Cryptanalysis of an efficient password-based group key agreement protocol

Abstract

Password-based group key agreement protocols are fundamental component of the communications systems. In 2009, Zheng et al. proposed an efficient and provably secure password-based agreement protocol and declared their protocol is secure in the ideal-cipher and random oracle models under the DDH problem. In this paper, we propose an online dictionary attack against Zheng et al.’ protocol, which an adversary can test more than one password in a session. If the number of users is few, this attack can not lead to security problem. However, if many users participate in this protocol, the security problem can not be ignored.