Data security in computer networks is becoming increasingly important due to the expanding role of distributed computation, distributed databases and tele-communication applications such as electronic mail and electronic funds transfer. For privacy, information which may be highly sensitive or privileged must be encrypted with secret keys which are shared by the communicating parties. These keys are generated by key agreement protocols. Traditionally such protocols were designed by trial and

more »

... or. History has proven this method to be unreliable: many protocols were broken or serious flaws were exposed. In this paper we discuss the security aspects of key agreement protocols. In particular, we consider two models for provable security, one based on probabilistic encryption, the other on zero-knowledge. We propose a variant of the Diffie-Hellman key agreement protocol which is provably secure and efficient.