Source： IEEE Communications Letters, Vol.9, No.1, pp.93-95, Jan 2005

Slides:

Advertisements

Similar presentations

1 Key Exchange Solutions Diffie-Hellman Protocol Needham Schroeder Protocol X.509 Certification.

Advertisements

Key distribution and certification In the case of public key encryption model the authenticity of the public key of each partner in the communication must.

多媒體網路安全實驗室 An efficient and security dynamic identity based authentication protocol for multi-server architecture using smart cards 作者 :JongHyup LEE 出處.

Further improvement on the modified authenticated key agreement scheme Authors: N.Y. Lee and M.F. Lee Source: Applied Mathematics and Computation, Vol.157,

An Improvement on Authenticated Key Agreement Scheme Authors: Chin-Chen Chang and Shih-Yi Lin Source: 2007 International Conference on Intelligent Pervasive.

1 Authenticated key agreement without using one-way hash functions Harn, L.; Lin, H.-Y. Electronics Letters, Volume: 37 Issue: 10, 10 May 2001 Presented.

1 Security analysis of an enhanced authentication key exchange protocol Authors ： H.Y. Liu, G.B. Horng, F.Y. Hung Presented by F.Y. Hung Date ： 2005/5/20.

Efficient verifier-based key agreement protocol for three parties without server’s public key Source: Applied Mathematics and Computation 167 (2005)

Chapter 9 Cryptographic Protocol Cryptography-Principles and Practice Harbin Institute of Technology School of Computer Science and Technology Zhijun Li.

1 Security Weakness in a Three-Party Password-Based Key Exchange Protocol Using Weil Pairing From ： ePrint (August 2005) Author ： Junghyun Nam, Seungjoo.

Diffie-Hellman Key Exchange

1 Needham-Schroeder A --> S: A,B, N A S --> A: {N A,B,K AB,{K AB,A} KBS } KAS A --> B:{K AB,A} KBS B --> A:{N B } KAB A --> B:{N B -1} KAB.

Secure Communication between Set-top Box and Smart Card in DTV Broadcasting Authors: T. Jiang, Y. Hou and S. Zheng Source: IEEE Transactions on Consumer.

MSN lab1 A novel deniable authentication protocol using generalized ElGamal signature scheme Source: Information Sciences, vol. 177, pp , 2007.

Password-based user authentication and key distribution protocols for client-server applications Authors: Her-Tyan Yeh and Hung-Min Sun Sources: The Journal.

Robust and Efficient Password- Authenticated Key Agreement Using Smart Cards Authors: Wen-Shenq Juang, Sian-Teng Chen and Horng-Twu Liaw Src: IEEE Transaction.

1 An Ordered Multi-Proxy Multi-Signature Scheme Authors: Min-Shiang Hwang, Shiang-Feng Tzeng, Shu-Fen Chiou Speaker: Shu-Fen Chiou.

Lesson Introduction ●Authentication protocols ●Key exchange protocols ●Kerberos Security Protocols.

A Secure Authentication Scheme with Anonymity for Wireless Communications IEEE COMMUNICATIONS LETTERS, VOL. 12, NO. 10, OCTOBER 2008 Chia-Chun Wu, Wei-Bin.

Non-PKI Methods for Public Key Distribution

A Dynamic ID-Based Generic Framework for Anonymous Authentication Scheme for Roaming Service in Global Mobility Networks Source: Wireless Personal Communications,

Source: The Journal of Systems and Software, Vol. 73, 2004, pp.507–514

Encryption and Integrity

Cryptanalyses and improvements of two cryptographic key assignment schemes for dynamic access control in a user hierarchy Source: Computer & Security,

Author:YongBin Zhou, ZhenFeng Zhang, and DengGuo Feng Presenter:戴士桀

Key Substitution Attacks on Some Provably Secure Signature Schemes

Advanced Computer Networks

A lightweight authentication scheme based on self-updating strategy for space information network Source: International Journal Of Satellite Communications.

Author : Guilin Wang Source : Information Processing Letters

Protocol Analysis.

