Password-authenticated Key Exchange Research Articles

Password-Authenticated Group Key Exchange

Two-party password-authenticated key exchange (2PAKE) protocols provide a natural mechanism for secret key establishment in distributed applications, and they have been extensively studied in past decades. However, only a few efforts have been made so far to design password-authenticated group key exchange (GPAKE) protocols. In a 2PAKE or GPAKE protocol, it is assumed that short passwords are preshared among users. This assumption, however, would be impractical in certain applications. Motivated by this observation, this article presents a GPAKE protocol without the password sharing assumption. To obtain the passwords, wireless devices, such as smart phones, tablets, and laptops, are used to extract short secrets at the physical layer. Using the extracted secrets, users in our protocol can establish a group key at higher layers with light computation consumptions. Thus, our GPAKE protocol is a cross-layer design. Additionally, our protocol is a compiler, that is, our protocol can transform any provably secure 2PAKE protocol into a GPAKE protocol with only one more round of communications. Besides, the proposed protocol is proved secure in the standard model.

An efficient and practical threshold gateway-oriented password-authenticated key exchange protocol in the standard model

With the assistance of an authentication server, a gateway-oriented password-authenticated key exchange (GPAKE) protocol can establish a common session key shared between a client and a gateway. Unfortunately, a GPAKE protocol becomes totally insecure if an adversary can compromise the authentication server and steal the passwords of the clients. In order to provide resilience against adversaries who can hack into the authentication server, we propose a threshold GPAKE protocol and then present its security proof in the standard model based on the hardness of the decisional Diffie-Hellman (DDH) problem. In our proposal, the password is shared among $n$ authentication servers and is secure unless the adversary corrupts more than $t+1$ servers. Our protocol requires $n>3t$ servers to work. Compared with existing threshold PAKE protocols, our protocol maintains both stronger security and greater efficiency.

Secure modular password authentication for the web using channel bindings

Secure protocols for password-based user authentication are well-studied in the cryptographic literature but have failed to see wide-spread adoption on the internet; most proposals to date require extensive modifications to the Transport Layer Security (TLS) protocol, making deployment challenging. Recently, a few modular designs have been proposed in which a cryptographically secure password-based mutual authentication protocol is run inside a confidential (but not necessarily authenticated) channel such as TLS; the password protocol is bound to the established channel to prevent active attacks. Such protocols are useful in practice for a variety of reasons: security no longer relies on users' ability to validate server certificates and can potentially be implemented with no modifications to the secure channel protocol library. We provide a systematic study of such authentication protocols. Building on recent advances in modeling TLS, we give a formal definition of the intended security goal, which we call password-authenticated and confidential channel establishment (PACCE). We show generically that combining a secure channel protocol, such as TLS, with a password authentication or password-authenticated key exchange protocol, where the two protocols are bound together using the transcript of the secure channel's handshake, the server's certificate, or the server's domain name, results in a secure PACCE protocol. Our prototypes based on TLS are available as a cross-platform client-side Firefox browser extension as well as an Android application and a server-side web application that can easily be installed on servers.

A Provably Password Authenticated Key Exchange Scheme Based on Chaotic Maps in Different Realm

Until now, the overwhelming majority of password- authenticated key agreement protocols using chaotic maps are based on three architectures (client/server, two clients/server and multi-server) and four security models (heuristic security, random oracle, ideal cipher and standard model). However, with rapid changes in the modern communication environment such as wireless mesh net- works and cloud storing, it is necessary to put forward a kind more flexible and general architecture to adapt it. So, in our paper, we firstly propose a provable secure two-party in two-realm key agreement protocol using chaotic maps in the standard model. Our proposed protocol is more general and it is easy to expand to many other forms, such as three-party or N-party in different realms. The new protocol resists dictionary attacks mounted by either passive or active network intruders, allowing, in principle, even weak password phrases to be used safely. It also offers perfect forward secrecy, which protects past sessions and passwords against future compromises. Finally, we give the security proof in the standard model and the efficiency analysis of our proposed scheme.

