Cryptanalysis of Two Provably Secure Cross-Realm C2C-PAKE Protocols

Abstract

Abstract. Password-Authenticated Key Exchange (PAKE) protocols allow parties to share secret keys in an authentic manner based on an easily memorizable password. Byun et al. first proposed a cross realm client-to-client (C2C) PAKE for clients of different realms (with different trusted servers) to establish a key. Subsequent work includes some attacks and a few other variants either to resist existing attacks or to improve the efficiency. However, all these variants were designed with heuristic security analysis despite that well founded provable security models already exist for PAKEs, e.g. the Bellare-Pointcheval-Rogaway model. Recently, the first provably secure cross-realm C2C-PAKE protocols were independently proposed by Byun et al. and Yin-Bao, respectively; i.e. security is proven rigorously within a formally defined security model and based on the hardness of some computationally intractable assumptions. In this paper, we show that both protocols fall to undetectable online dictionary attacks by any adversary. Further we show that malicious servers can launch successful man-in-the-middle attacks on the variant by Byun et al., while the Yin-Bao variant inherits a weakness against unknown key-share attacks. Designing provably secure protocols is indeed the right approach, but our results show that such proofs should be interpreted with care.

Cryptanalysis of simple three-party key exchange protocol (S-3PAKE)

“…the Corrupt query [14,15], or improperly defining the adversarial game [10] may result in a security proof that fails to capture valid attacks (see [10,14,15,32,33] for more details).…”

Improvement of a Three-party Key Exchange Protocol

“…For example, Steiner et al's, Abdalla et al's [3], Byun et al's [4] and Yin et al's [5] protocols cannot resist the password guessing attacks [6] [7]. Lin et al [8] and Ding et al [9] thought that the password guessing attacks have three classes:…”

“…Since it is widely used to send secret messages using the session key among parties over an insecure public network, therefore, lots of key exchange protocols have been proposed [3][4][5][6][7][8].…”

Password-Authenticated Key Exchange between Clients in a Cross-Realm Setting

“…However, S. Wang et al subsequently found the protocol due to Byun et al was insecure [22]. Later, two schemes for password-authenticated key establishment in a cross-realm setting were proposed in [24,25] but both of them were still pointed out to be insecure in [26]. To the best of our knowledge, no more work address the problem in the cross-realm setting and achieves provable security.…”