Password-based Authenticated Key Exchange Research Articles

Understanding Failures in Security Proofs of Multi-Factor Authentication for Mobile Devices

Multi-factor authentication is a promising way to enhance the security of password-based authenticated key exchange (PAKE) schemes. It is widely deployed in various daily applications for mobile devices (e.g., e-Bank, smart home, and cloud services) to provide the first line of defense for system security. However, despite intensive research, how to design a secure and efficient multi-factor authentication scheme is still a challenging problem. Hundreds of new schemes have been successfully proposed, and many are even equipped with a formal security proof. However, most of them have been shortly found to be insecure and cannot achieve the claimed security goals. Now a paradox arises: How can a multi-factor scheme that was “formally proven secure” later be found insecure? To answer this seemingly contradicting question, this paper takes a substantial first step towards systematically exploring the security proof failures in multi-factor authentication schemes for mobile devices. We first investigate the root causes of the “provable security” failure in vulnerable multi-factor authentication schemes under the random oracle model, and classify them into eight different types in terms of the five steps of conducting a formal security proof. Then, we elaborate on each type of these eight proof failures by examining three typical vulnerable protocols, and suggest corresponding countermeasures. Finally, we conduct a large-scale comparative measurement of 70 representative multi-factor authentication schemes under our extended evaluation criteria. The schemes we select range from 2009 to 2022, and the comparison results suggest that understanding failures in formal security proofs is helpful to design more secure multi-factor authentication protocols for mobile devices.

Smooth Projective Hash Function From Codes and its Applications

Nowadays, Smooth Projective Hash Functions (SPHFs) play an important role in constructing cryptographic tools such as secure Password-based Authenticated Key Exchange (PAKE) protocol in the standard model, oblivious transfer, and zero-knowledge proofs. Specifically, in this article, we focus on constructing PAKE protocol; that is, a kind of key exchange protocol which needs only a low entropy password to produce a cryptographically strong shared session key. In spite of relatively good progress of SPHFs in applications, it seems there has been little effort to build them upon quantum-resistant assumptions such as lattice-based cryptography and code-based cryptography to make them secure against quantum computer attacks. More precisely, there are two proposals based on lattice assumptions that utilize the SPHFs to construct PAKE secured in standard model. Considering quantum-resistant assumptions is less than straightforward and needs some relaxations. In this article, we introduce two new Approximate SPHF (ASPHFs) from error-correcting codes. Upon designing ASPHF, we can construct two efficient PAKE protocols. The security of our protocols could be proved based on the hardness of bounded decoding (BD) problem and learning with parity (LPN) problem in the standard model.

