Here, we give the following notations whichthrough this chapter.
κ Let κ be the cryptographic security parameter.
G LetG denote a finite cyclic group of order q, where
|q| = κ. Let g be a generator of G and assume it is included in the description ofG.
C, S The communication parties between a client C and a sever S.
idC C’s identity, which should to be unique to index the verified table stored in the server’s database.
idS S’s identity, which should to be unique to index the server.
pw C’s password secretly shared with S.
The exclusive operator.
A→ B :< m > The message m sent from A to B.
SK The session keySK.
G(·), H(·) Two secure one-way hash functions.
In the following, we show some password authenticated key exchange pro-tocols are insecure, which only give attack-response analyses.
The Tseng Scheme
We review the Tseng scheme [81] as follows. The scheme has a predeter-mined way to generate the two integers Q ∈ Zq and Q−1 ∈ Zq from the password pw and secretly shared between C and S. It is similar to employ a hash function G with an input pw and maps to Zq, i.e. Q = G(pw). The protocol is composed of two phases, the key establishment phase and the
key verification phase, as follows:
key Establishment Phase
Step 1. C → S: < idC, X1 >
C chooses an integer a∈R Zq and computes X1 = gaQ. Then, C sends idC and X1to S.
Step 2. S → C: < idS, Y1 >
After receiving C’s message, S chooses an integer b∈RZq to compute Y1 = gbQ. Then, S sends idS and Y1to C.
Step 3. After receiving S’s message, C computes Y = Y1Q−1 = gb and SKC = Ya = gab.
Step 4. After receiving C’s message, S computes X = X1Q−1 = gaand SKS = Xb = gab.
key Verification Phase
Step 5. C → S: < idC, Y >
C sends idC and X1to S.
Step 6. S → C: < idS, X >
S sends idS and X to C.
Step 7. C and S check whether X = ga and Y = gb hold or not, respectively.
If they hold, C and S are sure that they have the common session key SK = gab.
Ku and Wang [49] have shown that the Tseng scheme is vulnerable to the backward replay attack and forged authenticator attack. They proposed an improved version of the Seo-Sweeny scheme [70]. However, we will present another forged authenticator attack on the Tseng scheme, and it will still successfully break the Ku-Wang scheme as well as the others [53, 70].
On the other hand, we will show that the Tseng scheme and the Ku-Wang scheme are also weak in front of the off-line dictionary attack.
FORGED AUTHENTICATOR ATTACK. An adversary A tries to fool C and S into believing a wrong session key in the Tseng scheme. A first prepares a value e ∈ Zq and its inversion e−1 ∈ Zq. In the key establishment phase, upon seeing X1 sent by C in Step 1, A replaces it with X1 = (X1)e = gaQe. Then, C performs Step 3 and S performs Steps 2 and 4. C and S will sepa-rately obtain the session keysSKC = Ya = gab andSKS = Xb = gabe, where Y = (Y1)Q−1 = gb and X = (X1)Q−1 = gae. Next, they separately verify the validity of the session keys SKC andSKS. After receiving Y in Step 5, the check equation Y = gb will hold in Step 7 on S’s side, so S will believe that it and C have agreed on a common session key. Upon seeing X is sent by S in Step 6, A replaces it with X = (X)e−1 = ga. The check equation X = gamod p will hold in Step 7 on C’s side, and C will too believe that it and S have agreed on a common session key. However,SKC = gab is not equal toSKS = gabe.
OFF-LINE DICTIONARY ATTACK. A tries to reveal the secret values Q and Q−1 shared between C and S by mounting the off-line dictionary attack. A first intercepts X1 = gaQsent by C in Step 1 and masquerades as S to send Y1 = gein Step 2. C computes Y = Y1Q−1 = geQ−1 andSKC = Ya= geQ−1a. In
Step 5, C sends Y to S. After intercepting Y ,A can verify the correctness of the guessing password by checking whether YQ = ge holds or not because YQ = Y1Q−1Q= ge.
The Ku-Wang Scheme
We have presented another forged authenticator attack in the Tseng scheme, which also threatens the security of the Ku-Wang scheme. Furthermore, the off-line dictionary attack is still successful in their scheme. The key estab-lishment phase in the Ku-Wang scheme is the same as that in the Tseng scheme. We only briefly review the key verification phase of the Ku-Wang scheme that makes a difference.
key Verification Phase
Step 5. C → S: < idC, KC >
C computes KC = (SKC)Q= gabQ. Then, C sends idC and KC to S.
Step 6. S → C: < idS, X >
When KC is received, S checks whether KS = (SKS)Q−1. If it holds, S believes that it has obtained the correct X1 and C has obtained the correct Y1. Then, S sends idSand X to C.
