Computationally-Efficient Password Authenticated Key Exchange Based on Quadratic Residues
In this paper, we present a computationally efficient password authenticated key exchange protocol based on quadratic residues. The protocol, called QR-CEKE, is derived from the protocol QR-EKE, a previously published password authenticated key exchange p
- PDF / 461,666 Bytes
- 10 Pages / 430 x 660 pts Page_size
- 56 Downloads / 219 Views
Abstract. In this paper, we present a computationally efficient password authenticated key exchange protocol based on quadratic residues. The protocol, called QR-CEKE, is derived from the protocol QR-EKE, a previously published password authenticated key exchange protocol based on quadratic residues. The computational time for the client, however, is significant reduced in the protocol QR-CEKE. In comparison with QR-EKE, the protocol QR-CEKE is more suitable to an imbalanced computing environment where a low-end client device communicates with a powerful server over a broadband network. Based on number-theoretic techniques, we show that the computationally efficient password authenticated key exchange protocol is secure against residue attacks, a special type of off-line dictionary attack against passwordauthenticated key exchange protocols based on factorization. We also provide a formal security analysis of QR-CEKE under the factoring assumption and the random oracle model.
1
Introduction
Password-authenticated key exchange protocols allow two entities who share a small password to authenticate each other and agree on a large session key between them. Such protocols are attractive for their simplicity and convenience and have received much interest in the research community. A major challenge in designing password-authenticated key exchange protocols is to deal with the so-called exhaustive guessing or off-line dictionary attack, as passwords are generally drawn from a small space enumerable, off-line, by an adversary. In 1992, Bellovin and Merritt [3] presented a family of protocols, known as Encrypted Key exchange (EKE), which was shown to be secure against off-line dictionary attack. Following EKE, a number of protocols for password-based authentication and key exchange have been proposed; a comprehensive list of such protocols can be found in Jablon’s research link [6]. Over the last decade, many researchers have investigated the feasibility of implementing EKE using different types of public-key cryptosystems such as RSA, ElGamal, and Diffie-Hellman key exchange. Nonetheless, most of the well-known and secure variants of EKE K. Srinathan, C. Pandu Rangan, M. Yung (Eds.): Indocrypt 2007, LNCS 4859, pp. 312–321, 2007. c Springer-Verlag Berlin Heidelberg 2007
Computationally-Efficient Password Authenticated Key Exchange
313
are based on Diffie-Hellman key exchange. It seems that EKE works well with Diffie-Hellman key exchange, but presents subtleties one way or the other when implemented with RSA and other public-key cryptographic systems. In their original paper [3], Bellovin and Merritt pointed out that the RSA-based EKE variant is subject to a special type of dictionary attack, called residue attack. In 1997, Lucks [7] proposed an RSA-based password-authenticated key exchange protocol (called OKE) which was claimed to be secure against residue attacks. Later, Mackenzie et al. [8] found that the OKE protocol is still subject to residue attacks. In [8], Mackenzie et al. proposed an RSA-based EKE variant (called SNAPI) an
Data Loading...
