Recently, Zhu et al. proposed an password-based authenticated key exchange protocol based on RSA such that it is efficient enough to be implemented on most of the target low-power devices such as smart cards and low-power Personal Digital Assistants in wireless networks. They claimed that the proposed scheme is secure against dictionary attacks. In this paper, we show that the scheme proposed by Zhu et al. is insecure against undetectable on-line password guessing attacks. Furthermore, we examine Zhu et al.'s protocol and find that Zhu et al.'s protocol does not achieve explicit key authentication. An improved version is then proposed to defeat the undetectable on-line password guessing attacks and also provide explicit key authentication.
The copyright of the original papers published on this site belongs to IEICE. Unauthorized use of the original or translated papers is prohibited. See IEICE Provisions on Copyright for details.
Copy
Her-Tyan YEH, Hung-Min SUN, Cheng-Ta YANG, Bing-Cheng CHEN, Shin-Mu TSENG, "Improvement of Password Authenticated Key Exchange Based on RSA for Imbalanced Wireless Networks" in IEICE TRANSACTIONS on Communications,
vol. E86-B, no. 11, pp. 3278-3282, November 2003, doi: .
Abstract: Recently, Zhu et al. proposed an password-based authenticated key exchange protocol based on RSA such that it is efficient enough to be implemented on most of the target low-power devices such as smart cards and low-power Personal Digital Assistants in wireless networks. They claimed that the proposed scheme is secure against dictionary attacks. In this paper, we show that the scheme proposed by Zhu et al. is insecure against undetectable on-line password guessing attacks. Furthermore, we examine Zhu et al.'s protocol and find that Zhu et al.'s protocol does not achieve explicit key authentication. An improved version is then proposed to defeat the undetectable on-line password guessing attacks and also provide explicit key authentication.
URL: https://global.ieice.org/en_transactions/communications/10.1587/e86-b_11_3278/_p
Copy
@ARTICLE{e86-b_11_3278,
author={Her-Tyan YEH, Hung-Min SUN, Cheng-Ta YANG, Bing-Cheng CHEN, Shin-Mu TSENG, },
journal={IEICE TRANSACTIONS on Communications},
title={Improvement of Password Authenticated Key Exchange Based on RSA for Imbalanced Wireless Networks},
year={2003},
volume={E86-B},
number={11},
pages={3278-3282},
abstract={Recently, Zhu et al. proposed an password-based authenticated key exchange protocol based on RSA such that it is efficient enough to be implemented on most of the target low-power devices such as smart cards and low-power Personal Digital Assistants in wireless networks. They claimed that the proposed scheme is secure against dictionary attacks. In this paper, we show that the scheme proposed by Zhu et al. is insecure against undetectable on-line password guessing attacks. Furthermore, we examine Zhu et al.'s protocol and find that Zhu et al.'s protocol does not achieve explicit key authentication. An improved version is then proposed to defeat the undetectable on-line password guessing attacks and also provide explicit key authentication.},
keywords={},
doi={},
ISSN={},
month={November},}
Copy
TY - JOUR
TI - Improvement of Password Authenticated Key Exchange Based on RSA for Imbalanced Wireless Networks
T2 - IEICE TRANSACTIONS on Communications
SP - 3278
EP - 3282
AU - Her-Tyan YEH
AU - Hung-Min SUN
AU - Cheng-Ta YANG
AU - Bing-Cheng CHEN
AU - Shin-Mu TSENG
PY - 2003
DO -
JO - IEICE TRANSACTIONS on Communications
SN -
VL - E86-B
IS - 11
JA - IEICE TRANSACTIONS on Communications
Y1 - November 2003
AB - Recently, Zhu et al. proposed an password-based authenticated key exchange protocol based on RSA such that it is efficient enough to be implemented on most of the target low-power devices such as smart cards and low-power Personal Digital Assistants in wireless networks. They claimed that the proposed scheme is secure against dictionary attacks. In this paper, we show that the scheme proposed by Zhu et al. is insecure against undetectable on-line password guessing attacks. Furthermore, we examine Zhu et al.'s protocol and find that Zhu et al.'s protocol does not achieve explicit key authentication. An improved version is then proposed to defeat the undetectable on-line password guessing attacks and also provide explicit key authentication.
ER -