Step 7. When X is received, C checks whether X = ga. If it holds, C believes that it has obtained the correct Y1 and S has obtained the correct X1.
FORGED AUTHENTICATORATTACK. A performs the same work in the key establishment phase, described in the above. In the key verification phase, upon seeing KC is sent by C in Step 5, A replaces it with KC = (KC)e =
believe that it has obtained the correct X1and C has obtained the correct Y1. Then, S sends X = gaeto C. A replaces it with X = (X)e−1 = ga. The check equation X1 = gamod p in Step 7 will hold, which will make C believe that it has obtained the correct Y1 and S has obtained the correct X1. However, SKC = gabis not equal toSKS = gabe.
As a matter of fact, the forged authenticator attack can easily be mounted to break the existing password-related methods [53, 70]. Because all the schemes have the common weakness, any adversary can use some value to replace the original value sent by C in the key establishment phase and then use its inversion to make S return to the original value sent to C in the key verification phase. This will make C and S believe the wrong session key.
OFF-LINE DICTIONARY ATTACK. For the same reason, in the Ku-Wang scheme,A performs the same work in the key establishment phase. In the key verification phase, C computes KC = (SKC)Q= gaeand sends it to S in Step 5. After intercepting KC, A can verify the correctness of the guessing password by checking whether KC = (X1)Q−1 holds or not because KC = (X1)Q−1 = gae.
In both schemes, if the password pw is poorly chosen, the adversary can de-termine Q or Q−1 by using the equations to verify if the guessing password is correct. On the other hand, in the Ku-Wang scheme, when a password is compromised, the old session key SKC can be recovered by computing (KC)Q−1 = SKC = gab. Therefore, their scheme cannot provide perfect for-ward secrecy.
We have presented the forged authenticator attack and the off-line
dictio-nary attack to subvert the security of the Tseng scheme and the Ku-Wang scheme. As we have proved, the Ku-Wang scheme is weak against the forged authenticator attack and the off-line dictionary attack; moreover, the forged authenticator attack can be used to break all the existing PAKE-related schemes.
The Tseng-Jan-Chien Scheme
We shall first briefly review the Tseng-Jan-Chien protected password change protocol [82] and then show how the forged authenticator attack can work on their scheme. In the system, the server stores a client C’s idC and pw as v idpw = H(idC, pw) in the database.
The protected password changing scheme works as follows:
Step 1. C → S: < idC, C idpw >
C chooses a random number c ∈R Zq and computes rc = gc mod p.
Then, it computes C idpw = H(idC, pw) ⊕ rc and sends it along with idC to S.
Step 2. S → C: < idS, S idpw, S auth token >
Sfirst recovers rc from C idpw by computing C idpw digest⊕ v idpw.
Then, S chooses a random number s ∈R Zq and computes rs = gs and rcs = (rc)s = gcs. Next, S computes S idpw = v idpw ⊕ rs and S auth token = H(v idpw, rcs, rc), and then it sends them and idS to C.
Step 3. C → S: < idC, C auth token, C new idpw >
C first recovers rs from S idpw by computing S idpw ⊕ H(idC, pw).
Then it computes rcs = (rs)c = gsc and uses it together with its own H(idC, pw) and rc to compute H(H(idC, pw), rcs, rc), which is then compared with the received S auth token from S. If they match, C computes C auth token = H(H(idC, pw), rcs, rs). Then, C chooses a new password new pw and computes
C new idpw= H(idC, new pw) ⊕ H(H(idC, pw), rcs).
Finally, C sends < idC, C auth token, C new idpw >to S.
Step 4. S uses its own v idpw, rcs and rs to compute H(v idpw, rcs, rs) and compares it with the received C auth token. If they match, S recovers H(idC, new pw) from C new idpw by computing
H(idC, new pw) = C new idpw ⊕ H(v idpw, rcs)
and then stores v idpw = H(idC, new pw) in the database.
The difference between the protected password transmission scheme and protected password changing scheme is that C additionally sends C new idpw to S for changing passwords in the latter scheme. In the following, we point out Tseng-Jan-Chien protected password changing scheme is vulnerable to the forged authenticator attack; that is, any adversary can intercept the re-quest for changing passwords sent by a legal client and modify it with a wrong password.
FORGED AUTHENTICATORATTACK. Note that C sends < idC, C auth token , C new idpw >in Step 3 to S, and the messages C auth token and C new idpw are used to enable the server to authenticate the client and to obtainH(idC
, new pw), respectively. However, because the two messages are separated,
the adversary can replace C new idpw with a random number ra. After re-ceiving < idC, C auth token, ra >, S checks the validity of C auth token.