Multi-party Password-Authenticated Key Exchange Scheme with Privacy Preservation for Mobile Environment

Communications among multi-party must be fast, cost effective and secure. Today’s computing environments such as internet conference, multi-user games and many more applications involve multi-party. All participants together establish a common session key to enable multi-party and secure exchange of messages. Multi-party password-based authenticated key exchange scheme allows users to communicate securely over an insecure network by using easy-to-remember password. Kwon et al. proposed a practical three-party password-based authenticated key exchange (3-PAKE) scheme to allow two users to establish a session key through a server without pre-sharing a password between users. However, Kwon et al.s scheme cannot meet the security requirements of key authentication, key confirmation and anonymity. In this paper, we present a novel, simple and efficient multi-party password-based authenticated key exchange (M-PAKE) scheme based on the elliptic curve cryptography for mobile environment. Our proposed scheme only requires two round-messages. Furthermore, the proposed scheme not only satisfies security requirements for PAKE scheme but also achieves efficient computation and communication.

ID2S Password-Authenticated Key Exchange Protocols

In a two-server password-authenticated key exchange (PAKE) protocol, a client splits its password and stores two shares of its password in the two servers, respectively, and the two servers then cooperate to authenticate the client without knowing the password of the client. In case one server is compromised by an adversary, the password of the client is required to remain secure. In this paper, we present two compilers that transform any two-party PAKE protocol to a two-server PAKE protocol on the basis of the identity-based cryptography, called ID2S PAKE protocol. By the compilers, we can construct ID2S PAKE protocols which achieve implicit authentication. As long as the underlying two-party PAKE protocol and identity-based encryption or signature scheme have provable security without random oracles, the ID2S PAKE protocols constructed by the compilers can be proven to be secure without random oracles. Compared with the Katz et al.'s two-server PAKE protocol with provable security without random oracles, our ID2S PAKE protocol can save from 22 to 66 percent of computation in each server.

Provably secure CL-KEM Based Password-Authenticated Key Exchange Protocol

Provably secure CL-KEM Based Password-Authenticated Key Exchange Protocol

Multi-party Password-Authenticated Key Exchange Scheme with Privacy Preservation for Mobile Environment

Communications among multi-party must be fast, cost effective and secure. Today’s computing environments such as internet conference, multi-user games and many more applications involve multi-party. All participants together establish a common session key to enable multi-party and secure exchange of messages. Multi-party password-based authenticated key exchange scheme allows users to communicate securely over an insecure network by using easy-to-remember password. Kwon et al. proposed a practical three-party password-based authenticated key exchange (3-PAKE) scheme to allow two users to establish a session key through a server without pre-sharing a password between users. However, Kwon et al."s scheme cannot meet the security requirements of key authentication, key confirmation and anonymity. In this paper, we present a novel, simple and efficient multi-party password-based authenticated key exchange (M-PAKE) scheme based on the elliptic curve cryptography for mobile environment. Our proposed scheme only requires two round-messages. Furthermore, the proposed scheme not only satisfies security requirements for PAKE scheme but also achieves efficient computation and communication.

속성 기반 암호화 방식을 이용한 다중 서버 패스워드 인증 키 교환

Password authenticated key exchange (PAKE) is a protocol that a client stores its password to a server, authenticates itself using its password and shares a session ke y with the server. In multi-server PAKE, a client splits its password and stores them to several servers separately. Unless all the servers are compromised, client's password will not be disclosed in the multi-server setting. In attribute-based encryption (ABE), a sender encrypts a message M using a set of attributes and then a receiver decrypts it using the same set of attributes. In this paper, we introduce multi-server PAKE protocol that utilizes a set of attributes of ABE as a client's password. In the protocol, the client and servers do not need to create additional public/private key pairs because the password is used as a set of public keys. Also, the client and the servers exchange only one round-trip message per server. The protocol is secure against dictionary attacks. We prove our system is secure in a proposed threat model. Finally we show feasibility through evaluating the execution time of the protocol.

A Provably Secure Three-Party Password Authenticated Key Exchange Protocol without Using Server's Public-Keys and Symmetric Cryptosystems

Three-party password authenticated key exchange (3PAKE) protocols allow two clients to establish a common secure session key via the help of an authentication server, in which each client only needs to share a single password with the server. Many researchers pay attention to 3PAKE protocols since they are well suited for large-scale communication in mobile environments. Recently, Farash et al. proposed an enhanced 3PAKE protocol without using server's public-keys and symmetric cryptosystems. They claimed that their protocol is secure against various attacks. However, we found that Farash et al.'s protocol is vulnerable to partition attacks and off-line dictionary attacks. Moreover, their protocol needs 5 rounds to work, so it is inefficient in terms of communication. To overcome these shortcomings, we improve their protocol and propose a provably secure 3PAKE protocol, which is more efficient and secure than other related protocols.DOI: http://dx.doi.org/10.5755/j01.itc.44.2.8197

