Off-Line Dictionary Attack on Password-Based Authenticated Key Exchange Protocols  

作　　者：XU Chungen YANG Yanjiong 

机构地区：[1]Department of Applied Mathematics,Nanjing University of Science and Technology,Nanjing 210094,Jiangsu,China [2]Zijin College,Nanjing University of Science and Technology,Nanjing 210046,Jiangsu,China

出　　处：《Wuhan University Journal of Natural Sciences》2012年第6期468-472,共5页武汉大学学报（自然科学英文版）

基　　金：Supported by the Natural Science Foundation of Jiangsu Province (Key Program) (BK2011023)

摘　　要：In 2010,Lee et al proposed two simple and efficient three-party password-authenticated key exchange protocols that had been proven secure in the random oracle model.They argued that the two protocols could resist offline dictionary attacks.Indeed,the provable approach did not provide protection against off-line dictionary attacks.This paper shows that the two protocols are vulnerable to off-line dictionary attacks in the presence of an inside attacker because of an authentication flaw.This study conducts a detailed analysis on the flaw in the protocols and also shows how to eliminate the security flaw.In 2010,Lee et al proposed two simple and efficient three-party password-authenticated key exchange protocols that had been proven secure in the random oracle model.They argued that the two protocols could resist offline dictionary attacks.Indeed,the provable approach did not provide protection against off-line dictionary attacks.This paper shows that the two protocols are vulnerable to off-line dictionary attacks in the presence of an inside attacker because of an authentication flaw.This study conducts a detailed analysis on the flaw in the protocols and also shows how to eliminate the security flaw.

关 键 词：key exchange PASSWORD OFF-LINE dictionary attack provable security 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]