A new lattice-based password authenticated key exchange scheme with anonymity and reusable key

Abstract

In this article, we propose a novel bilateral generalization inhomogenous short integer solution (BiGISIS)-based password-authenticated key exchange (PAKE) scheme for post-quantum era security. The hardness assumption of the constructed PAKE is based on newly proposed hard lattice problem, BiGISIS. The main aim of this article is to provide a solution for the post-quantum secure PAKE scheme, which is one of the open problems in the literature. The proposed PAKE is the first BiGISIS-based PAKE that satisfies anonymity and reusable key features. The bilateral-pasteurization (BiP) approach is used to obtain the reusable key, and anonymity is achieved thanks to the additional identity components and hash functions. The reusable key structure reduces the time in the key generation, and anonymity prevents illegal user login attempts. The security analysis is done by following the real-or-random (RoR) model assumptions. As a result of security examinations, perfect forward secrecy (PFS) and integrity are satisfied, and the resistance against eavesdropping, manipulation-based attack (MBA), hash function simulation, impersonation, signal leakage attack (SLA), man-in-the-middle (MitM), known-key security (KKS), and offline password dictionary attack (PDA) is captured. According to the comparison analysis, the proposed PAKE is the first SLA-resistant lattice-based PAKE with reusable key and anonymity properties.

Password authenticated key exchange-based on Kyber for mobile devices

“…Note that two other lattice-based PAKE schemes ( Dabra, Bala & Kumari, 2020 ; Ding, Cheng & Qin, 2022 ; Seyhan & Akleylek, 2024 ) for two-party mobile device security were proposed using different approaches, hardness, and additional properties. When we checked the proposals, no source code was given, and the results were not provided for all metrics, such as memory, CPU, and energy usage.…”

“…The security-related examinations were done by following ROM definitions. In Seyhan & Akleylek (2024) , we also built a four-phase PAKE to achieve reusable key and anonymity features for mobile device-server communication model. In the security analysis, we followed RoR assumptions to prove the semantic security.…”