Password-authenticated Key Exchange Protocol Research Articles

TBVPAKE: An efficient and provably secure verifier-based PAKE protocol for IoT applications

Password-authenticated key exchange (PAKE) is an important cryptographic primitive by which two parties are allowed to authenticate each other and establish a cryptographically strong key using a low-entropy password over an insecure channel. Therefore, it is suitable for access control and securing communications between low-cost Internet of Things (IoT) devices where sound security mechanism is difficult to be applied. This paper makes a contribution to securing IoT applications by presenting a secure, efficient and easy-to-implement verifier-based PAKE protocol, named as TBVPAKE (short for Two-Basis Verifier-based PAKE). It is secure against the off-line dictionary attack and server compromise attack, and supports the perfect forward secrecy. Under the widely accepted BPR security model, TBVPAKE is formally proved in this paper in the random oracle model by reducing its security to the Computational Diffie–Hellman (CDH) and Simultaneous Diffie–Hellman (SDH) security assumptions. In addition, we compare the new TBVPAKE with some other outstanding verifier-based PAKE protocols by instantiating them over a commonly used elliptic curve group, and the comparative analysis results definitely show that the new TBVPAKE offers better computational efficiency and ease of implementation. Therefore, the new TBVPAKE might be a better choice for securing IoT applications.

Efficient and Strong Symmetric Password Authenticated Key Exchange With Identity Privacy for IoT

Password authenticated key exchange (PAKE) allows two parties with a shared password to establish a session key. In order to provide secure and private communication between devices in an Internet of Things (IoT) environment, the PAKE protocol is considered one of the most common and promising security methods. However, many existing PAKE proposals still face challenges in security and efficiency. First, both the terminals of participants may suffer from the compromise attack and precomputation attack, which will lead to the leakage of password. Second, the majority of the existing schemes cannot guarantee participants’ identity privacy. Third, most PAKE protocols are not suitable for IoT devices with limited computing capability because of a large number of exponential and pairing operations. To address these issues, we propose a strong symmetric PAKE protocol for IoT devices, which only requires 3 exponentiations per party. The proposed scheme can protect both parties from compromise and precomputation attacks, in which the password file relies on the identity and random salt. What’s more, our protocol guarantees the identity privacy, that is, the transmitted record and password file will not reveal the identity information. We further present a new security model for our protocol, and prove that the proposed scheme is secure under this model. Finally, we show the practicality of our PAKE via experiments and efficiency analysis.

Guest Editorial: Selected papers from the 24th International Conference on Information Security and Cryptology (ICISC 2021)

Guest Editorial: Selected papers from the 24th International Conference on Information Security and Cryptology (ICISC 2021)

Efficient module learning with errors‐based post‐quantum password‐authenticated key exchange

Password-authenticated key exchange (PAKE) is a cryptographic primitive that can establish secure remote communications between the client and the server, especially with the advantage of amplifying memorable passwords into strong session keys. However, the arrival of the quantum computing era has brought new challenges to traditional PAKE protocols. Thus, designing an efficient post-quantum PAKE scheme becomes an open research question. In this paper, the authors construct a quantum-safe PAKE protocol, which is a horizontal extension of the password-authenticated key (PAK) protocol in the field of module lattices. Subsequently, the authors accompany the proposed protocol with a rigorous security proof in the random oracle model with two adaptions: applying the CDF-Zipf model to characterise the ability of the adversary and using the pairing with errors assumption to simplify the proof. Taking the flexibility of the module learning with errors (MLWE) problem, the authors elaborately select three parameter sets to meet different application scenarios. Specifically, the authors’ Recommended-PAKE implementation achieves 177-bit post-quantum security with a generous margin to cope with later improvement in cryptanalysis. The performance results indicate that the authors’ MLWE-PAKE is quite practical: compared with the latest Yang-PAK, the authors’ Recommended-PAK reduces the communication cost and the running time by 36.8% and 13.8%, respectively.