Information Security message M one-way hash fingerprint f = H(M)

Cryptanalysis on Mu–Varadharajan's e-voting schemes

A secure and traceable E-DRM system based on mobile device

A Wireless LAN Security Protocol

Source: IEEE Communications Letters, Vol. 8, No. 3, March 2004

CS480 Cryptography and Information Security

Efficient password authenticated key agreement using smart cards

SAKAWP: Simple Authenticated Key Agreement Protocol Based on Weil Pairing Authors: Eun-Jun Yoon and Kee-Young Yoo Src: International Conference on Convergence.

Anonymous Wireless Authentication on a Portable Cellular Mobile System

Security of a Remote Users Authentication Scheme Using Smart Cards

Authors: Wei-Chi KU, Hao-Chuan TSAI, Maw-Jinn TSAUR

Information Security message M one-way hash fingerprint f = H(M)

Information Security message M one-way hash fingerprint f = H(M)

Message Security, User Authentication, and Key Management

Diffie-Hellman Secure Key Exchange 1976.

9.2 SECURE CHANNELS Medisetty Swathy.

Diffie-Hellman Key-Exchange Algorithm

Celia Li Computer Science and Engineering York University

Secure Electronic Transaction (SET) University of Windsor

IT IS 6200/8200.

Information Security message M one-way hash fingerprint f = H(M)

Security Properties Straw Polls

Bishop: Chapter 10 Key Management: Digital Signature

Diffie-Hellman key exchange/agreement algorithm

Authors：Debiao He, Sherali Zeadally, Neeraj Kumar and Wei Wu

Key Establishment Protocols ~

Date:2011/09/28 報告人：向峻霈出處: Ren-Chiun Wang Wen-Shenq Juang

Authors: Yuh-Min TSENG, Tsu-Yang WU, Jui-DiWU

Asymmetric Cryptographic Algorithms

刘振上海交通大学计算机科学与工程系电信群楼3-509

Chapter 15 Key Management

Biometrics-based RSA Cryptosystem for Securing Real-Time Communication

A Distributed Sign-and-Encryption for Anonymity

Secure Diffie-Hellman Algorithm

Privacy Protection for E-Health Systems by

Key Exchange, Man-in-the-Middle Attack

Improved Authenticated Multiple-Key Agreement Protocol

A Quadratic-Residue-based Fragile Watermarking Scheme

Lecture 6.2: Protocols - Authentication and Key Exchange II

Presentation transcript:

Security Analysis and Improvement of the Efficient Password-based Authentication Protocol Source： IEEE Communications Letters, Vol.9, No.1, pp.93-95, Jan 2005 Author: Taekyoung Kwon, Young-Ho Park, and Hee Jung Lee Speaker: Shing-Chin Pai

Outline Introduction EPA Protocol Server Compromise Attack on EPA EPA Protocol Improvement Conclusion

Introduction Password authenticated key exchange (PAKE) Memorable password Efficient password-based Authentication Protocol (EPA) Two generators Three message passes Server User Message 1 Message 2 Message 3

EPA Protocol (1/2) Alice, Bob : Two participators p, q : Two large primes f, g : Two generators, gq mod p = 1, f q mod p = 1 IA : Identity of Alice Π : Alice’s password h: One way hash fuction K: Session key Zq*: q of reduced set of residues Bob maintains〈V1 ,V2〉for Alice V1 = f v1 mod p, v1 = h1(IA , Π) V2 = gv2 mod p, v2 = h2(IA , Π)

EPA Protocol (2/2) Alice Bob 2.〈IA , X〉 X’ = (X/V1) = gx mod p V1 = f v1 mod p, v1 = h1(IA , Π) V2 = gv2 mod p, v2 = h2(IA , Π) Alice Bob Alice chooses a random number x Zq*, x≠-h2(IA ,Π) mod q 3. Bob chooses a random number y 2.〈IA , X〉 X’ = (X/V1) = gx mod p 1. X = gxV1 mod p Y = (X’V2)y mod p = g(x+v2)y mod p 4. 〈Y , h3(KB || X)〉 KB = (X’)y = gxy mod p HB= h3(KB || X) KA=KB KA = (Y)x(x+v2)-1 mod p = gxy mod p HA= h4(KA || X) 5. 〈h4(Y || KA)〉 Verifies HA ? Verifies HB ?