Achieving One-Round Password-Based Authenticated Key Exchange over Lattices

<i>Password-based authenticated key exchange</i> (<inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq1-2939836.gif"/></alternatives></inline-formula>) protocol, a widely used authentication mechanism to realize secure communication, allows protocol participants to establish a high-entropy session key by pre-sharing a low-entropy password. An open challenge in <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq2-2939836.gif"/></alternatives></inline-formula> is how to design a quantum-resistant round-optimal <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq3-2939836.gif"/></alternatives></inline-formula>. To solve this challenge, lattice-based cryptography is a promising candidate for post-quantum cryptography. In addition, Katz and Vaikuntanathan (ASIACRYPT&#x2019;09) design the first <i>three-round</i> <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq4-2939836.gif"/></alternatives></inline-formula> protocol by leveraging the smooth projective hash function (<inline-formula><tex-math notation="LaTeX">$\mathsf {SPHF}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">SPHF</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq5-2939836.gif"/></alternatives></inline-formula>) over lattices. Subsequently, Zhang and Yu (AISACRYPT&#x2019;17) optimized Katz-Vaikuntanathan&#x2019;s approximate <inline-formula><tex-math notation="LaTeX">$\mathsf {SPHF}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">SPHF</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq6-2939836.gif"/></alternatives></inline-formula> via a splittable public key encryption. They then constructed a <i>two-round</i> <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq7-2939836.gif"/></alternatives></inline-formula> by using the simulation-sound non-interactive zero-knowledge (NIZK) proofs, but how to construct a lattice-based simulation-sound NIZK remains an open research question. In other words, how to design a one-round <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq8-2939836.gif"/></alternatives></inline-formula> via an efficient lattice-based <inline-formula><tex-math notation="LaTeX">$\mathsf {SPHF}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">SPHF</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq9-2939836.gif"/></alternatives></inline-formula> still remains a challenge. In this work, we attempt to fill this gap by proposing a lattice-based <inline-formula><tex-math notation="LaTeX">$\mathsf {SPHF}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">SPHF</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq10-2939836.gif"/></alternatives></inline-formula> with adaptive smoothness. We then obtain a <i>one-round</i> <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq11-2939836.gif"/></alternatives></inline-formula> protocol over lattices with rigorous security analysis by integrating the proposed <inline-formula><tex-math notation="LaTeX">$\mathsf {SPHF}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">SPHF</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq12-2939836.gif"/></alternatives></inline-formula> into the one-round framework proposed by Katz and Vaikuntananthan (TCC&#x2019;11). Furthermore, we explore the possibilities of achieving two-round <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq13-2939836.gif"/></alternatives></inline-formula> and universal composable (UC) security from our <inline-formula><tex-math notation="LaTeX">$\mathsf {SPHF}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">SPHF</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq14-2939836.gif"/></alternatives></inline-formula>, and show the potential application of our <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq15-2939836.gif"/></alternatives></inline-formula> in Internet of Things (IoTs) where communication cost is the main consideration.

A Multi-Microgrid Thermal Game Model Based on Quantum Blockchain

The electricity transactions of microgrids face several problems: the high platform management cost, the low security, and the untimely consumption of scattered electricity. To solve these problems, this paper presents a multi-microgrid thermal game model based on quantum blockchain. Specifically, a dynamic model was established for the noncooperative game between aggregators, microgrids, and large users to maximize the benefit of each party, and to realize the timely consumption of scattered electricity. Next, a transaction platform was constructed based on the two-round password based authenticated key exchange (PAKE) protocol, which eliminates non-interactive zero-knowledge (NIZK), aiming to substantially enhance the post-quantum security of transactions. Then, the quantum signature using two-particle entangled Bell states was adopted to safeguard the quantum communication of electricity transactions, and authenticate the nodes. Example analysis shows that our model can realize the timely consumption of scattered electricity and thermal energy, improve the security of transaction data and users, and achieve Pareto optimality. The research provides theoretical support and decision-making basis for electricity transactions in the post-quantum age.

Two-Round Password-Based Authenticated Key Exchange from Lattices

Password-based authenticated key exchange (PAKE) allows participants sharing low-entropy passwords to agree on cryptographically strong session keys over insecure networks. In this paper, we present two PAKE protocols from lattices in the two-party and three-party settings, respectively, which can resist quantum attacks and achieve mutual authentication. The protocols in this paper achieve two rounds of communication by carefully utilizing the splittable properties of the underlying primitive, a CCA (Chosen-Ciphertext Attack)-secure public key encryption (PKE) scheme with associated nonadaptive approximate smooth projection hash (NA-ASPH) system. Compared with other related protocols, the proposed two-round PAKE protocols have relatively less communication and computation overhead. In particular, the two-round 3PAKE is more practical in large-scale communication systems.