Further Analysis and Improvements of a Lattice-Based Anonymous PAKE Scheme

To improve the security of mobile networks in the postquantum era, Dabra <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.</i> recently proposed a lattice-based anonymous password-authenticated key exchange (LBA-PAKE) protocol for mobile devices. Especially, LBA-PAKE is claimed to support the key reuse. However, we find that LBA-PAKE is still vulnerable to the signal leakage attack when the master key is reused. We propose two strategies to reduce the needed number of queries in our attack. Compared to the method of Bindel <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.</i> , our method reduces the required queries by more than 75%. Our experiments show that breaking LBA-PAKE needs less than 2 min. Through analysis of why LBA-PAKE fails in their security proof, we further propose an improved protocol without incurring extra computation costs. The formal security analysis shows that our improved scheme supports all features of LBA-PAKE while thwarting the signal leakage attack. Moreover, the implementation of our improved protocol demonstrates its efficiency in mobile networks.

Post-Quantum Secure Password-Authenticated Key Exchange Based on Ouroboros

Password-authenticated key exchange (PAKE) protocols play an important role in cryptography. Most of PAKEs are based on the Diffie–Hellman key exchange protocols or RSA encryption schemes, but their security is threatened by quantum computers. In this study, we propose the first code-based PAKE protocol based on Ouroboros, which is a code-based key exchange protocol. Our scheme enjoys high efficiency and provides mutual explicit authentication, with a security reduction to decoding random quasi-cyclic codes in the random oracle model.

A Chosen Random Value Attack on WPA3 SAE Authentication Protocol

Simultaneous Authentication of Equals (SAE) is a password-authenticated key exchange protocol that is designed to replace the WPA2-PSK-based authentication. The SAE authenticated key exchange protocol supports the peer-to-peer authentication and is one of the major authentication mechanisms of the Authentication and Key Management Suite specified within Wi-Fi. The SAE authenticated key exchange protocol has been widely implemented in today’s Wi-Fi devices as part of major security feature upgrades and is regarded as the third generation of Wi-Fi Protected Access. This article presents a way of attacking the weaker randomness generation algorithm within the SAE protocols, which can lead to successful impersonation types of attacks. We also suggest some protocol amendments for protection. It is recommended that SAE implementations should be upgraded to ensure protection against these attacks.

Improved Verifier-Based Three-Party Password-Authenticated Key Exchange Protocol from Ideal Lattices

With the advent of large-scale social networks, two communication users need to generate session keys with the help of a remote server to communicate securely. In the existing three-party authenticated key exchange (3PAKE) protocols, users’ passwords need to be stored on the server; it cannot resist the server disclosure attack. To solve this security problem, we propose a more efficient 3PAKE protocol based on the verification element by adopting a public-key cryptosystem and approximate smooth projection hash (ASPH) function on an ideal lattice. Using the structure of separating authentication from the server, the user can negotiate the session key only after two rounds of communication. The analysis results show that it can improve the efficiency of computation and communication and resist the server disclosure attack, quantum algorithm attack, and replay attack; moreover, it has session key privacy to the server. This protocol can meet the performance requirement of the current communication network.

Achieving password-hashing scheme over lattices

Password-based authentication is the dominant form of access control and is likely to keep its status in the foreseeable future. Password authenticated key exchange (PAKE) protocols enable two parties to exchange a session key during password-based authentication over an insecure channel. To resist password compromise at the server-side, passwords are recommended to be stored in a salted hash form. However, conventional password hashing functions (e.g., PBKDF2, bcrypt, and scrypt) only support PAKE protocols based on specific number-theoretic assumptions, which can only be proved secure in the random oracle model, and the communication rounds are generally high. Furthermore, they demand a large memory size, i.e., the output is of length łinebreak 32 bytes. To address these issues, several password hashing schemes based on discrete-logarithm assumptions, e.g., Benhamouda and Pointceva (IACR ePrint2013/833), Kiefer and Manulis (ESORICS14), and Pointcheval and Wang (ASIACCS17), have been proposed to be integrated with a smooth projective hash function (SPHF), but they are not secure in the coming quantum era and only can be proved security in the random oracle model. In this work, we focus on the question of how to design an efficient password hashing scheme that can be integrated into quantum-resistant SPHF-based PAKE while being secure in the standard model (but not the random oracle model). Following the research line of Kiefer and Manulis (ESORICS14), we design three new types of lattice-based password hashing schemes based on homomorphic commitment schemes with provable security in the standard model. We show that they can be efficiently integrated with SPHFs to obtain low-interactive PAKE protocols. Although the proposed scheme is not ready to be deployed in practice, it is an important step for the quantum-resistant password-based authentication and authenticated key exchange.

