Off-line Password Guessing Attacks Research Articles

A portable blind cloud storage scheme against compromised servers

Applications (Apps) generate large amounts of data on users’ storage-limited local devices. To alleviate the burden of local storage, users can outsource their App-generated data to a remote cloud server. Secure data outsourcing needs data portability and blindness. The former enables users to access data from multiple devices using a single password, and the latter ensures data privacy against unauthorized individuals. Portable blind cloud storage (PBCS) can satisfy both requirements. However, existing PBCS schemes are vulnerable to offline password guessing attacks (OPGA) if both the App server and the cloud server are compromised: an adversary can learn users’ passwords from compromised registered information of users. In this paper, we propose a PBCS scheme called IPBCS that is secure against OPGA. In IPBCS, a user hardens her/his password with a secret key, which is stored in trusted execution environments (TEE). With the hardened password and a user-specific randomness, a token can be derived for user authentication. By adopting TEE to protect secret keys, IPBCS guarantees security against OPGA even if both servers are compromised. Moreover, IPBCS adopts a password-based authentication mechanism to support authentication over public channels. Security analysis and performance evaluation demonstrate that IPBCS is secure and efficient.

Design of an anonymity-preserving three-factor authenticated key exchange protocol for wireless sensor networks

Recently, Farash et al. pointed out some security weaknesses of Turkanović et al.’s protocol, which they extended to enhance its security. However, we found some problems with Farash et al.’s protocol, such as a known session-specific temporary information attack, an off-line password-guessing attack using a stolen-smartcard, a new-smartcard-issue attack, and a user-impersonation attack. Additionally, their protocol cannot preserve user-anonymity, and the secret key of the gateway node is insecure. The main intention of this paper is to design an efficient and robust smartcard-based user authentication and session key agreement protocol for wireless sensor networks that use the Internet of Things. We analyze its security, proving that our protocol not only overcomes the weaknesses of Farash et al.’s protocol, but also preserves additional security attributes, such as the identity change and smartcard revocation phases. Moreover, the results of a simulation using AVISPA show that our protocol is secure against active and passive attacks. The security and performance of our work are also compared with a number of related protocols.

Cryptanalysis of a Remote User Authentication Scheme

Among many user authentications over insecure networks, password authentication is simple, convenient and widely adopted one. Chen and Lee proposed a new hash-based password authentication using smart card and claimed that their scheme could resist seven attacks as listed in their paper. However, in this paper, it is pointed out that Chen-Lee’s scheme is vulnerable to off-line password guessing, replay and impersonation attacks when the smart card is lost or stolen.

Security flaw of Hölbl et al.’s protocol

Recently, Hölbl et al. [M. Hölbl, T. Welzer, B. Brumen, Improvement of the Peyravian–Jeffries’s user authentication protocol and password change protocol, Computer Communications 31 (2008) 1945–1951] have proposed an improvement of Peyravian–Jeffries’s user authentication protocol and password change protocol [M. Peyravian, C. Jeffries, Secure remote user access over insecure networks, Computer Communications 29 (5–6) (2006) 660–667]. Peyravian–Jeffries’s scheme suffers from an active off-line password-guessing attack [J. Munilla, A. Peinado, Off-line password-guessing attack to Peyravian–Jeffries’s remote user authentication protocol, Computer Communications 30 (1) (2006) 52–54], and Hölbl et al. state that their improved protocol overcomes this weakness. However, we show in this paper that although this proposed protocol prevents this active attack, it remains vulnerable to a passive (simpler) off-line password-guessing attack.

Improvement of the Peyravian–Jeffries’s user authentication protocol and password change protocol

Remote authentication of users supported by passwords is a broadly adopted method of authentication within insecure network environments. Such protocols typically rely on pre-established secure cryptographic keys or public key infrastructure. Recently, Peyravian and Jeffries [M. Peyravian, C. Jeffries, Secure remote user access over insecure networks, Computer Communications 29 (5–6) (2006) 660–667] proposed a protocol for secure remote user access over insecure networks. Shortly after the protocol was published Shim [K.A. Shim, Security flaws of remote user access over insecure networks, Computer Communications 30 (1) (2006) 117–121] and Munilla et al. [J. Munilla, A. Peinado, Off-line password-guessing attack to Peyravian–Jeffries’s remote user authentication protocol, Computer Communications 30 (1) (2006) 52–54] independently presented an off-line guessing attack on the protocol. Based on their findings we present an improved secure password-based protocol for remote user authentication, password change, and session key establishment over insecure networks, which is immune against the attack.

Off-line password-guessing attack to Peyravian–Jeffries’s remote user authentication protocol

Recently, Peyravian and Jeffries [M. Peyravian, C. Jeffries, Secure remote user access over insecure networks, Computer Communications 29 (2006) 660–667] have proposed two set of protocols to perform remote user authentication and password change in a secure manner. The first set of protocols is based on hash functions, where no symmetric or asymmetric encryption scheme is applied. As Peyravian and Jeffries claim, these protocols suffer from an off-line password-guessing attack. They propose a second set of protocols based on Diffie–Hellman key agreement scheme to overcome the mentioned weakness. However, we show in this paper that this second set of protocols suffers also from the off-line password-guessing attack when a server impersonation attack is performed.

Off-line password-guessing attacks on the generalized key agreement and password authentication protocol

In this paper, we show that the generalized key agreement and password authentication protocol, proposed by Kwon and Song [T. Kwon, J. Song, A study on the generalized key agreement and password authentication protocol, IEICE Trans. Comm. E83-E (9) (2000) 2044–2050], is vulnerable to off-line password guessing attacks.