An off-line dictionary attack on a simple three-party key exchange protocol

Authors:
Junghyun Nam;Juryon Paik;Hyun-Kyu Kang;Ung Mo Kim;Dongho Won
Affiliations:
Department of Computer Science, Konkuk University, Chungju-si, Chungcheongbuk-do, Korea;Department of Computer Engineering, Sungkyunkwan University, Suwon-si, Gyeonggi-do, Korea;Department of Computer Science, Konkuk University, Chungju-si, Chungcheongbuk-do, Korea;Department of Computer Engineering, Sungkyunkwan University, Suwon-si, Gyeonggi-do, Korea;Department of Computer Engineering, Sungkyunkwan University, Suwon-si, Gyeonggi-do, Korea
Venue:
IEEE Communications Letters
Year:
2009

Citing 9
Cited 10

Refinement and extension of encrypted key exchange

ACM SIGOPS Operating Systems Review
Encrypted Key Exchange: Password-Based Protocols SecureAgainst Dictionary Attacks

SP '92 Proceedings of the 1992 IEEE Symposium on Security and Privacy
Three weaknesses in a simple three-party key exchange protocol

Information Sciences: an International Journal
Cryptanalysis of simple three-party key exchange protocol (S-3PAKE)

Information Sciences: an International Journal
Authenticated key exchange secure against dictionary attacks

EUROCRYPT'00 Proceedings of the 19th international conference on Theory and application of cryptographic techniques
Provably secure password-authenticated key exchange using Diffie-Hellman

EUROCRYPT'00 Proceedings of the 19th international conference on Theory and application of cryptographic techniques
Interactive diffie-hellman assumptions with applications to password-based authentication

FC'05 Proceedings of the 9th international conference on Financial Cryptography and Data Security
Password-Based authenticated key exchange in the three-party setting

PKC'05 Proceedings of the 8th international conference on Theory and Practice in Public Key Cryptography
Simple password-based encrypted key exchange protocols

CT-RSA'05 Proceedings of the 2005 international conference on Topics in Cryptology

A communication-efficient three-party password authenticated key exchange protocol

Information Sciences: an International Journal
An attack on an RFID authentication protocol conforming to EPC class 1 generation 2 standard

ICHIT'11 Proceedings of the 5th international conference on Convergence and hybrid information technology
Cryptanalysis of the user authentication scheme with anonymity

FGIT'11 Proceedings of the Third international conference on Future Generation Information Technology
A method for secure and efficient block cipher using white-box cryptography

Proceedings of the 6th International Conference on Ubiquitous Information Management and Communication
Cryptanalysis of a communication-efficient three-party password authenticated key exchange protocol

Information Sciences: an International Journal
Cryptanalysis of an efficient three-party password-based key exchange scheme

International Journal of Communication Systems
A Smart Card Based Efficient and Secured Multi-Server Authentication Scheme

Wireless Personal Communications: An International Journal
Security analysis and improvements of a communication-efficient three-party password authenticated key exchange protocol

The Journal of Supercomputing
Security Analysis of a Chaotic Map-based Authentication Scheme for Telecare Medicine Information Systems

Journal of Medical Systems
An undetectable on-line password guessing attack on Nam et al.'s three-party key exchange protocol

Journal of Computational Methods in Sciences and Engineering

Quantified Score

Hi-index	0.00

Visualization

Abstract

Key exchange protocols allow two or more parties communicating over a public network to establish a common secret key called a session key. Due to their significance in building a secure communication channel, a number of key exchange protocols have been suggested over the years for a variety of settings. Among these is the so-called S-3PAKE protocol proposed by Lu and Cao for password-authenticated key exchange in the three-party setting. In the current work, we are concerned with the password security of the S-3PAKE protocol. We first show that S-3PAKE is vulnerable to an off-line dictionary attack in which an attacker exhaustively enumerates all possible passwords in an off-line manner to determine the correct one. We then figure out how to eliminate the security vulnerability of S-3PAKE.