Elliptic Curve Based Password Authenticated Key Exchange Protocols

How to Hash into Elliptic Curves

“…However for ordinary curves the classical approach is inherently probabilistic; this implies that the number of operations required to hash the password may depend on the password itself. As shown in [3] this can lead to a timing attack. Therefore, it would be useful to be able to hash into a curve in a constant number of operations.…”

Trapdoor Hard-to-Invert Group Isomorphisms and Their Application to Password-Based Authentication

“…A classical way to break password-based schemes is the partition attack [5]. The basic idea is that if the cleartexts encrypted with the password have any redundancy, or lie in a strict subset, a dictionary attack can be successfully mounted: considering one flow (obtained by eavesdropping) one first chooses a password, decrypts the ciphertext and checks whether the redundancy is present or not (or whether the plaintext lies in the correct range).…”

“…Game G 5 . In this game we introduce a random challenge (ϕ, ρ), where ϕ is randomly drawn from F and ρ is randomly drawn from Y ϕ (or equivalently, because of the isomorphic property of f , σ is randomly drawn from X ϕ and ρ = ϕ(σ )).…”

“…Rule A1 (5) If this is the cth instance of the party A, f is set to ϕ. Otherwise, f is randomly drawn from F, as follows: Choose a random trapdoor…”

“…Rule A2 (5) If f = ϕ, use the simulator to build the proof of validity p of f . Otherwise, compute p ← Prove m ( f, t, seed).…”