A Secure Threshold Anonymous Password-Authenticated Key Exchange Protocol

Abstract

Abstract. At Indocrypt 2005, Viet et al., [22] have proposed an anonymous password-authenticated key exchange (PAKE) protocol and its threshold construction both of which are designed for client's password-based authentication and anonymity against a passive server, who does not deviate the protocol. In this paper, we first point out that their threshold construction is completely insecure against off-line dictionary attacks. For the threshold t > 1, we propose a secure threshold anonymous PAKE (for short, TAP) protocol with the number of clients n upper-bounded, such that n ≤ 2 √ N − 1 − 1, where N is a dictionary size of passwords. We rigorously prove that the TAP protocol has semantic security of session keys in the random oracle model by showing the reduction to the computational Diffie-Hellman problem. In addition, the TAP protocol provides unconditional anonymity against a passive server. For the threshold t = 1, we propose an efficient anonymous PAKE protocol that significantly improves efficiency in terms of computation costs and communication bandwidth compared to the original (not threshold) anonymous PAKE protocol [22].Key words: password authentication, key exchange, PAKE, anonymity, provable security At Indocrypt 2008, Yang and Zhang [25] have shown two attacks on the TAP (threshold t ≥ 2) protocol, and then proposed the NAPAKE (i.e., t = 1) and D-NAPAKE (i.e., t ≥ 2) protocols. Here, we add some comments on their paper [25]. PrefaceAbout two attacks on the TAP (t ≥ 2) protocol. In [25], they showed two insider attacks on legitimate clients in the TAP (t ≥ 2) protocol. However, we proved AKE security and unilateral authentication of the TAP (t ≥ 2) protocol against an adversary A / ∈ {C 1 , · · · , C n , S} where C = {C 1 , · · · , C n } is a set of all clients and S is the server (see the security model in Section 4). Of course, we agree that considering insider attacks and finding a solution are one of the research directions in cryptography. In Appendix B, we give a simple countermeasure for the TAP (t ≥ 2) protocol against the two attacks (i.e., impersonation attack and off-line dictionary attack). In fact, we considered keyword search as an application of the TAP (t ≥ 2) protocol and, in such applications, the off-line dictionary attack of legitimate clients is not possible because each share doesn't need to be transmitted to other parties.The D-NAPAKE protocol is not threshold anonymous PAKE! In Appendix C, we show an attack on the D-NAPAKE (i.e., t ≥ 2) protocol of [25] where only one legitimate client can impersonate any subgroup of clients to the server. That actually means that the D-NAPAKE (t ≥ 2) protocol is NOT a threshold anonymous PAKE protocol unlike the author's claim. This is the full version of [20].

Threshold Anonymous Password-Authenticated Key Exchange Secure against Insider Attacks

“…Though some protocols turned out to be insecure, their main idea [2] deserves to be reconsidered that by correctly combining symmetric and asymmetric cryptographic techniques we can prevent an adversary from verifying a guessed password (i.e., doing off-line dictionary attacks). Since then, their Encrypted Key Exchange protocols have formed the ba- APAKE t-out-of-n APAKE (insecure against active attacks) [22] TAP (t = 1) TAP (t > 1) (secure against active attacks) (insecure against insider attacks) [26] NAPAKE D-NAPAKE (claimed to be secure against insider attacks) [23] VEAP − (the most efficient) sis for what we call Password-Authenticated Key Exchange (PAKE) protocols. Such protocols [10] have been in standardization of IEEE P1363.2.…”

“…The client anonymity is guaranteed against an outside adversary as well as a passive server, who follows the protocol honestly but it is curious about identity of the client involved with the protocol. In [22], Shin et al, pointed out that the t-out-of-n APAKE protocol [25] is insecure against an outside adversary (i.e., doing off-line dictionary attacks). Also, they proposed an anonymous PAKE (TAP (t = 1)) protocol and its threshold (TAP (t > 1)) which are only based on the PAKE protocol [1], and showed that their protocols are secure against an outside adversary.…”

“…As in [22], [23], [25], we consider a semi-honest server S , who honestly follows the protocol P, but it is curious about the involved clients' identities. The client anonymity is defined by the probability distribution of messages in P.…”

Purpose-restricted Anonymous Mobile Communications Using Anonymous Signatures in Online Credential Systems

“…But [11] does not support the anonymous retrieval of credentials by the user in one protocol run. Here we extend the APAKE of [11] so that it can be used with ring signatures or group signatures. In our scenario, it is preferable to use ring signatures as contrarily to group signatures, ring signatures do not require a group manager (in charge of adding group members and revoking a member's anonymity) and additional setup for forming a group.…”

“…Recently, an efficient anonymous PAKE protocol has been proposed in [11] for performing anonymous authenticated key establishment. But [11] does not support the anonymous retrieval of credentials by the user in one protocol run. Here we extend the APAKE of [11] so that it can be used with ring signatures or group signatures.…”