Password-Based Authenticated Key Exchange without Centralized Trusted Setup

Almost all existing password-based authenticated key exchange (PAKE) schemes achieve concurrent security in the standard model by relying on the common reference string (CRS) model. A drawback of the CRS model is to require a centralized trusted authority in the setup phase; thus, passwords of parties may be revealed if the authority ill-uses trapdoor information of the CRS. There are a few secure PAKE schemes in the plain model, but, these are not achievable in a constant round (i.e., containing a linear number of rounds). In this paper, we discuss how to relax the setup assumption for (constant round) PAKE schemes. We focus on the multi-string (MS) model that allows a number of authorities (including malicious one) to provide some reference strings independently. The MS model is a more relaxed setup assumption than the CRS model because we do not trust any single authority (i.e., just assuming that a majority of authorities honestly generate their reference strings). Though the MS model is slightly restrictive than the plain model, it is very reasonable assumption because it is very easy to implement. We construct a (concurrently secure) three-move PAKE scheme in the MS model (justly without random oracles) based on the Groce-Katz PAKE scheme. The main ingredient of our scheme is the multi-string simulation-extractable non-interactive zero-knowledge proof that provides both the simulation-extractability and the extraction zero-knowledge property even if minority authorities are malicious. This work can be seen as a milestone toward constant round PAKE schemes in the plain model.

A post-quantum end-to-end encryption over smart contract-based blockchain for defeating man-in-the-middle and interception attacks

Ethereum is a public, open-source, decentralized, and peer-to-peer blockchain-based computing network which is involving to the usefulness of smart contract. It gives a distributed Turing-complete virtual machine in which some codes can be executed by utilizing a worldwide and public network of nodes. The compelled certificate creation and Man-In-The-Middle (MITM) attacks are two major attacks on End-to-End Encryption (EEE) and SSL/TLS. A portion of the real attacks on end-to-end encryption and SSL/TLS is IP/ARP poisoning and the phishing attack. MITM attack makes the client difficult to understand, whether they are associated with a unique verified and secured connection or not. Since the certificate and public-key that is being passed during the connection setup is unreliable and insecure, the attacker can undoubtedly change the data in the certificate and leaves the endorsement of the certificate and public-key to the client. The purpose of this paper is to present a solution of providing the legitimacy and authenticity of freely shared and published online digital data, e.g., digital certificates, cryptographic keys, and common reference strings such as shared passwords using a mix of recently developed innovations which primary include blockchain, smart contract, InterPlanetary File System (IPFS), and quantum-resistant Password-based Authenticated Key Exchange (PAKE) protocol over rings and ideal lattices. Ethereum smart contract is utilized to manage, surveil, and give detectability and visibility into the history of digital data from its beginning to the most recent variant, in a way that it is decentralized and internationally accessed with high integrity, resiliency, and transparency, that we should thank to the immutability and irreversibility of the blockchain. The full code of our smart contract is given, with a discourse on the execution and testing of its key functionalities.

Comments on “Provably Secure Dynamic Id-Based Anonymous Two-Factor Authenticated Key Exchange Protocol With Extended Security Model”

Password-based authenticated key exchange (PAKE) protocol has been widely used in practice, since it is convenient for users. However, the easy-to-remember property of the password also brings security problem. In this paper, we show there is an off-line dictionary attack in an efficient PAKE protocol when the smart card is lost. In order to resist the attack, we give a countermeasure to improve it. The countermeasure makes a simple change to the original protocol which does not affect the efficiency of the protocol.

Provably Leakage-Resilient Password-Based Authenticated Key Exchange in the Standard Model

The password-based authenticated key exchange (PAKE) protocol is one of most practical cryptographic primitives for trusted computing, which is used to securely authenticate devices’ identities and generate shared session keys among devices in insecure environments by using a short, human-memorable password. With the fast development of the Internet of Things (IoT), new challenges regarding PAKE have emerged. The traditional PAKE protocols are completely insecure in IoT environments, since there are many kinds of side-channel attacks. Therefore, it is very important to model and design leakage-resilient (LR) PAKE protocols. However, there has been no prior work on modeling and constructing LR PAKE protocols. In this paper, we first formalize an LR eCK security model for PAKE based on the eCK-secure PAKE model and the only computation leakage model. Then, we propose the first LR PAKE protocol by using Diffie-Hellman key exchange, LR storage (LRS) and LR refreshing of LRS appropriately and formally present a security proof in the standard model.

