Improved key exchange protocol for three-party based on verifier authentication  

一种改进的基于验证值的三方密钥交换协议(英文)

作　　者：柳秀梅[1] 周福才[2] 常桂然[1] 

机构地区：[1]东北大学计算中心,沈阳110004 [2]东北大学信息科学与工程学院,沈阳110004

出　　处：《Journal of Southeast University(English Edition)》2008年第3期322-324,共3页东南大学学报（英文版）

基　　金：The National High Technology Research and Development Program of China(863Program)(No.2001AA115300);the Natural Science Foundation of Liaoning Province(No.20031018,20062023)

摘　　要：To prevent server compromise attack and password guessing attacks,an improved and efficient verifier-based key exchange protocol for three-party is proposed,which enables two clients to agree on a common session key with the help of the server.In this protocol,the client stores a plaintext version of the password,while the server stores a verifier for the password.And the protocol uses verifiers to authenticate between clients and the server.The security analysis and performance comparison of the proposed protocol shows that the protocol can resist many familiar attacks including password guessing attacks,server compromise attacks,man-in-the-middle attacks and Denning-Sacco attacks,and it is more efficient.为防止服务器泄露攻击和口令猜测攻击,提出了一种基于验证值的三方密钥交换协议.该协议用于实现2个客户通过与第三方服务器间的交互协商出会话密钥的过程.协议中客户只需要记住自己的口令,而服务器端则存储与口令对应的验证值,客户与服务器之间的身份认证通过验证值来完成.对协议的安全分析结果表明,该协议能抵御很多已知的攻击,包括服务器泄漏攻击、口令猜测攻击、中间人攻击以及Denning-Sacco攻击等.对协议的效率评估表明该协议是高效的.

关 键 词：key exchange for three-party password-based authentication VERIFIER 

分 类 号：TN911.22[电子电信—通信与信息系统]