Blockchain-based cross-user data shared auditing

In cloud storage, public auditing is a more popular data integrity verification technique since it allows users to delegate auditing tasks to a fully trusted third-party auditor (TPA). However, it is difficult to find such a TPA in practical application. Besides, the centralised auditing model makes TPA have to bear burdensome work pressure, which limits the practicability of existing schemes. In this paper, we firstly proposed a blockchain-based generalised shared auditing mechanism BCSA in the cross-user scenario, which aims at achieving available public auditing with a non-fully trusted TPA, and reducing the user's auditing fees and TPA's work pressure by allowing data users to share their auditing procedure with others. Furthermore, we initialise a concrete construction BCSAD with Diffie–Hellman protocol for the cross-user auditing scenario with different data. Likewise, we also propose a novel construction BCSAI for the cross-user auditing scenario with identical data, which utilises a password-authenticated key exchange (PAKE) protocol to achieve shared auditing and ciphertext deduplication, reducing data storage and auditing fees for data users and alleviating service pressure on the cloud server and TPA. Security and performance analysis evaluate the practicability of the proposed scheme.

A Two-Party Password-Authenticated Key Exchange Protocol with Verifier

To tackle with the security lack in the password-authenticated key exchange protocol, this paper proposes a two-party password-authenticated key exchange protocol based on a verifier. In the proposed protocol, a user stores his password in plaintext, and the server stores a verifier for the user’s password, using DL difficult problem and DH difficult problem, through the session between user and server to establish a session key. The security discussion result shows that the proposed protocol provides forward secrecy, and can effectively defend against server compromising fake attacks, dictionary attacks and middleman attacks. Protocol efficiency comparisons reveal our protocol is more reasonable.

Gateway‐oriented two‐server password authenticated key exchange protocol for unmanned aerial vehicles in mobile edge computing

With the popularity of unmanned aerial vehicles (UAVs), more and more valuable data can be collected by UAVs. In order to balance the data usage and communication cost, the data can be preprocessed in UAVs rather than directly transmitting to the data centre in the edge computing paradigm. Users can obtain information of interest by accessing the data centre remotely by authenticating themselves to the data centre using the most pervasive password authentication method. Unfortunately, the data centre becomes the main attack target because it not only stores the data but also maintains the passwords of all the users. Aiming at protecting the data as well as the password in the UAV-enabled mobile edge computing environment, the authors combine the advantages of gateway-oriented password authenticated key exchange (PAKE) protocols and two-server PAKE protocols and put forward an efficient gateway-oriented two-server PAKE protocol. The security of the proposed protocol is given in the random oracle model. The performance comparison shows their proposal has comparable efficiency in computation and communication costs. Their protocol provides better protection to the password without sacrificing efficiency. Consequently, their protocol is more suitable for real applications in UAV-enabled mobile edge computing environment.

An improved password-authenticated key exchange protocol for VANET

With a securely pre-shared short password, Password-Authenticated Key Exchange (PAKE) protocol is able to produce a secure session key to protect the communication. However, in a practical self-organized network, e.g. Vehicular Ad-hoc Network (VANET), the pre-shared passwords are often insecure, because the mass-produced devices are frequently with similar default passwords, such as 0000 or 1234, which always never be changed at all. Therefore, in this paper, we proposed a more efficient, secure, and practical PAKE protocol for VANET by fully applying the real physical randomness, the fading phase of wireless slow fading channels that is random, independent but stable in different coherence timeslots. The proposed protocol first generates a high-entropy secret shared information (HSSI) based on the physical randomness and the pre-shared short password, then establishes session keys based on the HSSI other than the only pre-shared password. With the physical randomness, the proposed scheme replaces exponential operations with XOR evaluations to improve efficiency. The security of the proposed protocol has been proved in the real-or-random model.

