Cryptanalysis of two three-party encrypted key exchange protocols

  • Authors:

  • N. W. Lo;Kuo-Hui Yeh

  • Affiliations:

  • Department of Information Management, National Taiwan University of Science and Technology, # 43, Sec. 4, Keelung Rd., Taipei, 106, Taiwan, ROC;Department of Information Management, National Taiwan University of Science and Technology, # 43, Sec. 4, Keelung Rd., Taipei, 106, Taiwan, ROC

  • Venue:
  • Computer Standards & Interfaces
  • Year:
  • 2009

Quantified Score

Hi-index 0.00

Visualization

Abstract

Due to the simplicity of maintaining human memorable passwords without any assistant storage device, password-based three-party encrypted key exchange (3PEKE) protocol has become one of the most promising research fields on user authentication and secure communication. In 2008, Chen et al. and Yoon and Yoo both pointed that Chang and Chang's password-based 3PEKE scheme cannot resist against undetectable on-line password guessing attacks, and then respectively proposed an improved protocol to eliminate the security vulnerability. However, based on the security analyses conducted by us, we find that both of their protocols are still vulnerable against undetectable on-line password guessing attacks. Accordingly, we develop a novel 3PEKE protocol to remedy these authentication flaws. Moreover, our proposed protocol can achieve better performance efficiency by requiring only four message transmission rounds. In conclusion, we can claim that our proposed 3PEKE protocol is more secure and efficient in comparison with the protocols proposed by Chen et al. and Yoon and Yoo.