Since C auth token is generated by the legal client, S will accept it. Then, S computes ra⊕ H(v idpw, rcs) and stores v idpw=ra ⊕ H(v idpw, rcs) in the database.
Unfortunately, the client is mistakenly convinced that it has successfully changed from the old password pw to a new password new pw. When the client tries to login the server the next time, the server will reject the client’s login request because the client cannot recover rs from S idpw by comput-ing S idpw⊕ H(idC, new pw) and therefore cannot compute C auth token correctly. As a result, the server will conclude that the client is illegal, and the client will not be able to change its password successfully.
The Hwang-Yeh Scheme
The different from the Tseng scheme and the Ku-Wang scheme is that the Hwang-Yeh scheme [43] employs the public key cryptosystem. However, there are still some security flaws in the Hwang-Yeh password change scheme.
Any adversary can intercept the request for changing passwords sent by a legal user and modify it with a wrong password. As a result, the user will not be able to successfully login the server next time.
The main difference between Hwang-Yeh password transmission scheme and password change scheme is that in the latter the client sends a password change request to the server. In the system, the server stores v pw = H(pw) instead of pw for each client in the database. Here, we only present the password transmission scheme.
Step 1. C → S: < idC, C cipher >
Cencrypts the random number rc and along with pw with the server’s public key P KS denoted as C cipher = EP KS(rc, pw) and send it with idC as a login request to S.
Step 2. S → C: < idS, S auth token, S rs >
Sdecrypts C cipher to obtain rc and pw by using its private key. Then, it computes the hash valueH(pw) and checks whether H(pw) = v pw holds or not. If it holds, S chooses a random number rs and com-putes S auth token = rs ⊕ rc and S rs = H(rs). Then, S sends
< idS, S auth token, S rs >to C.
Step 3. C → S: < idC, C auth token, C new pw >
C retrieves rs by computing S auth token ⊕ rc and then verifies the consistency between the retrieved rs and the received S rs. If the result is positive, C chooses a new password new pw and computes C auth token= H(rc, rs) and C new pw = H(new pw) ⊕ H(rc + 1, rs).
Finally, C sends < idC, C auth token, C new pw >to S.
Step 4. S → C: access granted or access denied
S computes the hash value H(rc, rs) and checks whether H(rc, rs) = C auth token holds or not. If it holds, S can obtain H(new pw) by computing C new pw⊕H(rc+1, rs) and then store v pw = H(new pw) in the database.
Obviously, by employing the public key cryptosystem on the server’s side to protect the transmitted password, Hwang and Yeh have effectively avoided the guessing attack and server spoofing that treated the Peyravian-Zunic schemes. However, we show that the Hwang-Yeh scheme is also vulnerable
to the forged authenticator attack as follows.
FORGED AUTHENTICATOR ATTACK. Upon seeing < idC, C auth token, C new pw >sent by C in Step 3, the adversaryA replaces C new pw with a random number ra. After receiving < idC, C auth token, rc >, S first com-putes the hash valueH(rc, rs) and checks whether H(rc, rs) = C auth token holds or not. Since C auth token is computed by C, the equationH(rc, rs) = C auth token checked by the server will turn out positive. Then, S com-putes ra⊕ H(rc + 1, rs) and stores v pw = ra ⊕ H(rc + 1, rs) in place of H(pw) in the database.
However, C is under the impression that it has successfully changed from an old password pw to a new password new pw. Once the client logins to S the next time, it sends < idC, C cipher = EP KS(rc, new pw) > to S in Step 1. In Step 2, S decrypts the message to obtain rc and new pw with its private key. Then, S computes the hash value H(new pw) and check whetherH(new pw) = v pw holds or not. However, H(new pw) is not equal to v pw because v pw = ra ⊕ H(rc + 1, rs). The server will reject the client’s login request.
Chapter 6
Simple Password Authenticated Key Exchange and Protected
Password Change Protocols
6.1 Password Authenticated Key Exchange Proto-col
In this chapter, we shall present a simple password authenticated key ex-change (PAKE) protocol by modifying the Yeh-Sun scheme [85]. This scheme is proven secure when the symmetric-encryption primitive is instantiated via a mask generation function that is the product of the message with a hash of the password. At the same time, we shall also present a new protected password change (PPC) protocol which unlike the previously proposed schemes [47, 49, 53, 70, 81, 85] where the parties cannot arbi-trarily change their own passwords, offers users the freedom of changing passwords at will. The proposed PAKEprotocol is formally proven using the Ballare-Poincheval-Rogaway security model. The provable security is
demonstrated by reduction. Here, we give the following notations which through this chapter.
