Cryptanalysis of a communication-efficient three-party password authenticated key exchange protocol

Wu, Shang; Pu, Qiaosheng; Wang, Shengbao; He, Debiao

doi:10.1016/j.ins.2012.06.005

Cited by 29 publications

(32 citation statements)

References 47 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It has been observed that the 3PAKE protocol is either based on the smart card [10][11][12][13][14][15] or without smart card [16][17][18][19] and uses many cryptographic algorithms such as one-way hash function [15], ecc [20], chaotic maps [21][22][23][24][25][26] in the literature. In 2006, Juang [11] proposed a 3PAKE protocol using smart card, which was not suitable for practical application, as the response time of the protocol was very low, because of taking five rounds of messages.…”

Section: Literature Reviewmentioning

confidence: 99%

Cryptanalysis and Design of a Three-Party Authenticated Key Exchange Protocol Using Smart Card

Amin

Biswas

2015

Arab J Sci Eng

View full text Add to dashboard Cite

Three-party authenticated key exchange protocol (3PAKE) is used to provide security protection on the transmitted data over the insecure communication by performing session key agreement between the entities involved. Comparing with the 2PAKE protocol, 3PAKE protocol is more suitable for managing unrestricted number of users. Recently, several researchers have proposed many 3PAKE protocols using smart card. However, we have scrutinized carefully recently published Yang et al.'s protocol, and it has been observed that the same protocol suffers from several security weaknesses such as insider attack, off-line password guessing attack, many logged-in users' attack and replay attack. Moreover, we have justified a serious security issue of the password change phase of the same scheme. In order to fix the above-mentioned shortcomings, this paper proposes an efficient 3PAKE protocol using smart card based on the cryptographic one-way hash function. The formal security analysis proves that proposed protocol provides strong security protection on the relevant security attacks including the above-mentioned security weaknesses. Moreover, the simulation results of the proposed scheme using AVISPA tool show that the same protocol is SAFE under OFMC and CLAtSe models. The performance comparisons are also made, which ensure that the protocol is relatively better than the existing related schemes. To the best of our knowledge, the proposed scheme should be implemented in practical application, as it provides well security protection on the B Ruhul Amin relevant security attacks, provides relatively better complexities than the existing schemes, achieves proper mutual authentication along with user-friendly password change phase.

show abstract

Section: Literature Reviewmentioning

confidence: 99%

Cryptanalysis and Design of a Three-Party Authenticated Key Exchange Protocol Using Smart Card

Amin

Biswas

2015

Arab J Sci Eng

View full text Add to dashboard Cite

show abstract

“…However, Wu et al . proved that the scheme of Chang et al , is vulnerable to a partition attack and proposed an improvement. Further, in 2013, Tso showed that the scheme of Chang et al , is insecure against passive attacks and then proposed two improvements to withstand the security flaws found in .…”

Section: Introductionmentioning

confidence: 99%

An efficient biometric‐based privacy‐preserving three‐party authentication with key agreement protocol using smart cards

Odelu

Das

Goswami

2015

Security Comm Networks

View full text Add to dashboard Cite

In communication systems, authentication protocols play an important role in protecting sensitive information against a malicious adversary by means of providing a variety of services such as mutual authentication, user credentials' privacy, and user revocation facility when the smart card of the user is lost/stolen or user's authentication parameters are revealed. Recently, several three-party authentication with key agreement (3PAKA) schemes are proposed in the literature, but most of them do not provide the basic security requirements such as user anonymity as well as user revocation and reregistration with the same identity. Thus, we feel that there is a great need to design a secure 3PAKA scheme with these security properties. In this paper, we propose a new secure biometric-based privacy-preserving 3PAKA scheme using the elliptic curve cryptography with efficient mechanism for the user revocation and re-registration with the same identity. The formal security analysis using the widely accepted Burrows-Abadi-Needham logic shows that our scheme provides secure authentication. In addition, we simulate our scheme for the formal security verification using the widely accepted Automated Validation of Internet Security Protocols and Applications tool. The simulation results show that our scheme is secure against passive and active attacks. Furthermore, our scheme is efficient as compared with other related schemes. Our scheme provides high security along with low computation and communication costs, and extra features as compared with other related existing schemes in the literature, and as a result, our scheme is suitable for battery-limited mobile devices. An efficient biometric-based three-party authentication protocol Security Comm. Networks 2015; 8:4136-4156 An efficient biometric-based three-party authentication protocol ECDLP assumption: There exists no (t, )-ECDLP distinguisher for E p (a, b). Thus, for every D, Adv ECDLP D,E p (a,b) (t) Ä , for any sufficiently small > 0. Security Comm. Networks 2015; 8:4136-4156An efficient biometric-based three-party authentication protocol Figure 4. Role specification in HLPSL for the session, goal and environment.

show abstract

“…In such a three-party model, the server provides its registered clients with a centralized authentication service, which allows each client to remember and manage only a single password. Password guessing attacks (also known as dictionary attacks) present a more subtle threat in the three-party model (compared to a two-party model), as a malicious client can attempt to mount such an attack against another client; see [2][3][4][5][6].…”

Section: Introductionmentioning

confidence: 99%

“…A number of three-party PAKE protocols have been proposed over the last decade [2,3,5,6,[11][12][13][14][15][16][17][18][19][20][21][22][23][24][25]. Many of these protocols have never been proven secure in any model [3,13,[17][18][19][20][21] and/or have been found to be vulnerable to some attack(s) [2,3,5,6,8,[18][19][20]23,[26][27][28][29][30][31][32].…”

Section: Introductionmentioning

confidence: 99%

“…Many of these protocols have never been proven secure in any model [3,13,[17][18][19][20][21] and/or have been found to be vulnerable to some attack(s) [2,3,5,6,8,[18][19][20]23,[26][27][28][29][30][31][32]. Some protocols [2,11,12,15,23,24] have been proven secure only in a restricted model, in which the adversary is not allowed to corrupt protocol participants, and thus, no attacks by malicious clients can be captured.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Two-Round Password-Only Authenticated Key Exchange in the Three-Party Setting

et al. 2015

View full text Add to dashboard Cite

We present the first provably-secure three-party password-only authenticated key exchange (PAKE) protocol that can run in only two communication rounds. Our protocol is generic in the sense that it can be constructed from any two-party PAKE protocol. The protocol is proven secure in a variant of the widely-accepted model of Bellare, Pointcheval and Rogaway (2000) without any idealized assumptions on the cryptographic primitives used. We also investigate the security of the two-round, three-party PAKE protocol of Wang, Hu and Li (2010) and demonstrate that this protocol cannot achieve implicit key authentication in the presence of an active adversary.

show abstract

Cryptanalysis of a communication-efficient three-party password authenticated key exchange protocol

Cited by 29 publications

References 47 publications

Cryptanalysis and Design of a Three-Party Authenticated Key Exchange Protocol Using Smart Card

Cryptanalysis and Design of a Three-Party Authenticated Key Exchange Protocol Using Smart Card

An efficient biometric‐based privacy‐preserving three‐party authentication with key agreement protocol using smart cards

Two-Round Password-Only Authenticated Key Exchange in the Three-Party Setting

Contact Info

Product

Resources

About