1. Password-based user authentication and key distribution protocols for client-server applications Authors: Her-Tyan Yeh and Hung-Min Sun Sources: The Journal of Systems and Software, Vol.72, pp.97-103, 2004. Adviser: Min-Shiang Hwang Speaker: Chun-Ta Li Date: 2004/11/04

2. 2 Outline IntroductionIntroduction Description of notations and security requirementsDescription of notations and security requirements Key transfer authentication protocol (KTAP)Key transfer authentication protocol (KTAP) Key agreement authentication protocol (KAAP)Key agreement authentication protocol (KAAP) ConclusionsConclusions CommentsComments

3. 3 Introduction Password-based mechanismPassword-based mechanism –User authentication –Password guessing attacks –Server can use strong cryptographic secret Session key creationSession key creation –Key transfer protocol (two-party, three-party) –Key agreement protocol (two-party, three-party) three-party three-party KTAP KAAP

4. 4 Introduction (cont.) Key Transfer Authentication Protocol (KTAP)Key Transfer Authentication Protocol (KTAP) Key Agreement Authentication Protocol (KAAP)Key Agreement Authentication Protocol (KAAP) Authentication Server Client Application Server Authentication Server Client Application Server authentication session key (K) authentication X 1 = g x mod P session key (K) Y 1 = g y mod P, K = g xy mod P session key (K) X1X1X1X1 Y1Y1Y1Y1

5. 5 Description of notations and security requirements NotationsNotations –A: Client –B: AP server –S: Trust authentication server –P A : Password shared between A and S –S B : Secret key shared between B and S –K S : Public key of the trust authentication server –x, y, ra, rb: Random numbers –[info] K : Symmetric encryption with key K –{info} K : Asymmetric encryption with the Public key K

6. 6 Description of notations and security requirements (cont.) Security requirementsSecurity requirements –Guessing attacks On-line guessing attackOn-line guessing attack Off-line guessing attackOff-line guessing attack –Replay attacks – Perfect forward secrecy AssumptionAssumption –All principals know the server’s public key Ks in the system –A poorly chosen password P A chosen by A is known to S via a secure channel –The application server’s secret key S B is known to S via a secure channel

7. 7 Key transfer authentication protocol (KTAP) B (Application server) A (Client) S (Trust authentication server) {A, B, P A, ra} K S [A, B, [A, K] ra, K] S B [A, K] ra,[B, rb] K rb h(K): session key

8. 8 Key transfer authentication protocol (cont.) Security analysisSecurity analysis –Guessing attacks -- P A in Message 1 is used only to authenticate A’s statusP A in Message 1 is used only to authenticate A’s status –Replay attacks Attacker can get is {[A, B, [A, K] ra, K] S B, [A, K] ra, [B, rb] K }Attacker can get is {[A, B, [A, K] ra, K] S B, [A, K] ra, [B, rb] K } –Perfect forward secrecy Attacker can know PA: doesn’t know server’s private keyAttacker can know PA: doesn’t know server’s private key unknown {A, B, P A, ra} K S unknown

9. 9 Key transfer authentication protocol (cont.) Comparison with the related worksComparison with the related works

10. 10 Key agreement authentication protocol (KAAP) B (Application server) A (Client) S (Trust authentication server) {A, B, P A, ra, g x } K S [A, g x ] S B g y, [B, rb] K rb K= g xy (session key)

11. 11 Key agreement authentication protocol (cont.) Security analysisSecurity analysis –Guessing attacks -- P A in Message 1 is used only to authenticate A’s statusP A in Message 1 is used only to authenticate A’s status The attacker must also guess the value of raThe attacker must also guess the value of ra –Replay attacks (forge K`) Attacker can get is {{A, B, P A, ra, g x }, [A, g x ] S B, [B, rb] K }Attacker can get is {{A, B, P A, ra, g x }, [A, g x ] S B, [B, rb] K } –Perfect forward secrecy Attacker can know PA: doesn’t know server’s private keyAttacker can know PA: doesn’t know server’s private key {A, B, P A, ra, g x } K S unknown unknown unknown

12. 12 Key agreement authentication protocol (cont.) Comparison with the related worksComparison with the related works

13. 13 Conclusions Authors introduced key distribution protocols: KTAP and KAAPAuthors introduced key distribution protocols: KTAP and KAAP These two protocols can be applied to various communication systems in distributed computing environmentsThese two protocols can be applied to various communication systems in distributed computing environments

14. Thanks for your attention