Cryptanalysis and enhancements of efficient three-party password-based key exchange scheme

International Journal of Communication Systems

Volumn 26, Issue 5, 2013, Pages 674-686

  Wu, Shuhua ^a,b,c   Chen, Kefei ^a,d   Pu, Qiong ^b,c,e   Zhu, Yuefei ^c  

^a SHANGHAI JIAO TONG UNIVERSITY   (China)

^b UNIVERSITY OF CHINESE ACADEMY OF SCIENCES   (China)

^c INFORMATION ENGINEERING UNIVERSITY   (China)

^d Shanghai Key Lab of Scalable Computing and Systems   (China)

^e TONGJI UNIVERSITY   (China)

Author keywords

authenticated key exchange; dictionary attack; password based; three party

Indexed keywords

AUTHENTICATED KEY EXCHANGE; DICTIONARY ATTACK; OFF-LINE DICTIONARY ATTACKS; PASSWORD-BASED; PASSWORD-BASED KEY EXCHANGE; THREE-PARTY;

AUTHENTICATION;

COMPUTER CRIME;

EID: 84876132598     PISSN: 10745351     EISSN: 10991131     Source Type: Journal    
DOI: 10.1002/dac.1362     Document Type: Article

References (47)

1. Bellare M, Pointcheval D, Rogaway P,. Authenticated key exchange secure against dictionary attacks. In Proceedings of Advances in Cryptology- EUROCRYPT'2000 (LNCS 1807). Springer: Berlin, 2000; 139-155.
2. Boyko V, MacKenzie PD, Patel S,. Provably secure password-authenticated key exchange using Diffie-Hellman. In Proceedings of Advances in Cryptology-EUROCRYPT '2000 (LNCS 1807). Springer: Berlin, 2000; 156-171.
3. Bresson E, Chevassut O, Pointcheval D,. New security results on encrypted key exchange. In Proceedings of 7th International Workshop on Theory and Practice in Public Key Cryptography-PKC'2004 (LNCS 2947). Springer: Berlin, 2004; 145-158.
4. Gennaro R, Lindell Y,. A framework for password-based authenticated key exchange. In Proceedings of Advances in Cryptology -EUROCRYPT'2003 (LNCS 26560. Springer: Berlin, 2003; 524-543.
5. Goldreich O, Lindell Y,. Session-key generation using human passwords only. In Proceedings of Advances in Cryptology-CRYPTO 2001 (LNCS 2139). Springer: Berlin, 2001; 408-432.
6. Halevi S, Krawczyk H,. Public-key cryptography and password protocols. ACM Transactions on Information and System Security 1999; 2 (3): 230-268.
7. MacKenzie PD, Patel S, Swaminathan R,. Password-authenticated key exchange based on RSA. In Proceedings of Advances in Cryptology-ASIACRYPT 2000 (LNCS 1976). Springer: Berlin, 2000; 599-613.
8. Abdalla M, Chevassut O, Pointcheval D,. One-time verifier-based encrypted key exchange. In Proceedings of the 8th International Workshop on Theory and Practice in Public Key-PKC '05 (LNCS 3386). Springer: Berlin, 2005; 47-64.
9. Abdalla M, Pointcheval D,. Simple password-based encrypted key exchange protocols. In Proceedings of Topics in Cryptology-CT-RSA 2005 (LNCS 3376). Springer: Berlin, 2005; 191-208.
10. Lee SW, Kim HS, Yoo KY,. Efficient verifier-based key agreement for three parties without server's public key. Applied Mathematics and Computation 2005; 167 (2): 996-1003.
11. Lin CL, Sun HM, Steiner M, Hwang MT,. Three-party encrypted key exchange without server's public keys. IEEE Communication Letters 2001; 5 (12): 497-499.
12. Sun H, Chen MB, Hwang T,. Secure key agreement protocols for three-party against guessing attacks. The Journal of Systems and Software 2005; 75: 63-1003.
13. Ding Y, Horster P,. Undetectable on-line password guessing attacks. ACM Operating Systems Review 1995; 29 (24): 77-86.
14. Law L, Menezes L, Qu A, Solinas M, Vanstone JS,. An efficient protocol for authenticated key agreement. Designs, Codes and Cryptography 2003; 28 (2): 119-134.
15. Lee TF, Hwang T, Lin CL,. Enhanced three-party encrypted key exchange without servers public keys. Computers and Security 2004; 23 (7): 571-577.
16. Lin C, Sun HM, Hwang T,. Three-party encrypted key exchange attacks and a solution. ACM Operating Systems Review 2000; 34 (4): 12-20.
17. Chang FY,. A practical three-party key exchange protocol with round efficiency. International Journal of Innovative Computing, Information and Control 2008; 4 (4): 953-960.
18. Abdalla M, Fouque PA, Pointcheval D,. Password-based authenticated key exchange in the three-party setting. In Proceedings of PKC'2005, Vol. 3386, Lecture Notes in Computer Science. Springer: Berlin, 2005; 65-84. Full version appeared in IEE Information Security 2006, 153(1): 27-39.
19. Abdalla M, Pointcheval D,. Interactive Diffie-Hellman assumptions with applications to password-based authentication. In Proceedings of Financial Cryptography'2005, Vol. 3570, Lecture Notes in Computer Science. Springer: Berlin, 2005; 341-356.
