Authenticated Key Exchange Protocol Secure against Offline Dictionary Attack and Server Compromise

In 2010, Lee et al proposed two simple and efficient three-party password-authenticated key exchange protocols that had been proven secure in the random oracle model. They argued that the two protocols could resist offline dictionary attacks. Indeed, the provable approach did not provide protection against off-line dictionary attacks. This paper shows that the two protocols are vulnerable to off-line dictionary attacks in the presence of an inside attacker because of an authentication flaw. This study conducts a detailed analysis on the flaw in the protocols and also shows how to eliminate the security flaw.

With the great development of network technology, the multiserver system gets widely used in providing various of services. And the two-factor authentication protocols in multiserver system attract more and more attention. Recently, there are two new schemes for multiserver environment which claimed to be secure against the known attacks. However, after a scrutinization of these two schemes, we found that (1) their description of the adversary’s abilities is inaccurate; (2) their schemes suffer from many attacks. Thus, firstly, we corrected their description on the adversary capacities to introduce a widely accepted adversary model and then summarized fourteen security requirements of multiserver based on the works of pioneer contributors. Secondly, we revealed that one of the two schemes fails to preserve forward secrecy and user anonymity and cannot resist stolen-verifier attack and off-line dictionary attack and so forth and also demonstrated that another scheme fails to preserve forward secrecy and user anonymity and is not secure to insider attack and off-line dictionary attack, and so forth. Finally, we designed an enhanced scheme to overcome these identified weaknesses, proved its security via BAN logic and heuristic analysis, and then compared it with other relevant schemes. The comparison results showed the superiority of our scheme.

We consider the problem of formal automatic verification of cryptographic protocols when some data, like poorly chosen passwords, can be guessed by dictionary attacks. First, we define a theory of these attacks and propose an inference system modeling the deduction capabilities of an intruder. This system extends a set of well-studied deduction rules for symmetric and public key encryption, often called Dolev---Yao rules, with the introduction of a probabilistic encryption operator and guessing abilities for the intruder. Then, we show that the intruder deduction problem in this extended model is decidable in PTIME. The proof is based on a locality lemma for our inference system. This first result yields to an NP decision procedure for the protocol insecurity problem in the presence of a passive intruder. In the active case, the same problem is proved to be NP-complete: we give a procedure for simultaneously solving symbolic constraints with variables that represent intruder deductions. We illustrate the procedure with examples of published protocols and compare our model to other recent formal definitions of dictionary attacks.

In recent years, attribute-based encryption (ABE) provides a new idea to help researchers solving the problem of data privacy protection in cloud. But there are two issues in traditional ABE, the first issue is that the attributes in the access structures will be sent to users in cleartext together with the ciphertext. So a attacker has the opportunity to obtain some of the private information from the plaintext access structure. And the other issue is the traditional ABE scheme cannot revoke the users' illegal keys in an efficient way. To handle both of the above challenges, we come up with a large universe ciphertext-policy ABE (CP-ABE) scheme which supports partially hidden access structures (PHAS) and highly efficient key revocation at the same time in this paper. What's more, unlike most previous schemes, first our access structure is based on the expressive linear secret sharing scheme (LSSS) which supports both AND and OR gates in access formulas and second our scheme is built from the prime-order bilinear pairing groups. The comparison with other relevant works presents that our scheme is more comprehensive and efficient. Finally we rigorously prove and analyze that our scheme is selectively indistinguishable secure under chosen plaintext attacks (IND-CPA) in the random oracle model (ROM) and our access structure is really anonymous against off-line dictionary attacks.

