VSPAKE: Provably secure verifier-based PAKE protocol for client/server model in TLS ciphersuite

Abstract

Nowadays, password-authenticated key exchange (PAKE) protocols have actually been widely used in our daily life to provide security assurance, by which two parties can achieve mutual authentication and cryptographic session key establishment via a shared memorable password. In this paper, an efficient verifier-based PAKE protocol is presented in the form of TLS ciphersuite, which is essentially a variant of the symmetric SPAKE protocol and thus named as VSPAKE. Besides resistance to the tricky offline password guessing attack, the new VSPAKE protocol is secure against the server compromise attack. In the random oracle model, the new VSPAKE protocol is formally proved under the BPR security model by only using the basic CDH security assumption, making it gain certain security advantages in security aspect over the recently proposed TBVPAKE protocol, etc. What is more, compared with its very relevant KC-SPAKE2+ protocol, the new VSPAKE protocol has computational efficiency advantages over it in the client side and has comparable computational efficiency in the server side. Therefore, the new VSPAKE protocol is likely to be as a good choice for some applications in practice.