Zero-Knowledge Password Policy Checks and Verifier-Based PAKE

Kiefer, Franziskus; Manulis, Mark

doi:10.1007/978-3-319-11212-1_17

Cited by 24 publications

(69 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…In the discrete log setting considered in [31], passwords are mapped to large integers and then encoded as elements in a group of large order. Unfortunately, this does not translate well to the lattice setting as working with large-norm objects usually reduces the security and efficiency of the construction.…”

Section: Our Constructionsmentioning

confidence: 99%

“…Kiefer and Manulis [31] showed how to address this problem with zero knowledge password policy check (ZKPPC). It enables blind registration: users register a password with a server and prove password policy conformance without revealing anything about their passwords, thereby solving the dilemma.…”

Section: Introductionmentioning

confidence: 99%

“…Kiefer and Manulis [31] proposed a generic construction of ZKPPC using homomorphic commitments and set membership proofs. In the same work, a concrete ZKPPC protocol was constructed using Pedersen commitments [45], whose security is based on the hardness of the discrete logarithm problem.…”

Section: Introductionmentioning

confidence: 99%

“…The only construction of ZKPPC was proposed by Kiefer and Manulis [31] using Pedersen commitments [45] and a randomised password hashing scheme introduced in the same work. It commits each character individually and uses set membership proofs to prove compliance of the entire password to a password policy.…”

Section: Introductionmentioning

confidence: 99%

“…Using techinques introduced in [31], Kiefer and Manulis used an efficient shuffling proof from [19] to achieve O(1) number of set membership proofs instead of O(n max ) in ZKPPC. However, the security model considered for BPR is only suitable for honest but curious participants.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Zero-Knowledge Password Policy Check from Lattices

Nguyen

Tan

Wang

2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Passwords are ubiquitous and most commonly used to authenticate users when logging into online services. Using high entropy passwords is critical to prevent unauthorized access and password policies emerged to enforce this requirement on passwords. However, with current methods of password storage, poor practices and server breaches have leaked many passwords to the public. To protect one's sensitive information in case of such events, passwords should be hidden from servers. Verifier-based password authenticated key exchange, proposed by Bellovin and Merrit (IEEE S&P, 1992), allows authenticated secure channels to be established with a hash of a password (verifier). Unfortunately, this restricts password policies as passwords cannot be checked from their verifier. To address this issue, Kiefer and Manulis (ESORICS 2014) proposed zero-knowledge password policy check (ZKPPC). A ZKPPC protocol allows users to prove in zero knowledge that a hash of the user's password satisfies the password policy required by the server. Unfortunately, their proposal is not quantum resistant with the use of discrete logarithm-based cryptographic tools and there are currently no other viable alternatives. In this work, we construct the first post-quantum ZKPPC using lattice-based tools. To this end, we introduce a new randomised password hashing scheme for ASCII-based passwords and design an accompanying zero-knowledge protocol for policy compliance. Interestingly, our proposal does not follow the framework established by Kiefer and Manulis and offers an alternate construction without homomorphic commitments. Although our protocol is not ready to be used in practice, we think it is an important first step towards a quantum-resistant privacy-preserving password-based authentication and key exchange system.

show abstract

Section: Our Constructionsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Zero-Knowledge Password Policy Check from Lattices

Nguyen

Tan

Wang

2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

A Modular Framework for Multi-Factor Authentication and Key Exchange

Fleischhacker

Manulis

Azodi

2014

Security Standardisation Research

View full text Add to dashboard Cite

Secure Set-Based Policy Checking and Its Application to Password Registration

Dong

Kiefer

2015

Cryptology and Network Security

Self Cite

View full text Add to dashboard Cite

This version is available at https://strathprints.strath.ac.uk/54928/ Strathprints is designed to allow users to access the research output of the University of Strathclyde. Unless otherwise explicitly stated on the manuscript, Copyright © and Moral Rights for the papers on this site are retained by the individual authors and/or other copyright owners. Please check the manuscript for details of any other licences that may have been applied. You may not engage in further distribution of the material for any profitmaking activities or any commercial gain. You may freely distribute both the url (https://strathprints.strath.ac.uk/) and the content of this paper for research or private study, educational, or not-for-profit purposes without prior permission or charge.Any correspondence concerning this service should be sent to the Abstract. Policies are the corner stones of today's computer systems. They define secure states and safe operations. A common problem with policies is that their enforcement is often in conflict with user privacy. In order to check the satisfiability of a policy, a server usually needs to collect from a client some information which may be private. In this work we introduce the notion of secure set-based policy checking (SPC) that allows the server to verify policies while preserving the client's privacy. SPC is a generic protocol that can be applied in many policy-based systems. As an example, we show how to use SPC to build a password registration protocol so that a server can check whether a client's password is compliant with its password policy without seeing the password. We also analyse SPC and the password registration protocol and provide security proofs. To demonstrate the practicality of the proposed primitives, we report performance evaluation results based on a prototype implementation of the password registration protocol.

show abstract

Zero-Knowledge Password Policy Checks and Verifier-Based PAKE

Cited by 24 publications

References 15 publications

Zero-Knowledge Password Policy Check from Lattices

Zero-Knowledge Password Policy Check from Lattices

A Modular Framework for Multi-Factor Authentication and Key Exchange

Secure Set-Based Policy Checking and Its Application to Password Registration

Contact Info

Product

Resources

About