Server Compromise Attack on EPA – Basic Attack (1/2) V1 = f v1 mod p, v1 = h1(IA , Π) V2 = gv2 mod p, v2 = h2(IA , Π) Compromise Attack: Attacker Get <V1,V2> form Server. Eva Bob 3. Bob chooses a random number y 1. X = V2V1 mod p 2.〈IA , X〉 X’ = (X/V1) = V2 Y = (X’V2)y mod p = V22y mod p 4. 〈Y , h3(KB || X)〉 KB = (X’)y = (V2) y mod p HB= h3(KB || X) KA = (Y)1/2 mod p = (V2)y mod p HA=h4(Y || KA) 5. 〈h4(Y || KA)〉 Verifies HA ? Verifies HB ?

Server Compromise Attack on EPA – General Attack (2/2) V1 = f v1 mod p, v1 = h1(IA , Π) V2 = gv2 mod p, v2 = h2(IA , Π) Eva Bob Eva chooses a random number r Zq*, 3. Bob chooses a random number y 2.〈IA , X〉 1. X = V2rV1 mod p X’ = (X/V1) = V2r Y = (X’V2)y mod p = V2(r+1) y mod p 4. 〈Y , h3(KB || X)〉 KB = (X’)y = (V2) r y mod p HB= h3(KB || X) KA = (Y)r(r+1)-1 mod p = (V2)ry mod p HA=h4(Y || KA) 5. 〈h4(Y || KA)〉 Verifies HA ? Verifies HB ?

EPA Protocol Improvement(1/3) V1 = f v1 mod p, v1 = h1(IA , Π) V2 = gv2 mod p, v2 = h2(IA , Π) Alice Bob Alice chooses a random number x Zq*, x≠-h2(IA ,Π) mod q 3. Bob chooses a random number y 2.〈IA , X〉 X’ = (X/V1) = gx mod p 1. X = gxV1 mod p Y = (X’V2)y mod p = g(x+v2)y mod p 4. 〈Y , h3(KB || X)〉 KB = (X’g)y = g(x+1)y mod p HB= h3(KB || X) KA = (Y)(x+1)(x+v2)-1 mod p = g(x+1)y mod p HA= h4(Y || KA) 5. 〈h4(Y || KA)〉 Verifies HA ? Verifies HB ?

EPA Protocol Improvement(2/3) (Basic Attack on EPA) Eva Bob 3. Bob chooses a random number y 1. X = V2V1 mod p 2.〈IA , X〉 X’ = (X/V1) = V2 Y = (X’V2)y mod p = V22y mod p 4. 〈Y , h3(KB || X)〉 KB = (X’)y = (V2g) y mod p HB= h3(KB || X) KA = (Y)1/2 mod p = (V2)y mod p HA=h4(Y || KA) 5. 〈h4(Y || KA)〉 Verifies HA ? Verifies HB ?

EPA Protocol Improvement(3/3) (General Attack on EPA) V1 = f v1 mod p, v1 = h1(IA , Π) V2 = gv2 mod p, v2 = h2(IA , Π) Eva Bob Eva chooses a random number r Zq*, 3. Bob chooses a random number y 2.〈IA , X〉 1. X = V2rV1 mod p X’ = (X/V1) = V2r Y = (X’V2)y mod p = V2(r+1)y mod p KA = (Y)r(r+1)-1 mod p = (V2)ry mod p =gv2rymod p HA= h4(Y || KA) 4. 〈Y , h3(KB || X)〉 KB = (X’g)y = (V2rg)y mod p = gv2r y+gy mod p HB= h3(KB || X) 5. 〈h4(Y || KA)〉 Verifies HA ? Verifies HB ?

Conclusion Improve the Security of EPA.