1. The Secure Password-Based Authentication Protocol
Jeong Yunkyoung

2. Contents Introduction Authentication over an untrusted network
Secure Password Authentication
Previous Work
EKE
SRP
PAK
Future Study
Reference

3. Introduction Techniques for user authentication
What a user knows (passwords, PINs)
What a user is (voiceprint identification, retinal scanners)
What a user has (ID cards, smartcards)
The problem of password authentication protocol
One party must somehow prove to another party that it knows some password P.
telnet, Kerberos : insecure

4. Authentication over an untrusted network(1)
We want a password authentication and key-exchange protocol suitable for authenticating users and exchanging keys over an untrusted network.
Alice
Bob
Password=“sesame”
The Internet

5. Authentication over an untrusted network(2)
Alice
Bob
Password=“sesame”
K=3A82019B7CE8F1F9
The Internet

6. Secure Password Authentication
Remote user access
If one of the entities is a user and the other is a server, then this can be seen as a problem in the area of remote user access.
Goal: security without requiring the user to carry/remember anything except password
BUT, Password is “weak” : “easily memorizable” “low entropy” “easily guessed” “drawn from a ‘small’ dictionary”
Dictionary attack

7. Previous Work - EKE Encrypted Key Exchange
Steven M. Bellovin, Michael Merritt
Notation

8. Previous Work - EKE Protocol (using RSA)
Both parites have cleartext versions of the shared password.
Alice
Bob K

9. Previous Work - SRP
Secure Remote Password Protocol
Thomas Wu
Notation

10. Previous Work - SRP Protocol
To establish a password P with Steve, Carol picks a random salt s, and computes .
Carol
Steve

11. Previous Work - PAK Victor Boyko, Philip MacKenzie, Sarvar patel
P=rq+1 for some value r co-prime to q.
g is a generator of a subgroup of of size q.
The resulting session key is K.
Alice
Bob

12. Future Study Some effort is needed. My approach… Network is insecure.
PAP for using a short password.
Don’t have cleartext version of the shared password.
Less rounding.
Using Diffie-Hellman and Hash,etc.
Suggest efficient and secure password-based
authentication protocol.

13. Reference
S.M.Bellovin and M.Merritt. Encrypted key exchange: Password-based protocols secure against dictionary attacks. In IEEE Security 92, pages
S.M.Bellovin and M.Merritt. Augumented encrypted key exchange: Password-based protocols secure against dictionary attacks. In IEEE Security 92, pages
T.Wu. The secure remote password protocol. In NDSS 98, pages
V.Boyko, P.MacKenzie, and S.Patel. Provably-secure password authentication and key exchange using Diffie-Hellman. In EUROCRYPT2000 , PAGES
P.MacKenzie and R.Swaminathan. Secure network authentication with password information. Manuscript.