Revisit of Password-Authenticated Key Exchange Protocol for Healthcare Support Wireless Communication

Wireless communication is essential for the infrastructure of a healthcare system. This bidirectional communication is used for data collection and to control message delivery. Wireless communication is applied in industries as well as in our daily lives, e.g., smart cities; however, highly reliable communication may be more difficult in environments with low power consumption, many interferences, or IoT wireless network issues due to resource limitations. In order to solve these problems, we investigated the existing three-party password-authenticated key exchange (3PAKE) and developed an enhanced protocol. Currently, Lu et al. presented a 3PAKE protocol to improve the security flaws found in Farash and Attari’s protocol. This work revisits the protocol proposed by Lu et al. and demonstrates that, in addition to other security weaknesses, the protocol does not provide user anonymity which is an important issue for healthcare environment, and is not secure against insider attacks that may cause impersonation attacks. We propose a secure biometric-based efficient password-authenticated key exchange (SBAKE) protocol in order to remove the incidences of these threats, and present an analysis regarding the security and efficiency of the SBAKE protocol for practical deployment.

A Mobile Intelligent Terminal Based Anonymous Authenticated Key Exchange Protocol for Roaming Service in Global Mobility Networks

With the rapid development of mobile intelligent terminals, users can conveniently enjoy ubiquitous services in global mobility networks. User authentication and user privacy protection are two important issues for providing secure roaming service in global mobility networks. Until now, many authentication protocols for roaming service with user anonymity are proposed. Unfortunately, most of the existing protocols only have heuristic informal security arguments. Moreover, current works only achieve weak anonymity. A user's identity is only anonymous against eavesdroppers and is known to the home agent and sometimes even the foreign agent. In order to overcome these weaknesses, we propose a privacy-preserving password-authenticated key exchange protocol for roaming service in global mobility networks. The proposed protocol is proven secure in the random oracle model under the CDH and the $q$ q -SDH assumptions. Our protocol achieves stronger user anonymity than other related protocols. The performance comparison shows that our protocol is more efficient in terms of on-line computation and enjoys optimal communication complexity. Consequently, it is more suitable for real applications in global mobility networks.

AuCPace: Efficient verifier-based PAKE protocol tailored for the IIoT

Increasingly connectivity becomes integrated in products and devices that previously operated in a stand-alone setting. This observation holds for many consumer applications in the so-called "Internet of Things" (IoT) as well as for corresponding industry applications (IIoT), such as industrial process sensors. Often the only practicable means for authentication of human users is a password. The security of password-based authentication schemes frequently forms the weakest point of the security infrastructure. In this paper we first explain why a tailored protocol designed for the IIoT use case is considered necessary. The differences between IIoT and the conventional Internet use-cases result in largely modified threats and require special procedures for allowing both, convenient and secure use in the highly constrained industrial setting. Specifically the use of a verifier-based password-authenticated key-exchange (V-PAKE) protocol as a hedge against public-key-infrastructure (PKI) failures is considered important. Availability concerns for the case of failures of (part of) the communication infrastructure makes local storage of access credentials mandatory. The larger threat of physical attacks makes it important to use memory-hard password hashing. This paper presents a corresponding tailored protocol, AuCPace, together with a security proof within the Universal Composability (UC) framework considering fully adaptive adversaries. We also introduce a new security notion of partially augmented PAKE that provides specific performance advantages and makes them suitable for a larger set of IIoT applications. We also present an actual instantiation of our protocol, AuCPace25519, and present performance results on ARM Cortex-M0 and Cortex-M4 microcontrollers. Our implementation realizes new speed-records for PAKE and X25519 Diffie-Hellman for the ARM Cortex M4 architecture.

