Improvement in new three-party-authenticated key agreement scheme based on chaotic maps without password table

Abstract

A three-party-authenticated key agreement (3PAKA) scheme allows two participants to establish shared secure session key (3SK) via trusted server over a public network. Recently, Lee et al. (Nonlinear Dyn 79(4):2485–2495, 2015) proposed a new 3PAKA protocol based on chaotic maps without password table. They claimed that the proposed scheme can establish a common session key among two users with security and users anonymity. Unfortunately, Lee et al.’s scheme is vulnerable to impersonation attack when the adversary is an internal user. Furthermore, in this paper, we will prove that Lee et al.’s scheme cannot guarantee user anonymity. To exhibit these flaws, we apply an automatic protocol verifier tool, Proverif. Therefore, we have put forward some improvements to overcome the weaknesses of Lee et al.’s protocol. We apply Proverif to show that the proposed improvement can satisfy security and authentication properties. The performance analysis shows that the proposed enhancement is efficient.