volume 10808 of LNCS (Springer, Heidelberg, 2018), pp. 98\u2013115","DOI":"10.1007\/978-3-319-76953-0_6"},{"key":"9427_CR80","doi-asserted-by":"crossref","unstructured":"A.C.-C. Yao, Y.\u00a0Zhao, Deniable internet key exchange, in J.\u00a0Zhou, M.\u00a0Yung, editors, ACNS 10, volume 6123 of LNCS (Springer, Heidelberg, 2010), pp. 329\u2013348","DOI":"10.1007\/978-3-642-13708-2_20"},{"key":"9427_CR81","doi-asserted-by":"crossref","unstructured":"T.H. Yuen, M.F. Esgin, J.K. Liu, M.H. Au, Z.\u00a0Ding, DualRing: generic construction of ring signatures with efficient instantiations, in T.\u00a0Malkin, C.\u00a0Peikert, editors, CRYPTO\u00a02021, Part\u00a0I, volume 12825 of LNCS (Springer, Heidelberg, 2021), pp. 251\u2013281","DOI":"10.1007\/978-3-030-84242-0_10"}],"container-title":["Journal of Cryptology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s00145-022-09427-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s00145-022-09427-1\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s00145-022-09427-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,9,23]],"date-time":"2024-09-23T22:11:53Z","timestamp":1727129513000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s00145-022-09427-1"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,5,5]]},"references-count":81,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2022,7]]}},"alternative-id":["9427"],"URL":"https:\/\/doi.org\/10.1007\/s00145-022-09427-1","relation":{},"ISSN":["0933-2790","1432-1378"],"issn-type":[{"value":"0933-2790","type":"print"},{"value":"1432-1378","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,5,5]]},"assertion":[{"value":"30 September 2021","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"1 April 2022","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"1 April 2022","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"5 May 2022","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}],"article-number":"17"}}