Public‐key encryption indistinguishable under plaintext‐checkable attacks

Indistinguishability under chosen-ciphertext attack (IND-CCA) is now considered the de facto security notion for public-key encryption. However, this sometimes offers a stronger security guarantee than what is needed. In this study, the authors consider a weaker security notion, termed as indistinguishability under plaintext-checking attacks (IND-PCA), in which the adversary has only access to an oracle indicating whether or not a given ciphertext encrypts a given message. After formalising this notion, the authors design a new public-key encryption scheme satisfying it. The new scheme is a variant of the Cramer–Shoup encryption scheme with shorter ciphertexts. Its security is also based on the plain decisional Diffie–Hellman (DDH) assumption. Additionally, the algebraic properties of the new scheme allow proving plaintext knowledge using Groth–Sahai non-interactive zero-knowledge proofs or smooth projective hash functions. Finally, as a concrete application, the authors show that, for many password-based authenticated key exchange (PAKE) schemes in the Bellare–Pointcheval–Rogaway security model, they can safely replace the underlying IND-CCA encryption schemes with their new IND-PCA one. By doing so, they reduce the overall communication complexity of these protocols and obtain the most efficient PAKE schemes to date based on plain DDH.

Improving Security of a Communication-Efficient Three-Party Password Authentication Key Exchange Protocol

Three-party Password-based Authentication Key Exchange (3PAKE) allows a trusted server to assist two users to establish a common session key. Recently, Wu et al. pointed out that Chang et al.'s 3PAKE was vulnerable to the off-line guessing attack and proposed an improved 3PAKE to fix the problem. However, we found that Wu et al.'s protocol is still subject to the off-line guessing attack. In addition, the paper offers a simple method to detect the attack.

Scalable protocol for cross-domain group password-based authenticated key exchange

Cross-domain password-based authenticated key exchange (PAKE) protocols have been studied for many years. However, these protocols are mainly focusing on multi-participant within a single domain in an open network environment. This paper proposes a novel approach for designing a cross-domain group PAKE protocol, that primarily handles with the setting of multi-participant in the multi-domain. Moreover, our protocol is proved secure against active adversary in the Real-or-Random (ROR) model. In our protocol, no interaction occurs between any two domain authentication servers. They are regarded as ephemeral certificate authorities (CAs) to certify key materials that participants might subsequently use to exchange and agree on group session key. We further justify the computational complexity and measure the average computation time of our protocol. To the best of our knowledge, this is the first work to analyze and discuss a provably secure multi-participant cross-domain group PAKE protocol.

Cryptanalysis and Improvement of a Password-Based Authenticated Three-Party Key Exchange Protocol

Protocols for password-based authenticated key exchange (PAKE) in the three-party setting must be designed to be secure against dictionary attacks even in the presence of a malicious insider. In this work, we revisit the three-party PAKE protocol proposed by Kim and Choi in 2009, and demonstrate that the protocol is vulnerable to an insider offline dictionary attack (which allows an adversary to impersonate a legitimate party and initiate transactions). We also show that due to the vulnerability, Kim and Choi’s protocol is rendered insecure in the in distinguish ability-based security model of Bellare, Pointcheval and Rogaway (2000). We propose an improved three-party PAKE protocol which is resistant to all classes of dictionary attacks, including insider offline dictionary attacks and undetectable online dictionary attacks.

Dictionary Attacks against Password-Based Authenticated Three-Party Key Exchange Protocols

A three-party password-based authenticated key exchange (PAKE) protocol allows two clients registered with a trusted server to generate a common cryptographic key from their individual passwords shared only with the server. A key requirement for three-party PAKE protocols is to prevent an adversary from mounting a dictionary attack. This requirement must be met even when the adversary is a malicious (registered) client who can set up normal protocol sessions with other clients. This work revisits three existing three-party PAKE protocols, namely, Guo et al.’s (2008) protocol, Huang’s (2009) protocol, and Lee and Hwang’s (2010) protocol, and demonstrates that these protocols are not secure against offline and/or (undetectable) online dictionary attacks in the presence of a malicious client. The offline dictionary attack we present against Guo et al.’s protocol also applies to other similar protocols including Lee and Hwang’s protocol. We conclude with some suggestions on how to design a three-party PAKE protocol that is resistant against dictionary attacks.