An Enhanced Dragonfly Key Exchange Protocol against Offline Dictionary Attack

Dragonfly is Password Authenticated Key Exchange protocol that uses a shared session key to authenticate parties based on pre-shared secret password. It was claimed that this protocol was secure against off-line dictionary attack, but a new research has proved its vulnerability to off-line dictionary attack and proving step was applied by using “Patched Protocol” which was based on public key validation. Unfortunately, this step caused a raise in the computation cost, which made this protocol less appealing than its competitors. We proposed an alternate enhancement to keep this protocol secure without any extra computation cost that was known as “Enhanced Dragonfly”. This solution based on two-pre-shared secret passwords instead of one and the rounds between parties had compressed into two rounds instead of four. We prove that the enhanced-Dragonfly protocol is secure against off-line dictionary attacks by analyzing its security properties using the Scyther tool. A simulation was developed to measure the execution time of the enhanced protocol, which was found to be much less than the execution time of patched Dragonfly. The off-line dictionary attack time is consumed for few days if the dictionary size is 10,000. According to this, the use of the enhanced Dragonfly is more efficient than the patched Dragonfly.

Improvement of a chaotic maps-based three-party password-authenticated key exchange protocol without using server’s public key and smart card

Three-party password-authenticated key exchange (3PAKE) protocol allows two users to establish a secure session key over an insecure communication channel with the help of a trusted server. Recently, Farash and Attari proposed a chaotic maps-based 3PAKE protocol without using server’s public key, smart card and symmetric cryptosystems and claimed its security by providing well-organized security proof. Unfortunately, in this paper, we demonstrate that their protocol cannot resist impersonation attack and off-line password guessing attack. To overcome their security weaknesses, we propose an improved chaotic maps-based 3PAKE protocol with the same advantages. Further, we apply the pi calculus-based formal verification tool ProVerif to show that our 3PAKE protocol achieves authentication and security and show that our protocol is more efficient than Farash and Attari’s protocol in terms of computation and communication costs.

Anonymous three-party password-authenticated key exchange scheme for Telecare Medical Information Systems.

Telecare Medical Information Systems (TMIS) provide an effective way to enhance the medical process between doctors, nurses and patients. For enhancing the security and privacy of TMIS, it is important while challenging to enhance the TMIS so that a patient and a doctor can perform mutual authentication and session key establishment using a third-party medical server while the privacy of the patient can be ensured. In this paper, we propose an anonymous three-party password-authenticated key exchange (3PAKE) protocol for TMIS. The protocol is based on the efficient elliptic curve cryptosystem. For security, we apply the pi calculus based formal verification tool ProVerif to show that our 3PAKE protocol for TMIS can provide anonymity for patient and doctor while at the same time achieves mutual authentication and session key security. The proposed scheme is secure and efficient, and can be used in TMIS.

Solution to Security and Secrecy in Cloud Environment using PAKE Protocol - A Bibliographic Survey

Cloud computing is an emerging technology that provide people a way to share large amount of hardware and software resources that belong to different organizations. Maintaining privacy and security in cloud environment is more complicated. Mitigating threats in a distributed computing environment is a difficult task as it requires constant vigilance and defense-in-depth. Most systems lack a secure model that guarantees an end-to-end security and confidentiality. Adopting a cloud computing paradigm may have positive as well as negative effects on authenticating a user and exchanging the data. This paper presents an extensive survey of various Password Authenticated Key Exchange (PAKE) protocols available in the literature to eliminate the drawbacks in the current authentication procedure of cloud computing environment.

Practical RSA-PAKE for Low-Power Device in Imbalanced Wireless Networks

For enhancing the security of ubiquitous communication, we have to consider three keywords: mobility, wireless, and low computing capability. In this paper, we study one of suitable security protocols for the ubiquitous communication environment. We discuss RSA-based password-authenticated key exchange (RSA-PAKE) protocols for imbalanced wireless networks where a party uses a low-power device to communicate with another party equipped with a powerful computing device. For imbalanced wireless network applications, it is important to reduce the cost of communication for a low-power device even though the cost for powerful devices is increasing. The most power-consuming operation in RSA-PAKE protocols is the reliability test of unauthorized RSA public keys. Hence, it is important to design an efficient reliability test method to construct an efficient RSA-PAKE protocol. In this paper, we propose a new reliability test technique and design a provably secure RSA-PAKE protocol using the technique. Our protocol is suitable for securing the communications conducted over imbalanced wireless networks since the operations computed by one communicating party are efficient enough to be implemented on most low-power devices such as mobile phones and PDAs. The cost of a low-power device is reduced by 84.25% compared with CEKEP, the most efficient RSA-PAKE protocol. We prove the security of our protocol under a firmly formalized security model.

