Off-line dictionary attack on password-based authenticated key exchange protocols

Abstract

In 2010, Lee et al proposed two simple and efficient three-party password-authenticated key exchange protocols that had been proven secure in the random oracle model. They argued that the two protocols could resist offline dictionary attacks. Indeed, the provable approach did not provide protection against off-line dictionary attacks. This paper shows that the two protocols are vulnerable to off-line dictionary attacks in the presence of an inside attacker because of an authentication flaw. This study conducts a detailed analysis on the flaw in the protocols and also shows how to eliminate the security flaw.