Password-Authenticated Key Exchange between Clients with Different Passwords

Byun, Jin Wook; Jeong, Ik Rae; Lee, Dong Hoon; Park, Chang-Seop

doi:10.1007/3-540-36159-6_12

Cited by 71 publications

(54 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Password-based authenticated key exchange has been extensively studied in the last few years [5, 10-15, 18-20, 23, 26], with a portion of the work dealing with the subject of group key exchange and the vast majority dealing with different aspects of 2-party key exchange. Only a few of them (e.g., [12,18,26]) consider password-based protocols in the 3-party setting, but none of their schemes enjoys provable security. In fact, our generic construction seems to be the first provably-secure 3-party password-based authenticated key exchange protocol.…”

Section: Contributionsmentioning

confidence: 99%

Password-Based Authenticated Key Exchange in the Three-Party Setting

Abdalla

Fouque

Pointcheval

2005

Lecture Notes in Computer Science

522

123

View full text Add to dashboard Cite

Abstract. Password-based authenticated key exchange are protocols which are designed to be secure even when the secret key or password shared between two users is drawn from a small set of values. Due to the low entropy of passwords, such protocols are always subject to online guessing attacks. In these attacks, the adversary may succeed with non-negligible probability by guessing the password shared between two users during its on-line attempt to impersonate one of these users. The main goal of password-based authenticated key exchange protocols is to restrict the adversary to this case only. In this paper, we consider password-based authenticated key exchange in the three-party scenario, in which the users trying to establish a secret do not share a password between themselves but only with a trusted server. Towards our goal, we recall some of the existing security notions for password-based authenticated key exchange protocols and introduce new ones that are more suitable to the case of generic constructions. We then present a natural generic construction of a three-party protocol, based on any two-party authenticated key exchange protocol, and prove its security without making use of the Random Oracle model. To the best of our knowledge, the new protocol is the first provably-secure password-based protocol in the three-party setting.

show abstract

Section: Contributionsmentioning

confidence: 99%

Password-Based Authenticated Key Exchange in the Three-Party Setting

Abdalla

Fouque

Pointcheval

2005

Lecture Notes in Computer Science

522

123

View full text Add to dashboard Cite

show abstract

“…Password-based schemes, provably secure in the standard model, have been recently proposed [19,18,17], but only for two parties. Only few papers [15,21,27] have considered password-based protocols in the 3-party setting, but none of their schemes enjoys provable security. In fact, our generic construction seems to be the first provably-secure 3-party password-based authenticated key exchange protocol.…”

Section: Introductionmentioning

confidence: 99%

Password-based authenticated key exchange in the three-party setting

Abdalla

Fouque

Pointcheval

2006

IEE Proc. Inf. Secur.

224

426

View full text Add to dashboard Cite

Password-based authenticated key exchange (PAKE) are protocols which are designed to be secure even when the secret key used for authentication is a human-memorable password. In this paper, we consider PAKE protocols in the three-party scenario, in which the users trying to establish a common secret do not share a password between themselves but only with a trusted server. Towards our goal, we recall some of the existing security notions for PAKE protocols and introduce new ones that are more suitable to the case of generic constructions of three-party protocols. We then present a natural generic construction of a three-party PAKE protocol from any two-party PAKE protocol and prove its security. To the best of our knowledge, the new protocol is the first provably-secure PAKE protocol in the three-party setting.

show abstract

“…To provide a cross-realm authentication, where clients from one environment (realm) wish to communicate with clients from other realms, Byun et al [2] presented a Client-to-Client Password-Authenticated Key Exchange (C2C-PAKE) protocol. Kim et al [4] showed that the C2C-PAKE scheme is vulnerable to a Denning-Sacco-style attack where the attacker is an insider with knowledge of the password of a client in a different realm.…”

Section: Known As Encrypted Key Exchange (Eke)mentioning

confidence: 99%

Cryptanalysis of two password-authenticated key exchange protocols between clients with different passwords

Cao¹,

Zhang²

2007

imf

View full text Add to dashboard Cite

In large-scale client-client communication environments, Password-Authenticated Key Exchange (PAKE) based on trusted server is very convenient in key management. For enhancing the efficiency and preventing various attacks, Wang and Mo proposed a three-PAKE protocol, Yoon and Yoo proposed a C2C-PAKE protocol. However, in this paper, we show that the Wang-Mo protocol and the Yoon-Yoo protocol exist impersonation attack.

show abstract

Password-Authenticated Key Exchange between Clients with Different Passwords

Cited by 71 publications

References 12 publications

Password-Based Authenticated Key Exchange in the Three-Party Setting

Password-Based Authenticated Key Exchange in the Three-Party Setting

Password-based authenticated key exchange in the three-party setting

Cryptanalysis of two password-authenticated key exchange protocols between clients with different passwords

Contact Info

Product

Resources

About