IEICE TRANSACTIONS on Fundamentals
Provably Secure Gateway Threshold Password-Based Authenticated Key Exchange Secure against Undetectable On-Line Dictionary Attack
Summary :
By using Password-based Authenticated Key Exchange (PAKE), a server can authenticate a user who has only the same password shared with the server in advance and establish a session key with the user simultaneously. However, in the real applications, we may have a situation where a user needs to share a session key with server A, but the authentication needs to be done by a different server B that shares the password with the user. Further, to achieve higher security on the server side, it may be required to make PAKE tolerant of a server breach by having multiple authentication servers. To deal with such a situation, Abdalla et al. proposed a variant of PAKE called Gateway Threshold PAKE (GTPAKE) where a gateway corresponds to the aforementioned server A being an on-line service provider and also a potential adversary that may try to guess the passwords. However, the schemes of Abdalla et al. turned out to be vulnerable to Undetectable On-line Dictionary Attack (UDonDA). In this paper, we propose the first GTPAKE provably secure against UDonDA, and in the security analysis, we prove that our GTPAKE is secure even if an adversary breaks into parts of multiple authentication servers.
- Publication
- IEICE TRANSACTIONS on Fundamentals Vol.E100-A No.12 pp.2991-3006
- Publication Date
- 2017/12/01
- Publicized
- Online ISSN
- 1745-1337
- DOI
- 10.1587/transfun.E100.A.2991
- Type of Manuscript
- PAPER
- Category
- Cryptography and Information Security
Authors
Yukou KOBAYASHI
University of Tsukuba
Naoto YANAI
Osaka University
Kazuki YONEYAMA
Ibaraki University
Takashi NISHIDE
University of Tsukuba
Goichiro HANAOKA
National Institute of Advanced Industrial Science and Technology
Kwangjo KIM
Korea Advanced Institute of Science and Technology
Eiji OKAMOTO
University of Tsukuba
Keyword
Latest Issue
Copyrights notice of machine-translated contents
The copyright of the original papers published on this site belongs to IEICE. Unauthorized use of the original or translated papers is prohibited. See IEICE Provisions on Copyright for details.
Cite this
Copy
Yukou KOBAYASHI, Naoto YANAI, Kazuki YONEYAMA, Takashi NISHIDE, Goichiro HANAOKA, Kwangjo KIM, Eiji OKAMOTO, "Provably Secure Gateway Threshold Password-Based Authenticated Key Exchange Secure against Undetectable On-Line Dictionary Attack" in IEICE TRANSACTIONS on Fundamentals,
vol. E100-A, no. 12, pp. 2991-3006, December 2017, doi: 10.1587/transfun.E100.A.2991.
Abstract: By using Password-based Authenticated Key Exchange (PAKE), a server can authenticate a user who has only the same password shared with the server in advance and establish a session key with the user simultaneously. However, in the real applications, we may have a situation where a user needs to share a session key with server A, but the authentication needs to be done by a different server B that shares the password with the user. Further, to achieve higher security on the server side, it may be required to make PAKE tolerant of a server breach by having multiple authentication servers. To deal with such a situation, Abdalla et al. proposed a variant of PAKE called Gateway Threshold PAKE (GTPAKE) where a gateway corresponds to the aforementioned server A being an on-line service provider and also a potential adversary that may try to guess the passwords. However, the schemes of Abdalla et al. turned out to be vulnerable to Undetectable On-line Dictionary Attack (UDonDA). In this paper, we propose the first GTPAKE provably secure against UDonDA, and in the security analysis, we prove that our GTPAKE is secure even if an adversary breaks into parts of multiple authentication servers.
URL: https://global.ieice.org/en_transactions/fundamentals/10.1587/transfun.E100.A.2991/_p
Copy
@ARTICLE{e100-a_12_2991,
author={Yukou KOBAYASHI, Naoto YANAI, Kazuki YONEYAMA, Takashi NISHIDE, Goichiro HANAOKA, Kwangjo KIM, Eiji OKAMOTO, },
journal={IEICE TRANSACTIONS on Fundamentals},
title={Provably Secure Gateway Threshold Password-Based Authenticated Key Exchange Secure against Undetectable On-Line Dictionary Attack},
year={2017},
volume={E100-A},
number={12},
pages={2991-3006},
abstract={By using Password-based Authenticated Key Exchange (PAKE), a server can authenticate a user who has only the same password shared with the server in advance and establish a session key with the user simultaneously. However, in the real applications, we may have a situation where a user needs to share a session key with server A, but the authentication needs to be done by a different server B that shares the password with the user. Further, to achieve higher security on the server side, it may be required to make PAKE tolerant of a server breach by having multiple authentication servers. To deal with such a situation, Abdalla et al. proposed a variant of PAKE called Gateway Threshold PAKE (GTPAKE) where a gateway corresponds to the aforementioned server A being an on-line service provider and also a potential adversary that may try to guess the passwords. However, the schemes of Abdalla et al. turned out to be vulnerable to Undetectable On-line Dictionary Attack (UDonDA). In this paper, we propose the first GTPAKE provably secure against UDonDA, and in the security analysis, we prove that our GTPAKE is secure even if an adversary breaks into parts of multiple authentication servers.},
keywords={},
doi={10.1587/transfun.E100.A.2991},
ISSN={1745-1337},
month={December},}
Copy
TY - JOUR
TI - Provably Secure Gateway Threshold Password-Based Authenticated Key Exchange Secure against Undetectable On-Line Dictionary Attack
T2 - IEICE TRANSACTIONS on Fundamentals
SP - 2991
EP - 3006
AU - Yukou KOBAYASHI
AU - Naoto YANAI
AU - Kazuki YONEYAMA
AU - Takashi NISHIDE
AU - Goichiro HANAOKA
AU - Kwangjo KIM
AU - Eiji OKAMOTO
PY - 2017
DO - 10.1587/transfun.E100.A.2991
JO - IEICE TRANSACTIONS on Fundamentals
SN - 1745-1337
VL - E100-A
IS - 12
JA - IEICE TRANSACTIONS on Fundamentals
Y1 - December 2017
AB - By using Password-based Authenticated Key Exchange (PAKE), a server can authenticate a user who has only the same password shared with the server in advance and establish a session key with the user simultaneously. However, in the real applications, we may have a situation where a user needs to share a session key with server A, but the authentication needs to be done by a different server B that shares the password with the user. Further, to achieve higher security on the server side, it may be required to make PAKE tolerant of a server breach by having multiple authentication servers. To deal with such a situation, Abdalla et al. proposed a variant of PAKE called Gateway Threshold PAKE (GTPAKE) where a gateway corresponds to the aforementioned server A being an on-line service provider and also a potential adversary that may try to guess the passwords. However, the schemes of Abdalla et al. turned out to be vulnerable to Undetectable On-line Dictionary Attack (UDonDA). In this paper, we propose the first GTPAKE provably secure against UDonDA, and in the security analysis, we prove that our GTPAKE is secure even if an adversary breaks into parts of multiple authentication servers.
ER -
English
