一种改进的跨域口令密钥交换协议  

An Improved Cross-Realm Client-to-Client Password-Authenticated Key Exchange Protocol

作　　者：刘广伟[1] 周恩光[1] 闫虹[1] 周福才[1] 

机构地区：[1]东北大学信息科学与工程学院,辽宁沈阳110004

出　　处：《东北大学学报（自然科学版）》2009年第1期42-45,共4页Journal of Northeastern University(Natural Science)

基　　金：国家自然科学基金资助项目(60773218);国家高技术研究发展计划项目(2001AA115300);辽宁省自然科学基金资助项目(20062023)

摘　　要：跨域的端到端的口令认证密钥交换(C2C-PAKE)协议,可实现不同区域的两个客户通过不同的口令协商出共享的会话密钥.首先对Byun2007的C2C-PAKE协议进行了描述,并针对其安全性进行了分析,发现该协议易遭受口令泄露伪造攻击的安全漏洞,提出了一种高效的改进的跨域口令认证密钥交换协议.该协议引入公钥密码体制能够有效抵抗口令泄露伪造攻击和不可检测在线字典攻击,且只需要6步通信.安全性分析表明该协议是安全有效的.The client-to-client password-authenticated key exchange （C2C-PAKE） protocol enables two clients from different realms to agree on a shared common session key. Describing the C2C-PAKE protocol of Byun2007, its security is analyzed and it is found that the protocol is easy to suffer the attacks due to password-compromised impersonation and undetected on-line dictionary. An improved C2C-PAKE protocol is therefore proposed to introduce the public key mechanism into system security to resist those attacks effectively, especially only six operational steps are needed in relevant communication. As shown in security analysis , the protocol proposed is available to meet the security requirements.

关 键 词：安全协议 跨域 口令认证密钥交换 口令泄露伪造攻击 敌手 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]