A key for John Doe: modeling and designing Anonymous Password-Authenticated Key Exchange protocols

Anonymous Password-Authenticated Key Exchange ( $\sf{ APAKE}$ APAKE ) can be seen as the hybrid offspring of standard key exchange and anonymous password authentication protocols. $\sf{ APAKE}$ APAKE allows a client holding a low-entropy password to establish a session key with a server, provided that the client’s password is in the server’s set. Moreover, no information about the password input by the client or the set of valid passwords held by the server should leak to the other party–beyond whether the client’s password lies or not in the server’s password database. To the best of our knowledge, all $\sf{ APAKE}$ APAKE proposals to date either assume client storage or force the client to remember the index assigned to its password in the server’s database. Furthermore, earlier works either provide only informal definitions or fail in some sense to properly model the primitive. In this paper, we provide a formal security model for $\sf{ APAKE}$ APAKE , capturing security and anonymity provisions for both clients and servers. In addition, we present two $\sf{ APAKE}$ APAKE protocols that only require clients to remember a password and that attain our sought key secrecy and anonymity guarantees. Our first protocol leverages oblivious pseudo-random functions, while the second one builds upon a special type of identity-based encryption scheme.

Verifier-based anonymous password-authenticated key exchange protocol in the standard model.

Anonymous password-authenticated key exchange (APAKE) allows a client to authenticate herself and to establish a secure session key with a remote server via only a low-entropy password, while keeping her actual identity anonymous to the third party as well as to the server. Since that APAKE protocol enjoys both the convenience of password authentication and the advantage of privacy protection, researchers have paid much attention to them. However, most of the existing APAKE protocols are designed in the symmetric setting which does not take into consideration the threat of password file leakage. To mitigate the damage of server compromise, we propose a verifier-based anonymous password-authenticated key exchange protocol, in which the server holds a verifier corresponding to each client instead of the clear password. The construction of our protocol is built on standard cryptographic primitives such public key encryption, smooth projective hash functions and password hashing schemes. The resulting protocol is proved secure in the standard model, i.e., without resorting to random oracles. Comparisons with other similar schemes show that our protocol guarantees stronger security while enjoys considerable efficiency in terms of computational cost.

Efficient Anonymous Password-Authenticated Key Exchange Protocol to Read Isolated Smart Meters by Utilization of Extended Chebyshev Chaotic Maps

In smart grid, key exchange protocols play a vital role in providing secure channels to read consumption reports from the smart meters. Thus far, several key exchange schemes have been proposed for the networked smart meters. However, for the first time, quite recently, Sha et al . have presented an interesting two-phase authentication and key agreement scheme that exclusively aims at the isolated smart meters. In their scheme, they have properly addressed the computationally constrained smart meters by offering a lightweight key exchange protocol. Nevertheless, after meticulous observation, we found that their proposed scheme cannot resist the desynchronization attack and cannot provide the perfect forward secrecy. Moreover, there are some other weaknesses in their scheme. As a result, to tackle the existing security challenges, in this paper, by utilization of the extended Chebyshev chaotic maps, we propose an efficient anonymous password-authenticated key exchange protocol that not only is free from the limitations of Sha et al .'s scheme, but also provides the anonymity. The security analysis in the random oracle model and using the widely accepted ProVerif tool besides the computational and communication costs comparison demonstrate that the proposed scheme has reached a proper level of efficiency without sacrificing the desired security properties.

A variant of password authenticated key exchange protocol

Password authenticated key exchange (PAKE) protocols are designed for a pair of users to establish a secret session key over a public and unreliable network. In existing PAKE protocols, it is assumed that short passwords are pre-shared between users. This assumption, however, would be impractical in certain applications. For instance, in the Internet of Things and Fog computing, billions of devices will be wirelessly connected. In practice, the devices are produced by different factories, and it is not practical to assume that these devices are pre-loaded with passwords when they leave factories. As a result, existing PAKE protocols cannot be directly employed in these applications. Moreover, it is investigated that devices can extract secrets using the wireless fading channel. However, the key extraction rate at the physical layer is slow. Motivated by these observations, this paper presents a variant of password authenticated key exchange (vPAKE) protocol without the password sharing assumption. To obtain the passwords, wireless devices, such as mobile phones, tablets, and laptops, are used to extract short secrets at the physical layer. Using the extracted secrets, users can establish a secret key at higher layers. The performance analysis shows that comparing with other PAKE protocols (which are proved secure in the standard model), the communication and computation consumptions of our protocol are significantly reduced. Additionally, the proposed protocol is proved secure in the standard model.