20. Lu RX, Cao ZF,. Simple three-party key exchange protocol. Computers and Security 2007; 26: 94-97.
21. Huang HF,. A simple three-party password-based key exchange protocol. International Journal of Communication Systems 2009 John Wiley & Sons, DOI: 10.1002/dac.1002.
22. Ding Y, Horster P,. Undetectable on-line password guessing attacks. ACM Operating Systems Review 1995; 29: 77-86.
23. Kim HS, Choi JY,. Enhanced password-based simple three-party key exchange protocol. Computers and Electrical Engineering 2009; 22: 857-862.
24. Guo H, Li Z, Mu Y, Zhang X,. Cryptanalysis of simple three-party key exchange protocol. Computers and Security 2008; 27: 16-21.
25. Chung HR, Ku WC,. Three weaknesses in a simple three-party key exchange protocol. Information Science 2008; 178: 220-229.
26. Lo NW, Yeh KH,. Cryptanalysis of two three party encrypted key exchange protocols. Computer Standards & Interfaces 2009, DOI: 10.1016/j.csi.2009.03. 002.
27. Phan Raphael CW, Yau WC, Bok-Min G,. Cryptanalysis of simple three-party key exchange protocol (S-3PAKE). Information Science 2008; 178: 2849-2856.
28. Nam J,. Infringing and Improving Password Security of a Three-Party Key Exchange Protocol. Available at http://eprint.iacr.org/2008/065/.
29. Nam J, Lee Y, Kim S, Won D,. Security weakness in a three-party pairing-based protocol for password authenticated key exchange. Information Sciences 2007; 177 (6): 1364-1375.
30. Wang W, Hu L,. Efficient and provably secure generic construction of three-party password-based authenticated key exchange protocols. In Proceedings of INDOCRYPT 2006, Vol. 4329, Lecture Notes in Computer Science. Springer: Berlin, 2006; 118-132.
31. Choo KKR, Boyd C, Hitchcock Y,. Examining indistinguishability-based proof models for key establishment protocols. In Proceedings of Advances in Cryptology-Asiacrypt'05, Vol. 3788, Lecture Notes in Computer Science, Springer: Berlin, 2005; 585-604.
32. Lou DC, Huang H F,. Efficient three-party password-based key exchange scheme. International Journal of Communication Systems 2010 John Wiley & Sons, Published online in Wiley Online Library (wileyonlinelibrary.com). DOI: 10.1002/dac.1172.
33. Hankerson D, Menezes A, Vanstone S,. Guide to elliptic curve cryptography. Springer: Berlin, 2004.
34. Koblitz N,. Elliptic curve cryptosystem. Mathematics of Computation 1987; 48: 203-209.
35. Boyd C, Montague P, Nguyen K,. Elliptic curve based password authenticated key exchange protocols. In Proceedings of 28th Australasian Conference on Information Security and Privacy-ACISP 2001, Vol. 2119, Lecture Notes in Computer Science. Springer: Berlin, 2001; 487-501.
36. Blake IF, Seroussi G, Smart NP,. Elliptic Curves in Cryptography. Cambridge University Press: Cambridge, 1999.
37. Barreto PSLM, Kim HY, Lynn B,. 2002. Efficient algorithms for pairing-based cryptosystems. In Proceedings of CRYPTO'2002, Vol. 2442, Lecture Notes in Computer Science. Springer: Berlin; 354-368.
38. Bellare M, Rogaway P,. Provably secure session key distribution-the three party case. In Proceedings of 28th Annual ACM Symposium on Theory of Computing. ACM Press, 1996; 57-66.
39. Advanced Encryption Standard. .
40. Wu TY, Tseng YM,. An efficient user authentication and key exchange protocol for mobile client-server environment. Computer Networks 2010; 54 (9): 1520-1530.
41. Shamus Software, http://www.shamus.ie/index.php.
42. Philips HiPerSmart, http://www.testech-elect.com/ashling/hps\-tools.htm.
43. Abdalla M, Bellare M, Rogaway P,. The oracle Diffie-Hellman assumptions and an analysis of DHIES. In Proceedings of CT-RSA'2001. Springer: Berlin, 2001; 143-158.
44. Abdalla M, Bresson E, Chevassut O, Möller B, Pointcheval D,. Provably secure password-based authentication in TLS. In Proceedings of AsiaCCS'06. ACM, 2006; 35-45.
45. Bellare M, Desai A, Pointcheval D, Rogaway P,. Relations among notions of security for public-key encryption schemes. In Proceedings of Advances in Cryptology-CRYPTO 1998, Vol. 1462, Lecture Notes in Computer Science, Springer: Berlin, 1998; 26-45.
46. Fiat A, Shamir A,. How to prove yourself: practical solutions to identification and signature problems. In Proceedings of Advances in Cryptology-CRYPTO 1986, Vol. 263, Lecture Notes in Computer Science. Springer: Berlin, 1986; 186-194.
47. Bellare M, Rogaway P,. Random oracles are practical: a paradigm for designing efficient protocols. In Proceedings of 1st ACM Conference on Computer and Communications Security-ACM CCS 1993. ACM Press, 1993; 62-73.