Fuzzy Password-Authenticated Key Exchange

Abstract

Consider key agreement by two parties who start out knowing a common secret (which we refer to as "pass-string", a generalization of "password"), but face two complications: (1) the pass-string may come from a low-entropy distribution, and (2) the two parties' copies of the pass-string may have some noise, and thus not match exactly. We provide the first efficient and general solutions to this problem that enable, for example, key agreement based on commonly used biometrics such as iris scans. The problem of key agreement with each of these complications individually has been well studied in literature. Key agreement from low-entropy shared pass-strings is achieved by password-authenticated key exchange (PAKE), and key agreement from noisy but highentropy shared pass-strings is achieved by information-reconciliation protocols as long as the two secrets are "close enough." However, the problem of key agreement from noisy low-entropy pass-strings has never been studied. We introduce (universally composable) fuzzy password-authenticated key exchange (fPAKE), which solves exactly this problem. fPAKE does not have any entropy requirements for the pass-strings, and enables secure key agreement as long as the two pass-strings are "close" for some notion of closeness. We also give two constructions. The first construction achieves our fPAKE definition for any (efficiently computable) notion of closeness, including those that could not be handled before even in the high-entropy setting. It uses Yao's garbled circuits in a way that is only two times more costly than their use against semi-honest adversaries, but that guarantees security against malicious adversaries. The second construction is more efficient, but achieves our fPAKE definition only for pass-strings with low Hamming distance. It builds on very simple primitives: robust secret sharing and PAKE.

FastZIP

“…To implement the fPAKE protocol, we use primitives from a Python cryptography library [39]. For the ECC, we utilize Shamir's secret sharing scheme in its error-correcting variant (i.e., introducing redundancy by adding more point-value pairs of the polynomial) [10]. For the PAKE component, we use the Encrypted Key Exchange (EKE) protocol [1], built as Diffie-Hellman key exchange symmetrically encrypted with passwords.…”

“…This is challenging because fewer bits means less entropy in a shared key, easing an offline attack. To address this challenge, we adapt a recently introduced Fuzzy Password-Authenticated Key Exchange (fPAKE) protocol [10]. fPAKE establishes a shared key from low-entropy secrets (e.g., short passwords) and is resistant to offline attacks.…”

“…(3) attacks caused by the predictable context (e.g., replay). FastZIP overcomes these limitations by a novel design, namely combining the fPAKE protocol [10] and multi-sensor context constructed by combining multiple sensor modalities (i.e., sensor fusion). Table 3 compares FastZIP and prominent state-of-the-art ZIP schemes in terms of pairing time, error rates, and entropy biases in the fingerprints.…”

“…We first explain the working principle and shortcomings of fuzzy commitments-a cryptographic protocol used by state-of-the-art ZIP schemes to share a secret key. Then, we detail the fPAKE protocol [10], addressing these shortcomings, that we utilize in FastZIP.…”

Moonshine

“…Key reconciliation-a suite of techniques that context-based authentication relies heavily on-was originally developed for exchanging information over quantum communication channels [2,3,20]. Fuzzy extractors [5], fuzzy vaults [13], fuzzy commitment [14], and fPAKEs [6] are more modern cryptographic techniques that are commonly used in key reconciliation by context-based authentication systems. Also other authors have built techniques to create a more uniform distribution of biased random number generators [8].…”