Blind Password Registration for Verifier-based PAKE

Abstract

We propose Blind Password Registration (BPR), a new class of cryptographic protocols that is instrumental for secure registration of client passwords at remote servers with additional protection against unwitting password disclosures on the server side that may occur due to the lack of the stateof-the-art password protection mechanisms implemented by the server or due to common server-compromise attacks. The dictionary attack resistance property of BPR protocols guarantees that the only information available to the server during and after the execution of the protocol cannot be used to reveal the client password without performing an offline dictionary attack on a password verifier (e.g. salted hash value) that is stored by the server at the end of the protocol. In particular, at no point in time the server is supposed to work with plain passwords. Our BPR model allows servers to enforce password policies and the requirement on the client to obey them during the execution of the BPR protocol is covered by the policy compliance property.We construct an efficient BPR protocol in the standard model for ASCII-based password policies using some techniques underlying the recently introduced Zero-Knowledge Password Policy Checks (ZKPPC). However, we do not rely on the full power of costly ZKPPC proofs and in fact show that BPR protocols can be modelled and realised simpler and significantly faster (as supported by our implementation) without using them as a building block. Our BPR protocol can directly be used to replace ZKPPC-based registration procedure for existing VPAKE protocols.

Achieving password-hashing scheme over lattices

“…• 重新定义口令散列方案的接口. 观察到, Kiefer-Manuals方案 [21,22] 提出的口令散列方案, 其盐 值不具有不可区分的特性, 与Benhanmouda-Pointcheval方案 [20] 提出的原始定义不同. 这在一定程度 上降低了方案安全性, 为在标准模型中获得抗量子口令散列方案, 结合Benhanmouda-Pointcheval方 案 [20] 、Kiefer-Manuals方案 [21,22] , 本文重新修订口令散列方案的定义, 并修正了口令散列方案的接口, 以便可以有效地集成到非对称PAKE协议中.…”

“…• 提出基于格的Pedersen承诺口令散列方案. 观察到, 现有的基于离散对数的口令散列方案 [21,22] 均使用Pedersen承诺方案设计而来. Nguyen等 [24] 利用格上基于SIS问题的KTX承诺, 提出了一种基于 格的口令散列协议, 该协议具有零知识口令策略检查的特性, 其构造依赖于复杂的随机排列, 但放松了 安全性要求, 使其盐值不具有不可区分性的特性.…”

“…此外, 非对称(或称基于验证因子的, verifier-based) PAKE协议 [20,25,26] 要求服务器端存储与口令相关的验证信息(例如, 带有与盐值相关的随机口令散 列). 因此, 为保证基于格的口令散列方案满足PAKE协议的要求, 本文遵循基于Pedersen类口令散列方 案 [21,22] 的技术路线, 提出了3种基于格上承诺口令散列方案. 相较于Nguyen等 [24] 复杂的permutation操 作, 本文方案具有更高的计算效率.…”

Zero-Knowledge Password Policy Check from Lattices

“…To improve the efficiency of secure password registration for VPAKE [32] and two server PAKE [33], Kiefer and Manulis proposed blind password registration (BPR), a new class of cryptographic protocols that prevent password leakage from the server. Using techinques introduced in [31], Kiefer and Manulis used an efficient shuffling proof from [19] to achieve O(1) number of set membership proofs instead of O(n max ) in ZKPPC.…”

Privacy-preserving protocols from lattice cryptography

“…To get better efficiency for secure password registration than VPAKE [125] and two server PAKE [126], Kiefer and Manulis introduced a new family of protocols called blind password registration (BPR). Adapting the techniques in [124], they applied an efficient shuffling proof from Furukawa [77] to reduce the number of set membership proofs to a constant number instead of being dependent on the maximum allowed password length.…”