An improvement on strong-password authentication protocols

Authors:
Ya-Fen Chang;Chin-Chen Chang
Affiliations:
Department of Computer Science and Information Engineering, National Chung Cheng University, Chiayi, Taiwan, R.O.C;Department of Information Engineering and Computer Science, Feng Chia University, Taichung, Taiwan,R.O.C
Venue:
ICESS'05 Proceedings of the Second international conference on Embedded Software and Systems
Year:
2005

Citing 7
Cited 0

Reducing risks from poorly chosen keys

SOSP '89 Proceedings of the twelfth ACM symposium on Operating systems principles
Augmented encrypted key exchange: a password-based protocol secure against dictionary attacks and password file compromise

CCS '93 Proceedings of the 1st ACM conference on Computer and communications security
Strong password-only authenticated key exchange

ACM SIGCOMM Computer Communication Review
Password authentication with insecure communication

Communications of the ACM
Encrypted Key Exchange: Password-Based Protocols SecureAgainst Dictionary Attacks

SP '92 Proceedings of the 1992 IEEE Symposium on Security and Privacy
Provably secure password-authenticated key exchange using Diffie-Hellman

EUROCRYPT'00 Proceedings of the 19th international conference on Theory and application of cryptographic techniques
ID-based key agreement for multimedia encryption

IEEE Transactions on Consumer Electronics

Quantified Score

Hi-index	0.00

Visualization

Abstract

Password authentication schemes can be divided into two types. One requires the easy-to-remember password, and the other requires the strong password. In 2000, Sandirigama et al. proposed a simple and secure password authentication protocol (SAS). Then, Lin et al. showed that SAS suffers from two weaknesses and proposed an improvement (OSPA) in 2001. However, Chen and Ku pointed out that both SAS and OSPA are vulnerable to the stolen-verifier attack. We also find that these two protocols lack the property of mutual authentication. Hence, we propose an improvement of SAS and OSPA to defend against the stolen-verifier attack and provide mutual authentication in this paper.