Simple and efficient password-based authenticated key exchange protocol

Password-based authenticated key exchange (PAKE) protocols are cryptographic primitives which enable two entities, who only share a memorable password, to identify each other and to communicate over a public unreliable network with a secure session key. In this paper, we propose a simple, efficient and provably secure PAKE protocol based on Diffie-Hellman key exchange and cryptographic hash function. Our protocol is secure against dictionary attacks. Its security is proved based on the hardness of the computational Diffie-Hellman problem in the random oracle model.

Practical Password-Authenticated Three-Party Key Exchange

Password-based authentication key exchange (PAKE) protocols in the literature typically assume a password that is shared between a client and a server. PAKE has been applied in various environments, especially in the “client-server” applications of remotely accessed systems, such as e-banking. With the rapid developments in modern communication environments, such as ad-hoc networks and ubiquitous computing, it is customary to construct a secure peer-to-peer channel, which is quite a different paradigm from existing paradigms. In such a peer-to-peer channel, it would be much more common for users to not share a password with others. In this paper, we consider password-based authentication key exchange in the three-party setting, where two users do not share a password between themselves but only with one server. The users make a session-key by using their different passwords with the help of the server. We propose an efficient password-based authentication key exchange protocol with different passwords that achieves forward secrecy in the standard model. The protocol requires parties to only memorize human-memorable passwords; all other information that is necessary to run the protocol is made public. The protocol is also light-weighted, i.e., it requires only three rounds and four modular exponentiations per user. In fact, this amount of computation and the number of rounds are comparable to the most efficient password-based authentication key exchange protocol in the random-oracle model. The dispensation of random oracles in the protocol does not require the security of any expensive signature schemes or zero-knowlegde proofs.

Proof of Forward Security for Password-Based Authenticated Key Exchange

Recently, M. Abdalla et al. proposed a slightly different variant of AuthA, based on the scheme proposed by E. Bresson et al., and provided the first complete proof of forward-secrecy for AuthA. They claimed that under the Gap Diffie-Hellman assumption the variant of AuthA was forward-secure in the random-oracle model. In this paper, we present an active attack to reveal a previously unpublished flaw in their proof. To fix their proof, we have to introduce one more variant Diffie-Hellman assumption. If so, we found the scheme proposed by E. Bresson et al. could be proved forward secure as well. Since the proposal of E. Bresson et al. is simpler for implementation in practice, we only provided the rigorous proof of forward security for it.

A security solution for IEEE 802.11's ad hoc mode: password-authentication and group Diffie Hellman key exchange

IEEE 802 standards ease the deployment of networking infrastructures and enable employers to access corporate networks while travelling. These standards provide two modes of communication called infrastructure and ad hoc modes. A security solution for the IEEE 802.11's infrastructure mode took several years to reach maturity and firmware is still been upgraded, yet a solution for the ad hoc mode needs to be specified. This paper is a first attempt in this direction. It leverages the latest developments in the area of password-based authentication and (group) Diffie Hellman key exchange to develop a provably secure key-exchange protocol for IEEE 802.11's ad hoc mode. The protocol allows users to securely join and leave the wireless group at time, accommodates either a single-shared password or pairwise-shared passwords among the group members or at least with a central server; achieves security against dictionary attacks in the ideal-hash model (i.e. random oracles). This is, to the best of our knowledge, the first such protocol to appear in the cryptographic literature.

Password-based authenticated key exchange in the three-party setting

Password-based authenticated key exchange (PAKE) consists of protocols which are designed to be secure even when the secret key used for authentication is a human-memorable password. In the article, the authors consider PAKE protocols in the 3-party scenario, in which the users trying to establish a common secret do not share a password between themselves but only with a trusted server. Towards their goal, the authors recall some of the existing security notions for PAKE protocols and introduce new ones that are more suitable to the case of generic constructions of 3-party protocols. The authors then present a natural generic construction of a 3-party PAKE protocol from any 2-party PAKE protocol and prove its security. To the best of the authors knowledge, the new protocol is the first provably secure PAKE protocol in the 3-party setting.