新的三方密钥交换协议  

A New Key Exchange Protocol for Three-parties

作　　者：柳秀梅[1] 周福才[2] 刘广伟[2] 常桂然[1] 

机构地区：[1]东北大学计算中心,辽宁沈阳110004 [2]东北大学信息科学与工程学院,辽宁沈阳110004

出　　处：《东北大学学报（自然科学版）》2009年第7期976-979,共4页Journal of Northeastern University(Natural Science)

基　　金：国家高技术研究发展计划项目(2001AA115300);辽宁省自然科学基金资助项目(2003101820062023);教育部高等学校博士学科点专项科研基金资助项目(20030145017)

摘　　要：针对基于口令认证机制的密钥交换协议容易遭受口令猜测和服务器假冒等多种攻击的缺点,提出了基于验证值认证机制的新的三方密钥交换协议.新协议中的验证值是基于口令的变换,并代替口令被保存在服务器端.服务器不仅以验证值来认证用户的身份,并且要通过验证值协助用户之间协商出会话密钥.而口令则作为私钥由用户自己保存.对新协议的安全进行分析,表明该协议可以抵御多种攻击,说明协议是安全的,同时对协议的效率评估还表明该协议具有较高的效率.To eliminate the disadvantages that the password-authentication key exchange protocols are vulnerable to password guessing attacks and server compromised impersonation attack, a new verifier-based key exchange protocol for three-parties is proposed. In the new protocol the verifier is based on the change of password instead of storing it in the server. In this way the verifier enables the server not only to authenticate user＇ s identity but assist the users to determine a common session key through negotiation. Then, a user can store the password as a private key. The security analysis of the new protocol reveals that it can resist many attacks safely, and the computational costs show that the protocol has higher efficiency.

关 键 词：口令认证 验证值 密钥交换 服务器假冒攻击 口令猜测攻击 

分 类 号：TP309.7[自动化与计算机技术—计算机系统结构]