HPAKE: Password Authentication Secure against Cross-Site User Impersonation

  • Authors:
  • Xavier Boyen

  • Affiliations:
  • Stanford University,

  • Venue:
  • CANS '09 Proceedings of the 8th International Conference on Cryptology and Network Security
  • Year:
  • 2009

Quantified Score

Hi-index 0.01

Visualization

Abstract

We propose a new kind of asymmetric mutual authentication from passwords with stronger privacy against malicious servers, lest they be tempted to engage in "cross-site user impersonation" to each other. It enables a person to authenticate (with) arbitrarily many independent servers, over adversarial channels, using a memorable and reusable single short password. Beside the usual PAKE security guarantees, our framework goes to lengths to secure the password against brute-force cracking from privileged server information.