Security analysis of a password-based authentication protocol proposed to IEEE 1363

Theoretical Computer Science

Volumn 352, Issue 1-3, 2006, Pages 280-287

  Zhao, Zhu ^a   Dong, Zhongqi ^b   Wang, Yongge ^c  

^a HEXI UNIVERSITY   (China)

^b LANZHOU UNIVERSITY   (China)

^c UNIVERSITY OF NORTH CAROLINA AT CHARLOTTE   (United States)

Author keywords

AuthA; Dictionary attacks; EKE; Password based key agreement

Indexed keywords

CRYPTOGRAPHY; MATHEMATICAL MODELS; NETWORK PROTOCOLS;

AUTHA; DICTIONARY ATTACKS; EKE; PASSWORD-BASED KEY AGREEMENT;

SECURITY OF DATA;

EID: 32644442153     PISSN: 03043975     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.tcs.2005.11.038     Document Type: Article

References (26)

1. M. Bellare, A. Boldyreva, A. Desai, D. Pointcheval, Key-privacy in public-key encryption, in: Asiancrypt '01, Lecture Notes in Computer Science, Vol. 2248, Springer, Berlin, 2001, pp. 566-582.
2. M. Bellare, D. Pointcheval, P. Rogaway, Authenticated key exchange secure against dictionary attacks, Advances in Cryptology - Eurocrypt' 2000, Lecture Notes in Computer Science, Vol. 1807, Springer, Berlin, 2000, pp. 139-155.
3. M. Bellare, P. Rogaway, The AuthA protocol for password-based authenticated key exchange, Contributions to IEEE P1363.2 working group. http://grouper.ieee.org/groups/1363/passwdPK/contributions.html
4. S. Bellovin, M. Merritt, Encrypted key exchange: password-based protocols secure against dictionary attacks, Proc. 1992 IEEE Computer Society Conf. on Research in Security and Privacy, 1992, pp. 72-84.
5. J. Black, P. Rogaway, Ciphers with arbitrary finite domains, Proc. CT-RSA 2002, pp. 114-130.
6. C. Boyd, P. Montague, K. Nguyen, Elliptic curve based password authenticated key exchange protocols, in: ACISP '01, Lecture Notes in Computer Science, Vol. 2119, Springer, Berlin, 2001, pp. 487-501.
7. V. Boyko, P. MacKenzie, S. Patel, Provable secure password authenticated key exchange using Diffie-Hellman, Advances in Cryptology - Eurocrypt' 2000, Lecture Notes in Computer Science, Vol. 1807, Springer, Berlin, 2000, pp. 156-171.
8. E. Bresson, O. Chevassut, D. Pointcheval, Security proofs for an efficient password-based key exchange, Proc. 10th ACM Conf. on Computer and Communications Security, 2003, pp. 241-250.
9. P. Buhler, T. Eirich, M. Steiner, M. Waidner, Secure password-based cipher suite for TLS, Proc. Network and Distributed Systems Security Symposium, February, 2000.
10. L. Gong, M. Lomas, R. Needham, and J. Saltzer Protecting poorly chosen secrets from guessing attacks IEEE J. Selected Areas Comm. 11 5 1993 648 656
11. S. Halevi, and H. Krawczyk Public-key cryptography and password protocols ACM Trans. Inform. System Security 2 3 1999 230 268
12. IEEE P1363.2 〈 http://grouper.ieee.org/groups/1363/passwdPK/ submissions.html 〉
13. D. Jablon Strong password-only authentication key exchange ACM Comput. Communications Rev. 26 5 1996 5 26 This is also a submission to IEEE P1363.2. Available from IEEE P1363.2 〈 http://grouper.ieee.org/groups/1363/passwdPK/ submissions.html 〉
14. Y. Lee, and J.Lee. EC-SRP protocol: elliptic curve secure remote password protocol Korea Inst. Inform. Security Cryptol. 9 1 1999 85 102
15. C. Lim, P. Lee, A key recovery attack on discrete log-based schemes using a prime order subgroup, Advances in Cryptology - Crypto' 97, Lecture Notes in Computer Science, Vol. 1294, Springer, Berlin, 1997, pp. 249-263.
16. S. Lucks. Open key exchange: how to defeat dictionary attacks without encrypting public keys, Proc. Security Protocols Workshop, Lecture Notes in Computer Science, Vol. 1361, Springer, Berlin, 1997.
17. A. Menezes, M. Qu, S. Vanstone, Key agreement and the need for authentication, Workshop records of PKS'95, Toronto, Canada.
18. A. Menezes, P. van Oorschot, and S. Vanstone Handbook of Applied Cryptography 1996 CRC Press Boca Raton, FL
19. S. Patel, Number theoretic attacks on secure password schemes, in: Proc. IEEE Symp. on Security and Privacy, IEEE Press, Silver Spring, MD, 1997, pp. 236-247.
20. SACRED, Securely Available Credentials (sacred), IETF Working Group. More information is available from: 〈 http://www.ietf.org/html.charters/sacred- charter.html 〉
21. M. Steiner, P. Buhler, T. Eirich, and M. Waidner Secure password-based cipher suite for TLS ACM Trans. Inform. System Security 4 2 2001 134 157
22. D. Taylor, Using SRP for TLS authentication, November 2002, working in progress Internet Draft.
23. P. van Oorschot, M. Wiener, On Diffie-Hellman key agreement with short exponents, Advances in Cryptology - Eurocrypt' 96, Lecture Notes in Computer Science, Vol. 1070, Springer, Berlin, 1996, pp. 332-343.
24. Y. Wang. Elliptic curve based SRP protocol SRP5, IEEE P1363.2 standards. http://grouper.ieee.org/groups/1363/passwdPK/contributions.html
25. T. Wu, The secure remote password protocol, in: Proc. 1998 Internet Society Symp. on Network and Distributed Systems Security, San Diego, CA, 1998, pp. 97-111.
26. T. Wu, SRP6: Improvements and refinements to the secure remote password protocol. 〈 http://srp.stanford.edu/ 〉