A simple and robust anonymous two-factor authenticated key exchange protocol

Abstract

Recently two-factor authenticated key exchange (AKE) protocols have been widely used in various networks to ensure communication security. In 2009, Sun et al. proposed an improved password authenticated key agreement scheme based on smart cards. It is efficient in two-factor authentication key exchange protocols. However, we found that the scheme of Sun et al. was vulnerable to a password-guessing attack and a key compromise impersonation (KCI) attack. We made an improvement on the scheme of Sun et al. by using an elegant but simple trick to eliminate the security vulnerabilities. The improved scheme possesses untraceability, which is absent in the scheme of Sun et al. but important in anonymous communication. Moreover, the new scheme can also resist KCI attack, which is a strong secure property in AKE protocol. We proved the security of our protocol in the random oracle model provided that the Elliptic Curve Gap Diffie–Hellman assumption holds. The trick used in this paper can provide a new way for designing authenticated key agreement in two-factor authentication mechanism. Copyright © 2012 John Wiley & Sons, Ltd.