Password-based protocols for authenticated key exchange (AKE) are designed to work despite the use of passwords drawn from a space so small that an adversary might well enumerate, off line, all possible passwords. While several such protocols have been suggested, the underlying theory has been lagging. We begin by defining a model for this problem, one rich enough to deal with password guessing, forward secrecy, server compromise, and loss of session keys. The one model can be used to define various goals. We take AKE (with "implicit" authentication) as the "basic" goal, and we give definitions for it, and for entity-authentication goals as well. Then we prove correctness for the idea at the center of the Encrypted Key-Exchange (EKE) protocol of Bellovin and Merritt: we prove security, in an ideal-cipher model, of the two-flow protocol at the core of EKE.

Entity authentication and key distribution are central cryptographic problems in distributed computing|but up until now, they have lacked even a meaningful de nition. One consequence is that incorrect and ine cient protocols have proliferated. This paper provides the rst treatment of these problems in the complexity-theoretic framework of modern cryptography. Addressed in detail are two problems of the symmetric, two-party setting: mutual authentication and authenticated key exchange. For each w e present a de nition, protocol, and proof that the protocol meets its goal, assuming the minimal assumption of pseudorandom function. When this assumption is appropriately instantiated, the protocols given are practical and e cient.

The use of ciyptographic hash functions like MD5 or SHA-1 for message authentication has become a standard approach in many applications, particularly Internet security protocols. Though very easy to implement, these mechanisms are usually based on ad hoc techniques that lack a sound security analysis. We present new, simple, and practical constructions of message authentication schemes based on a cryptographic hash function. Our schemes, NMAC and HMAC, are proven to be secure as long as the underlying hash function has some reasonable cryptographic strengths. Moreover we show, in a quantitative way, that the schemes retain almost all the security ofthe underlying hash function. The peiformance of our schemes is essentially that of the underlying hash function. Moreover they use the hash function (or its compression function) as a black box, so that widely available library code or hardwair can be used to implement them in a simple way, and replaceability of the underlying hash function is easily supported. * This version of otir paper has been ti-uncated due to page limits. The full veision is 131.

We study notions and schemes for symmetric ie. private key encryption in a concrete security framework.We give four di erent notions of security against chosen plaintext attack and analyze the concrete complexity o f reductions among them, providing both upper and lower bounds, and obtaining tight relations. In this way w e classify notions even though polynomially reducible to each other as stronger or weaker in terms of concrete security.Next we provide concrete security analyses of methods to encrypt using a block cipher, including the most popular encryption method, CBC. We establish tight bounds meaning matching upper bounds and attacks on the success of adversaries as a function of their resources.

Abstract. We compare the relative strengths of popular notions of security for public key encryption schemes. We consider the goals of privacy and non-malleability, each under chosen plaintext attack and two kinds of chosen ciphertext attack. For each of the resulting pairs of definitions we prove either an implication (every scheme meeting one no~ion must meet the other) or a separation (there is a scheme meeting one notion but not the other, assuming the first notion can be met at all). We similaxly treat plaintext awareness, a notion of security in the random oracle model. An additional contribution of this paper is a new definition of non-malleability which we believe is simpler than the previous one.