사용자 인증 스킴은 개방된 통신환경에서 원격지에 있는 사용자가 서버에 로긴할 때 정당한 사용자 인지를 확인하는 것이다. 2005년 Liao등은 스마트 카드를 이용해서 사용자의 익명성을 보장하는 사용자 인증 스킴을 제안하였다. 최근 Yoon등은 Liao가 제안한 사용자 인증 스킴의 안전성 분석을 수행한 후 그 스킴에 존재하는 결점을 보완하는 향상된 스킴을 제안하였다. 그러나 안타깝게도 그들이 제안한 스킴은 사용자가 서버를 인증하는 방식과 서버가 사용자를 인증 방식을 모두 수행할 수 없고 패스워드의 안전성에도 문제점이 존재한다. 이러한 문제점을 이 논문에서는 서버 가장 공격, 사용자 가장 공격, 오프라인 사전공격을 수행하여 지적하였다. 아울러 본 논문에서는 Yoon등이 제안한 논문의 취약점을 제거하여 보다 안전한 사용자 인증 스킴을 제안하였다. A remote user authentication scheme is a two-party protocol whereby an authentication server in a distributed system confirms the identity of a remote individual logging on to the server over an untrusted, open network. In 2005, Liao et al. proposed a remote user authentication scheme using a smart card, in which users can be authenticated anonymously. Recently, Yoon et al. have discovered some security flaws in Liao et al.'s authentication scheme and proposed an improved version of this scheme to fix the security flaws. In this article, we review the improved authentication scheme by Yoon et al. and provide a security analysis on the scheme. Our analysis shows that Yoon et al.'s scheme does not guarantee not only any kind of authentication, either server-to-user authentication or user-to-server authentication but also password security. The contribution of the current work is to demonstrate these by mounting two attacks, a server impersonation attack and a user impersonation attack, and an off-line dictionary attack on Yoon et al.'s scheme. In addition, we propose the enhanced authentication scheme that eliminates the security vulnerabilities of Yoon et al.'s scheme.

Recently, Li et al. proposed a novel smart card and dynamic ID-based remote user authentication scheme for multi-server environments. They claimed that their scheme can resist several types of attacks. However, through careful analysis, we find that Li et al.’s scheme is vulnerable to stolen smart card and off-line dictionary attacks, replay attacks, impersonation attacks and server spoofing attacks. By analyzing other similar schemes, we find that a certain type of dynamic ID-based multi-server authentication scheme in which only hash functions are used and whereby no registration center participates in the authentication and session key agreement phase faces difficulties in providing perfectly efficient and secure authentication. To compensate for these shortcomings, we propose a novel dynamic ID-based remote user authentication scheme for multi-server environments based on pairing and self-certified public keys. Security and performance analyses show that the proposed scheme is secure against various attacks and has many excellent features.

The main contribution of this paper is to analyze a secure passwordauthentication mechanism (SPAM), proposed by Chuang et al. in 2013(IEEE Syst J.). The SPAM was used for designing a secure handover inProxy Mobile IPv6 (PMIPv6) networks. Chuang et al. in the originalpaper claimed that SPAM provides high security properties and canresist various attacks. However, in this paper we point out thatSPAM is vulnerable to the critical attacks, such as stolen smartcard and off-line dictionary attack, replay attack and impersonationattack. In addition, we show that the identity of MNs and thesession key between MN and MAG can be disclosed by an insiderattacker; resultantly, anonymity and confidentiality between MNs andMAG will be completely broken in SPAM. As a remedy, we also propose an improved scheme which not only conquers the problems of the previous schemes but also provides a reduction in computational cost. Moreover, the proposed scheme provides the user anonymity and untraceability and secure session key agreement. Finally, the security of the improved protocol is proved in the random oracle model.DOI: http://dx.doi.org/10.5755/j01.itc.46.2.12118

Authentication is one of the fundamental mechanisms to enable a legitimate user to log into a remote server in an insecure environment. Many authentication protocols have been proposed in the literature for preventing unauthorized parties from access resources. Recently, Chen et al. proposed a password-based remote user authentication and key agreement scheme using common storage devices, such as USB sticks. They claimed that the scheme can withstand off-line dictionary attacks even if the authentication information stored in the device is obtained by the adversary. However, we observe that Chen et al.’s scheme is insecure against off-line dictionary attacks in this case. To remedy this security flaw, we propose an improved authentication protocol without using smart cards. Compared with the previous schemes, our scheme not only provides more security guarantees, but also is more efficient both in computation and communication cost.DOI: http://dx.doi.org/10.5755/j01.itc.42.2.2079

This chapter explains the elements of key exchange, specifically the steps in a key exchange protocol, the parties that are involved and the messages which may be sent. It details key exchange security models and protocols, considering first the simpler case of unauthenticated key exchange before turning to authenticated protocols. The chapter deals with key exchange protocols designed to be secure against a passive adversary. It examines that unauthenticated protocols may be used as building blocks for authenticated key exchange protocols. Key exchange protocols that allow parties to verify the identity of other participating parties are called authenticated key exchange protocols. Key exchange has a long history and a vast literature, yet remains a very active research area with significant practical impact. It is inevitable that as new computational assumptions emerge as the basis for cryptographic security, so will their use in key exchange be relevant.

