IEICE TRANSACTIONS on Communications
Attacks and Solutions on Strong-Password Authentication
Summary :
A password-based mechanism is the most widely used method of authentication in distributed environments. However, because people are used to choosing easy-to-remember passwords, so-called "weak-passwords," dictionary attacks on them can succeed. The techniques used to prevent dictionary attacks lead to a heavy computational load. Indeed, forcing people to use well-chosen passwords, so-called "strong passwords," with the assistance of tamper-resistant hardware devices can be regarded as another fine authentication solution. In this paper, we examine a recent solution, the SAS protocol, and demonstrate that it is vulnerable to replay and denial of service attacks. We also propose an Optimal Strong-Password Authentication (OSPA) protocol that is secure against stolen-verifier, replay, and denial of service attacks, and minimizes computation, storage, and transmission overheads.
- Publication
- IEICE TRANSACTIONS on Communications Vol.E84-B No.9 pp.2622-2627
- Publication Date
- 2001/09/01
- Publicized
- Online ISSN
- DOI
- Type of Manuscript
- PAPER
- Category
- Fundamental Theories
Authors
Keyword
Latest Issue
Copyrights notice of machine-translated contents
The copyright of the original papers published on this site belongs to IEICE. Unauthorized use of the original or translated papers is prohibited. See IEICE Provisions on Copyright for details.
Cite this
Copy
Chun-Li LIN, Hung-Min SUN, Tzonelih HWANG, "Attacks and Solutions on Strong-Password Authentication" in IEICE TRANSACTIONS on Communications,
vol. E84-B, no. 9, pp. 2622-2627, September 2001, doi: .
Abstract: A password-based mechanism is the most widely used method of authentication in distributed environments. However, because people are used to choosing easy-to-remember passwords, so-called "weak-passwords," dictionary attacks on them can succeed. The techniques used to prevent dictionary attacks lead to a heavy computational load. Indeed, forcing people to use well-chosen passwords, so-called "strong passwords," with the assistance of tamper-resistant hardware devices can be regarded as another fine authentication solution. In this paper, we examine a recent solution, the SAS protocol, and demonstrate that it is vulnerable to replay and denial of service attacks. We also propose an Optimal Strong-Password Authentication (OSPA) protocol that is secure against stolen-verifier, replay, and denial of service attacks, and minimizes computation, storage, and transmission overheads.
URL: https://global.ieice.org/en_transactions/communications/10.1587/e84-b_9_2622/_p
Copy
@ARTICLE{e84-b_9_2622,
author={Chun-Li LIN, Hung-Min SUN, Tzonelih HWANG, },
journal={IEICE TRANSACTIONS on Communications},
title={Attacks and Solutions on Strong-Password Authentication},
year={2001},
volume={E84-B},
number={9},
pages={2622-2627},
abstract={A password-based mechanism is the most widely used method of authentication in distributed environments. However, because people are used to choosing easy-to-remember passwords, so-called "weak-passwords," dictionary attacks on them can succeed. The techniques used to prevent dictionary attacks lead to a heavy computational load. Indeed, forcing people to use well-chosen passwords, so-called "strong passwords," with the assistance of tamper-resistant hardware devices can be regarded as another fine authentication solution. In this paper, we examine a recent solution, the SAS protocol, and demonstrate that it is vulnerable to replay and denial of service attacks. We also propose an Optimal Strong-Password Authentication (OSPA) protocol that is secure against stolen-verifier, replay, and denial of service attacks, and minimizes computation, storage, and transmission overheads.},
keywords={},
doi={},
ISSN={},
month={September},}
Copy
TY - JOUR
TI - Attacks and Solutions on Strong-Password Authentication
T2 - IEICE TRANSACTIONS on Communications
SP - 2622
EP - 2627
AU - Chun-Li LIN
AU - Hung-Min SUN
AU - Tzonelih HWANG
PY - 2001
DO -
JO - IEICE TRANSACTIONS on Communications
SN -
VL - E84-B
IS - 9
JA - IEICE TRANSACTIONS on Communications
Y1 - September 2001
AB - A password-based mechanism is the most widely used method of authentication in distributed environments. However, because people are used to choosing easy-to-remember passwords, so-called "weak-passwords," dictionary attacks on them can succeed. The techniques used to prevent dictionary attacks lead to a heavy computational load. Indeed, forcing people to use well-chosen passwords, so-called "strong passwords," with the assistance of tamper-resistant hardware devices can be regarded as another fine authentication solution. In this paper, we examine a recent solution, the SAS protocol, and demonstrate that it is vulnerable to replay and denial of service attacks. We also propose an Optimal Strong-Password Authentication (OSPA) protocol that is secure against stolen-verifier, replay, and denial of service attacks, and minimizes computation, storage, and transmission overheads.
ER -
English
