1. A password authentication scheme with secure password updating SEC 期末報告 學號： 89321037 姓名：翁玉芬

2. Source Chun-Li Lin and Tzonelih Hwang, Computers & Security, Vol.22, No.1, pp. 68-72, 2003

3. Outline Introduction Peryravian-Zunic’s Scheme Hwang-Yen’s Scheme Proposed Scheme Conclusions

4. Introduction Password scheme  Password authentication protocol replay attack password search attack stolen-verifier attack  Password change protocol denial of service attack  Key distribution forward secrecy Peyarian -Zunic Hwang -Yen Proposed scheme Password authentication Yes Password change Yes Key distribution Yes

5. Introduction (cont.) Notations  id: user number  pw: password  K s : the server public key  {M}K s : Encryption of M with K s  rc: random number generated by client  rs: random number generated by server  H(.) : one-way hash function

6. Peyarian-Zunic’s Scheme – password transmission ClientServer id, rc rs id, H( H( id, pw), rc, rs) Access granted or denied. stolen-verifier attack

7. Peyarian-Zunic’s Scheme – password change ClientServer id, rc rs Access granted or denied id, H( H( id, pw), rc, rs), denial of service attack

8. Hwang-Yen’s Scheme –password transmission ClientServer id, { rc, pw}K s id, H (rc, rs) Access granted or denied, H ( rs)

9. Hwang-Yen’s Scheme -Key distribution ClientServer id, { rc, pw}K s receive rc generate rc generate rs, H ( rs) receive rs id, H (rc, rs) Access granted or denied Compute H (rc,rs) Compute H (rc,rs) one-time token No forward secrecy

10. Hwang-Yen’s Scheme -password change ClientServer id, { rc, pw}K s Access granted or denied, H( rs) id, H(rc, rs), denial of service attack

11. Proposed Scheme –password change ClientServer id, { rc, pw}K s Access granted or denied, H( rs) id, H(rc, rs), H( H( new_pw), rs)

12. Proposed Scheme –key distribution ClientServer generate x generate y id, Receive receive Access granted or denied id, Compute

13. Conclusions The password change protocol can protest against denial of service attack The key distribution protocol can propose forward secrecy