Password-Authenticated Key Exchange allows users to generate a strong cryptographic key based on a shared human-memorable password without requiring a public-key infrastructure. It is one of the most widely used and fundamental cryptographic primitives. Unfortunately, mass password theft from organizations is continually in the news and, even if passwords are salted and hashed, brute force breaking of password hashing is usually very successful in practice. In this paper, we propose two efficient protocols where the password database is somehow shared among two servers or more, and authentication requires a distributed computation involving the client and the servers. In this scenario, even if a server compromise is doable, the secret exposure is not valuable to the adversary since it reveals only a share of the password database and does not permit to brute force guess a password without further interactions with the parties for each guess. Our protocols rely on smooth projective hash functions and are proven secure under classical assumption in the standard model i.e. do not require idealized assumption, such as random oracles.

This paper shows several security weaknesses of a Multi-Factor Authenticated Key Exchange (MK-AKE) protocol, proposed by Pointcheval and Zimmer at ACNS’08. The Pointcheval-Zimmer scheme was designed to combine three authentication factors in one system, including a password, a secure token (that stores a private key) and biometrics. In a formal model, Pointcheval and Zimmer formally proved that an attacker had to break all three factors to win. However, the formal model only considers the threat that an attacker may impersonate the client; it however does not discuss what will happen if the attacker impersonates the server. We fill the gap by analyzing the case of the server impersonation, which is a realistic threat in practice. We assume that an attacker has already compromised the password, and we then present two further attacks: in the first attack, an attacker is able to steal a fresh biometric sample from the victim without being noticed; in the second attack, he can discover the victim’s private key based on the Chinese Remainder theorem. Both attacks have been experimentally verified. In summary, an attacker actually only needs to compromise a single password factor in order to break the entire system. We also discuss the deficiencies in the Pointcheval-Zimmer formal model and countermeasures to our attacks.

Cryptographic Primitives that Resist Backdooring and Subversion

A three-party password-based authenticated key exchange (PAKE) protocol allows two clients registered with a trusted server to generate a common cryptographic key from their individual passwords shared only with the server. A key requirement for three-party PAKE protocols is to prevent an adversary from mounting a dictionary attack. This requirement must be met even when the adversary is a malicious (registered) client who can set up normal protocol sessions with other clients. This work revisits three existing three-party PAKE protocols, namely, Guo et al.’s (2008) protocol, Huang’s (2009) protocol, and Lee and Hwang’s (2010) protocol, and demonstrates that these protocols are not secure against offline and/or (undetectable) online dictionary attacks in the presence of a malicious client. The offline dictionary attack we present against Guo et al.’s protocol also applies to other similar protocols including Lee and Hwang’s protocol. We conclude with some suggestions on how to design a three-party PAKE protocol that is resistant against dictionary attacks.

Security issues play an important role in modern communication worlds. Via distrusted networks, exchanged messages need to be encrypted by a session key for security requirements. Session keys are preferred to be generated by communication parties, and how to authenticate the other communication party is an important problem needed to be solved. In three-party encrypted key exchange (3PEKE) protocols, a special type of indirect-authenticated protocols, a trusted third party is involved to have two communication parties be able to authenticate each other and negotiate one session key. In 2008, Yoon and Yoo proposed a three-party encrypted key exchange protocol and claimed their protocol provides a more secure way for exchanging messages. Unfortunately, we find that their protocol suffers from undetectable one-line password guessing attacks. In this manuscript, we first review the important related works and show how to mount attacks on Yoon and Yoo’s 3PEKE protocol

The rapid development of technology by using the internet as a medium to transfer many types of data has led to the appearance of new problems, such as intrusion, hacking and other problems and providing the security for the progress using these algorithms. The Diffie-hillman algorithm is one of the key exchange protocols that used for the security of information, but by the passing time, the change of security progress led to the occurrence of many problems due to the using Diffie-Hellman protocol in key exchange such as Man-in-the-Middle attack and Discrete logarithm attack. So, to solve these problems and to obtain better security, it needs to generate a random colour image(NxN) for each encryption, then uses an image generated to extract keys by applying the XOR function.