ECC-Based Password-Authenticated Key Exchange in the Three-Party Setting

This paper investigates three-party password authenticated key exchange protocols using elliptic curve cryptosystem (ECC). We first show that the direct elliptic curve analog of Chien’s protocol proposed most recently is vulnerable to off-line dictionary attack. Thereafter, we present an enhanced protocol based on ECC. Our proposal can defeat password-guessing attacks and the stolen-verifier attacks. And yet, it is also efficient. Furthermore, we can provide the rigorous proof of the security for it. Therefore, the protocol is quite popular in low resource environments.