Enhanced password-based simple three-party key exchange protocol

被引：36

作者：

Kim, Hyun-Seok ^{[1
]}

Choi, Jin-Young ^{[1
]}

机构：

[1] Korea Univ, Dept Comp Sci & Engn, Seoul 136701, South Korea

来源：

COMPUTERS & ELECTRICAL ENGINEERING | 2009年 / 35卷 / 01期

关键词：

Password-based key exchange protocol; Undetectable on-line guessing attack; BPR model; SECURE; AGREEMENT;

D O I：

10.1016/j.compeleceng.2008.05.007

中图分类号：

TP3 [计算技术、计算机技术];

学科分类号：

0812 ;

摘要：

Recently, Lu and Cao proposed a simple three-party password-based key exchange (STPKE) protocol based on the CCDH assumption. They claimed that their protocol is secure, efficient, and practical. In this paper, unlike their claims, we find that the STPKE protocol is still vulnerable to undetectable on-line password guessing attacks by using formal description, BPR model. These weakness is due to the fact that the messages of the communicants are not appropriately encrypted into the exchanged cryptographic messages. To enhance the security of the STPKE protocol, we suggest a countermeasure to resist our described attacks while the merits of the original protocol are left unchanged. (C) 2008 Elsevier Ltd. All rights reserved.

引用

页码：107 / 114

页数：8

共 19 条

[1]

Abdalla M, 2005, LECT NOTES COMPUT SC, V3376, P191

[2]

[Anonymous], LNCS

[3]

[Anonymous], ACM OPERATING SYSTEM

[4]

Bellare M, 2000, LECT NOTES COMPUT SC, V1807, P139

[5]

Bellare M., 1995, Proceedings of the Twenty-Seventh Annual ACM Symposium on the Theory of Computing, P57, DOI 10.1145/225058.225084

[6]

Bellare M., 1993, C COMPUTER COMMUNICA, P62

[7]

Bellovin S. M., 1992, Proceedings. 1992 IEEE Computer Society Symposium on Research in Security and Privacy (Cat. No.92CH3157-5), P72, DOI 10.1109/RISP.1992.213269

[8]

BYUN JW, 2007, INFORM SCI, DOI DOI 10.1016/J.INS.2007.03.24

[9] Simple authenticated key agreement and protected password change protocol [J].

Chang, TY ;

Yang, WP ;

Hwang, MS .

COMPUTERS & MATHEMATICS WITH APPLICATIONS, 2005, 49 (5-6) :703-714

[10] A new method for using hash functions to solve remote user authentication [J].

Chen, Tzung-Her ;

Lee, Wei-Bin .

COMPUTERS & ELECTRICAL ENGINEERING, 2008, 34 (01) :53-62

← 1 2 →