Dictionary Attacks against Password-Based Authenticated Three-Party Key Exchange Protocols

被引：11

作者：

Nam, Junghyun ^{[1
]}

Choo, Kim-Kwang Raymond ^{[2
]}

Kim, Moonseong ^{[3
]}

Paik, Juryon ^{[4
]}

Won, Dongho ^{[4
]}

机构：

[1] Konkuk Univ, Dept Comp Engn, Seoul, South Korea

[2] Univ S Australia, Adv Comp Res Ctr, Informat Assurance Res Grp, Adelaide, SA 5001, Australia

[3] Korean Intellectual Property Off, Informat & Commun Examinat Bur, Taejon, South Korea

[4] Sungkyunkwan Univ, Dept Comp Engn, Seoul, South Korea

来源：

KSII TRANSACTIONS ON INTERNET AND INFORMATION SYSTEMS | 2013年 / 7卷 / 12期

基金：

新加坡国家研究基金会;

关键词：

Password-based authenticated key exchange (PAKE); three-party key exchange; password security; offline dictionary attack; undetectable online dictionary attack; SECURITY; CRYPTANALYSIS; PROOFS;

D O I：

10.3837/tiis.2013.12.016

中图分类号：

TP [自动化技术、计算机技术];

学科分类号：

0812 ;

摘要：

A three-party password-based authenticated key exchange (PAKE) protocol allows two clients registered with a trusted server to generate a common cryptographic key from their individual passwords shared only with the server. A key requirement for three-party PAKE protocols is to prevent an adversary from mounting a dictionary attack. This requirement must be met even when the adversary is a malicious (registered) client who can set up normal protocol sessions with other clients. This work revisits three existing three-party PAKE protocols, namely, Guo et al.'s (2008) protocol, Huang's (2009) protocol, and Lee and Hwang's (2010) protocol, and demonstrates that these protocols are not secure against offline and/or (undetectable) online dictionary attacks in the presence of a malicious client. The offline dictionary attack we present against Guo et al.'s protocol also applies to other similar protocols including Lee and Hwang's protocol. We conclude with some suggestions on how to design a three-party PAKE protocol that is resistant against dictionary attacks

引用

页码：3244 / 3260

页数：17

共 50 条

[1] Password-based authenticated key exchange in the three-party setting
Abdalla, M.
Fouque, P.-A.
Pointcheval, D.
[J]. IEE Proceedings: Information Security, 2006, 153 (01): : 27 - 39
[2] Password-based authenticated key exchange in the three-party setting
Abdalla, M
Fouque, PA
Pointcheval, D
[J]. PUBLIC KEY CRYPTOGRAPHY - PKC 2005, 2005, 3386 : 65 - 84
[3] Enhancements of a Three-Party Password-Based Authenticated Key Exchange Protocol
Wu, Shuhua
Chen, Kefei
Zhu, Yuefei
[J]. INTERNATIONAL ARAB JOURNAL OF INFORMATION TECHNOLOGY, 2013, 10 (03) : 215 - 221
[4] Efficient three-party password-based authenticated key exchange protocol
[J]. Xu, C.-X, 1600, Univ. of Electronic Science and Technology of China (41):
[5] Strongly password-based three-party authenticated key exchange protocol
Lin, Yuanhui
Hou, Mengbo
Xu, Qiuliang
[J]. 2013 9TH INTERNATIONAL CONFERENCE ON COMPUTATIONAL INTELLIGENCE AND SECURITY (CIS), 2013, : 555 - 558
[6] How to Construct Secure and Efficient Three-Party Password-Based Authenticated Key Exchange Protocols
Wang, Weijia
Hu, Lei
Li, Yong
[J]. INFORMATION SECURITY AND CRYPTOLOGY, 2011, 6584 : 218 - +
[7] Attacks and solutions on a three-party password-based authenticated key exchange protocol for wireless communications
Chen, Chien-Ming
Wang, King-Hang
Yeh, Kuo-Hui
Xiang, Bin
Wu, Tsu-Yang
[J]. JOURNAL OF AMBIENT INTELLIGENCE AND HUMANIZED COMPUTING, 2019, 10 (08) : 3133 - 3142
[8] Cryptanalysis of a three-party password-based authenticated key exchange protocol
[J]. He, D. (hedebiao@163.com), 1600, Femto Technique Co., Ltd. (16):
[9] Attacks and solutions on a three-party password-based authenticated key exchange protocol for wireless communications
Chien-Ming Chen
King-Hang Wang
Kuo-Hui Yeh
Bin Xiang
Tsu-Yang Wu
[J]. Journal of Ambient Intelligence and Humanized Computing, 2019, 10 : 3133 - 3142
[10] Provably secure three-party password-based authenticated key exchange protocol
Zhao, Jianjie
Gu, Dawu
[J]. INFORMATION SCIENCES, 2012, 184 (01) : 310 - 323

← 1 2 3 4 5 →