Cryptanalysis of a new protocol of wide use for email with perfect forward secrecy

This paper considers security analysis of a cross-realm client-to-client password-authenticated key exchange C2C-PAKE protocol with indirect communication structure that was proposed for secure email. The protocol does not need any public key infrastructure PKI and was designed to enable senders and recipients of emails to register at different mail servers. However, mail servers require sharing of secret keys in advance. Protocol designers claimed many security attributes including perfect forward secrecy and resilience to dictionary and replay attacks. However, in this paper, we show that the protocol does not provide forward secrecy and is vulnerable to offline dictionary attack, undetectable online dictionary attack, replay attack, and password-compromise impersonation attack. The protocol has also some other defects that are explained in the paper. Copyright © 2014 John Wiley & Sons, Ltd.

Password Authenticated Key Exchange Protocol in the Three Party Setting Based on Lattices

As it is resistant to quantum attacks,lattice theory is widely applied to various cryptosystem.Currently,lattice-based Password Authenticated Key Exchange(PAKE) protocols are all designed for two-party circumstance,so it can not meet the application requirements for large-scale communications system.In this paper,a three party PAKE protocol is proposed based on lattice from the two party PAKE framework of Gorce-Katz,and its security is proved in the standard model.At the same time,through the realization of explicit mutual authentication between user and server,the protocol can be used to resist undetectable online dictionary attacks.The new protocol is considered to be the first three party PAKE protocol based on lattices.Compared with general construction,the new protocol reduces the number of communication round,and can avoid the weakness that cryptosystem based on the integer factorization problem or discrete logarithm problem is vulnerable to quantum attacks.

A Secure and Efficient Two-Server Password Only Authenticated Key Exchange

Password-authenticated key exchange (PAKE) is an authentication mechanism where a client and a server who share a password and authenticate each other with that password and hence both will agree on a cryptographic key. Normally, the passwords which are required to verify the clients are stored on a single server. If the server is compromised, due to some malicious operations like hacking or installing a Trojan horse, passwords which are stored in the server gets revealed. In this paper two servers cooperate to authenticate a client and if one server is cooperated, the attacker still cannot act as a client with the evidence from the conceded server. Current solutions for two servers PAKE are either symmetric in the way that the two server correspondingly contribute to the authentication or asymmetric in the sense that one server confirms the authenticity of legal client with the assistance of another server. This paper presents the development of symmetric protocol for two-server PAKE, where the client can establish different cryptographic keys with the two servers. In addition to that a nonce will be generated during the period of authentication and this will act as a timer. If the timer does not expire with in the period limit, the authentication procedure will be carried out within the limit which provides security to replay attacks.

Efficient Two-Server Password-Only Authenticated Key Exchange

Password-authenticated key exchange (PAKE) is where a client and a server, who share a password, authenticate each other and meanwhile establish a cryptographic key by exchange of messages. In this setting, all the passwords necessary to authenticate clients are stored in a single server. If the server is compromised, due to, for example, hacking or even insider attack, passwords stored in the server are all disclosed. In this paper, we consider a scenario where two servers cooperate to authenticate a client and if one server is compromised, the attacker still cannot pretend to be the client with the information from the compromised server. Current solutions for two-server PAKE are either symmetric in the sense that two peer servers equally contribute to the authentication or asymmetric in the sense that one server authenticates the client with the help of another server. This paper presents a symmetric solution for two-server PAKE, where the client can establish different cryptographic keys with the two servers, respectively. Our protocol runs in parallel and is more efficient than existing symmetric two-server PAKE protocol, and even more efficient than existing asymmetric two-server PAKE protocols in terms of parallel computation.

Security analysis and improvements of a communication-efficient three-party password authenticated key exchange protocol

Three-party password-authenticated key exchange (3PAKE) protocols allow two clients to establish secure communication channels over a public network merely by sharing a human-memorable (low-entropy) password with a trusted server. In this paper, we first show that the 3PAKE protocol introduced by Chang, Hwang, and Yang is insecure against even passive attackers. Thereafter, we propose two kinds of improvement that can remedy the security flaw in their protocol. Finally, we present simulations to measure the execution time to show the efficiency of our two improvements.