Authenticated Key Exchange Secure against Dictionary Attacks

Abstract

Password-based protocols for authenticated key exchange (AKE) are designed to work despite the use of passwords drawn from a space so small that an adversary might well enumerate, off line, all possible passwords. While several such protocols have been suggested, the underlying theory has been lagging. We begin by defining a model for this problem, one rich enough to deal with password guessing, forward secrecy, server compromise, and loss of session keys. The one model can be used to define various goals. We take AKE (with "implicit" authentication) as the "basic" goal, and we give definitions for it, and for entity-authentication goals as well. Then we prove correctness for the idea at the center of the Encrypted Key-Exchange (EKE) protocol of Bellovin and Merritt: we prove security, in an ideal-cipher model, of the two-flow protocol at the core of EKE.

Efficient Password-Authenticated Key Exchange Using Human-Memorable Passwords

“…More recently, two formal models for password-authenticated key exchange have been proposed: one by Bellare, Pointcheval, and Rogaway [3], based on [4,6] with extensions suggested by [21]; and a second by Boyko, MacKenzie, and Patel [10], following [2] with extensions given in [28]. While both models have their advantages, we choose to work in the first model and review the appropriate definitions in Section 2.…”

“…Only recently have formal validations of security for specific protocols appeared [3,10,22]. However, these validations are not proofs in the standard model; [3] relies on ideal ciphers, while [10,22] rely on random oracles.…”

“…The setting arising most often in practice -in which (human) users are only capable of storing "human-memorable" passwords (password-authenticated key exchange) -remains much less studied, though many heuristic protocols exist. Indeed, only recently have formal definitions of security for this setting appeared [3,10,22,17].…”

“…Many heuristic protocols have been proposed to solve this important problem. Only recently have formal validations of security (namely, proofs in the idealized random oracle and ideal cipher models) been given for specific constructions [3,10,22].Very recently, a construction based on general assumptions, secure in the standard model with human-memorable passwords, has been proposed by Goldreich and Lindell [17]. Their protocol requires no public parameters; unfortunately, it requires techniques from general multi-party computation which make it impractical.…”

“…Many heuristic protocols have been proposed to solve this important problem. Only recently have formal validations of security (namely, proofs in the idealized random oracle and ideal cipher models) been given for specific constructions [3,10,22].…”