改进的三方口令验证元认证密钥交换协议  

Improved Verifier-based Three-party Password-authenticated Key Exchange Protocol

作　　者：张启慧 胡学先 刘文芬 魏江宏 ZHANG Qi-Hui;HU Xue-Xian;LIU Wen-Fen;WEI Jiang-Hong(PLA Strategic Support Force Information Engineering University,Zhengzhou 450001,China;School of Computer Science and Information Security,Guilin University of Electronic Technology,Guilin 541004,China)

机构地区：[1]中国人民解放军战略支援部队信息工程大学,河南郑州450001 [2]桂林电子科技大学计算机与信息安全学院,广西桂林541004

出　　处：《软件学报》2020年第10期3238-3250,共13页Journal of Software

基　　金：国家自然科学基金(61502527,61702549,61862011);广西密码学与信息安全重点实验室研究课题(GCIS201704)。

摘　　要：在三方口令认证密钥交换(三方PAKE)协议中,每个用户仅仅需要和服务器共享一个口令,就可以在服务器的协助下与他人进行安全的密钥交换.由于有效地减少了用户管理口令的负担,三方PAKE协议在大规模用户集的安全通信中受到了较多关注.然而,已有的三方PAKE协议大多关注的是服务器利用明文存储用户口令的情形,没有考虑服务器口令文件泄露所造成的巨大威胁.在服务器端存放的是相应于用户口令的验证元的情形下,研究三方PAKE协议的分析和设计.首先分析了一个最近提出的基于验证元的三方PAKE协议,指出该协议易于遭受离线字典攻击,因此未能达到所宣称的安全性;其次,在分析已有协议设计缺陷的基础上,提出了一个新的基于验证元的三方PAKE协议,并在标准模型下证明了所设计的协议的安全性,与已有协议的比较表明,新提出的协议在提供了更高安全性的同时具有可接受的计算和通信效率.With the aid of three-party password-authenticated key exchange(3PAKE)protocol,two users,each of which shares a low-entropy password with the trusted server,could agree on a common session key securely.Since 3PAKE protocols reduce the burden of password management dramatically when the total number of users is very large,they have attracted much attention recently.However,most of the existing 3PAKE protocols are designed in the scenario where a user stores her/his plain password in the password file of the server,henceforth no protection would be provided once the password file is leaked.This study investigates the analysis and design of verifier-based 3PAKE protocols,where the server holds a verifier of a password other than the plain password.Firstly,it is shown that a recently proposed verifier-based 3PAKE protocol is not secure,which is vulnerable to off-line dictionary attack.Then,aiming to overcome the existed deficits,a new verifier-based 3APKE protocol is proposed and its security is proved in the standard model.Comparisons show that the proposed new scheme takes the advantage of security as well as enjoys practical efficiency.

关 键 词：密钥交换协议 口令认证 验证元 离线字典攻击 标准模型 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]