Cryptanalysis of a communication-efficient three-party password authenticated key exchange protocol

Authors:
Shuhua Wu;Qiong Pu;Shengbao Wang;Debiao He
Affiliations:
Department of Network Engineering, Information Engineering University, Zhengzhou, China and State Key Laboratory of Information Security, Graduate University of Chinese Academy of Sciences, Beijin ...;CIMS Research Center, Tongji Univerity, Shanghai, China;State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing 100876, China;School of Mathematics and Statistics, Wuhan University, Wuhan, China
Venue:
Information Sciences: an International Journal
Year:
2012

Citing 36
Cited 1

Refinement and extension of encrypted key exchange

ACM SIGOPS Operating Systems Review
Undetectable on-line password guessing attacks

ACM SIGOPS Operating Systems Review
Public-key cryptography and password protocols

ACM Transactions on Information and System Security (TISSEC)
Three-party encrypted key exchange: attacks and a solution

ACM SIGOPS Operating Systems Review
Elliptic Curve Based Password Authenticated Key Exchange Protocols

ACISP '01 Proceedings of the 6th Australasian Conference on Information Security and Privacy
The Oracle Diffie-Hellman Assumptions and an Analysis of DHIES

CT-RSA 2001 Proceedings of the 2001 Conference on Topics in Cryptology: The Cryptographer's Track at RSA
Session-Key Generation Using Human Passwords Only

CRYPTO '01 Proceedings of the 21st Annual International Cryptology Conference on Advances in Cryptology
Password-Authenticated Key Exchange Based on RSA

ASIACRYPT '00 Proceedings of the 6th International Conference on the Theory and Application of Cryptology and Information Security: Advances in Cryptology
The Gap-Problems: A New Class of Problems for the Security of Cryptographic Schemes

PKC '01 Proceedings of the 4th International Workshop on Practice and Theory in Public Key Cryptography: Public Key Cryptography
Optimal authentication protocols resistant to password guessing attacks

CSFW '95 Proceedings of the 8th IEEE workshop on Computer Security Foundations
Guide to Elliptic Curve Cryptography

Guide to Elliptic Curve Cryptography
Password-based user authentication and key distribution protocols for client-server applications

Journal of Systems and Software
Secure key agreement protocols for three-party against guessing attacks

Journal of Systems and Software - Special issue: Software engineering education and training
Cryptography and Network Security (4th Edition)

Cryptography and Network Security (4th Edition)
Provably secure password-based authentication in TLS

ASIACCS '06 Proceedings of the 2006 ACM Symposium on Information, computer and communications security
Three weaknesses in a simple three-party key exchange protocol

Information Sciences: an International Journal
Security enhancement for a three-party encrypted key exchange protocol against undetectable on-line password guessing attacks

Computer Standards & Interfaces
Enhanced password-based simple three-party key exchange protocol

Computers and Electrical Engineering
Communication-efficient three-party protocols for authentication and key agreement

Computers & Mathematics with Applications
Provably Secure Password-Based Three-Party Key Exchange With Optimal Message Steps

The Computer Journal
An off-line dictionary attack on a simple three-party key exchange protocol

IEEE Communications Letters
Simple password-based three-party authenticated key exchange without server public keys

Information Sciences: an International Journal
Authenticated key exchange secure against dictionary attacks

EUROCRYPT'00 Proceedings of the 19th international conference on Theory and application of cryptographic techniques
Provably secure password-authenticated key exchange using Diffie-Hellman

EUROCRYPT'00 Proceedings of the 19th international conference on Theory and application of cryptographic techniques
A framework for password-based authenticated key exchange

EUROCRYPT'03 Proceedings of the 22nd international conference on Theory and applications of cryptographic techniques
A communication-efficient three-party password authenticated key exchange protocol

Information Sciences: an International Journal
A security weakness in Abdalla et al.'s generic construction of a group key exchange protocol

Information Sciences: an International Journal
Efficient three-party password-based key exchange scheme

International Journal of Communication Systems
Provably secure one-round identity-based authenticated asymmetric group key agreement protocol

Information Sciences: an International Journal
Provably secure three-party password-based authenticated key exchange protocol

Information Sciences: an International Journal
Examining indistinguishability-based proof models for key establishment protocols

ASIACRYPT'05 Proceedings of the 11th international conference on Theory and Application of Cryptology and Information Security
Interactive diffie-hellman assumptions with applications to password-based authentication

FC'05 Proceedings of the 9th international conference on Financial Cryptography and Data Security
One-Time verifier-based encrypted key exchange

PKC'05 Proceedings of the 8th international conference on Theory and Practice in Public Key Cryptography
Password-Based authenticated key exchange in the three-party setting

PKC'05 Proceedings of the 8th international conference on Theory and Practice in Public Key Cryptography
Simple password-based encrypted key exchange protocols

CT-RSA'05 Proceedings of the 2005 international conference on Topics in Cryptology
Protecting poorly chosen secrets from guessing attacks

IEEE Journal on Selected Areas in Communications

Finding and fixing vulnerabilities in several three-party password authenticated key exchange protocols without server public keys

Information Sciences: an International Journal

Quantified Score

Hi-index	0.07

Visualization

Abstract

We revisit the communication-efficient three-party password authenticated key exchange protocol recently proposed by Chang et al. We show it is insecure against partition attacks, whereby the adversary can guess the correct password off-line. Thereafter we propose an enhanced protocol that can resist the attack described and yet is quite efficient. Furthermore, we prove its security in a widely accepted model.