G LetG denote a finite cyclic group of order q, where
|q| = κ. Let g be a generator of G and assume it is included in the description ofG.
C, S The communication parties between a client C and a sever S.
idC C’s identity, which should to be unique to index the verified table stored in the server’s database.
idS S’s identity, which should to be unique to index the server.
pw C’s password secretly shared with S.
A→ B :< m > The message m sent from A to B.
SK The session keySK.
G A full-domain hash from{0, 1}∗intoG.
Hi Two hash functions from{0, 1}∗to{0, 1}κ, for i = 0, 1.
The parties initially share a low-quality password pw. The password au-thenticated key exchange protocol then runs as in Figure 6.1 and described as follows.
Step 1. C → S: < idC, RC∗ >
C chooses a random number c ∈R Zq, computes RC = gc and R∗C = RC×PW, wherePW= G(pw). Then C sends < idC, R∗C >to S,
Step 2. S → C: < idS, RS,AuthS >
After receiving < idC, R∗C >, S recovers RC by computing R∗C/PW.
Then S chooses a random number s ∈R Zq, computes RS = gs, KS = (RC)s = gcs,AuthS = H1(KS, RC) and sends < idS, RS,AuthS >to C.
Step 3. C → S: < idC,AuthC >
After receiving < idS, RS,AuthS >, C computes KC = (RS)c = gscand verifies whether the receivedAuthS is equal toH1(KC, RC) or not. If it
Client C Server S
Figure 6.1: An execution of the protocolPAKE
After receivingAuthC, S verifies whether it is equal toH1(KS, RS) or not. If it is, S and C agree on the common session key SK= H0(KC) = H0(KS) = H0(gcs).
6.2 Protected Password Change Protocol
Assume that C wants to change it’s old password pw to a new password newpw, C needs to follow these steps and illustrated in Figure 6.2.
Step 1*. C → S: < idC, RC∗, R†C >
C chooses a random number c ∈R Zq, computes RC = gc, R∗C = RC ×
Client C Server S
Figure 6.2: An execution of the protocolSPC
PW and R†C = RC ×NPW, whereNPW = G(newpw). Then C sends
After receiving < idS, RS,AuthS >, C computes KC = (RS)c = gscand verifies whether the received AuthS is equal to H1(KC, RC,NPW) or not. If it holds, C computesAuthC = H1(KC, RS) and sends it to S.
After receiving < idC,AuthC >, S verifies whether the recovered AuthC is equal toH1(KS, RS) or not. If it is, C has successfully changed its old pass-word pw to the new passpass-word newpw and S has successfully updated itsPW to NPWin its database. At the same time, S and C agree on the common session keySK= H0(KS) = H0(KC).
6.3 Security Analysis
In this section, we show the scheme is provable security in the random ora-cle model. We shall employ and simplify the security model [10] to formally prove the security ofPAKEandPPCin the random oracle model. ThePAKE protocol distributes session keys that are semantically secure and provide mutual authentication. Figure 6.3 shows the initialization of both protocols.
Figures 6.4 and 6.5 separately show how instances in the PAKE and PPC protocols behave in response to messages (runs the PAKE andPPC proto-cols).
Before putting the protocols to work, each oracle setsACC(Ui)←TERM(Ui)←
f alse; andSK(Ui)←SID(Ui)←PID(Ui)← null;.
AKE Security. We separately denote the AKE advantage of A in attack-ingPAKEandPPCasAdvAKEPAKE,Dict(A) andAdvAKEPPC,Dict(A); the advantages are taken over all bit tosses. The advantage ofA distinguishing the session key
Initialize(1κ)
- Select a finite cyclic groupG of prime order q with g as a generator, where|q| = κ.
- Hash functions.
Hi : {0, 1}∗ → {0, 1}κfor i = 0, 1, G : {0, 1}∗→ G.
- A client C ∈clientholds a password pw.
pw ←Dict.
- A server S ∈serverholds the hash valuesPWof pw.
PW← G(pw).
Figure 6.3: Specification of protocol initialization
is given by
AdvAKEPAKE,Dict(A) = 2 · Pr[Succ] − 1, AdvAKEPPC,Dict(A) = 2 · Pr[Succ] − 1.
ProtocolsPAKEandPPCareAKE-secure ifAdvAKEPAKE,Dict(A) andAdvAKEPPC,Dict(A) are negligible, respectively.
Computational Diffie-Hellman Assumption. A (t, ε)-CDHg,G attacker, in finite cyclic groupG of prime order q with g as a generator, is a probabilistic machine ∆ running in time t such that its success probability SuccCDHg,G (∆), given random elements gxand gy to output gxy, is greater than ε:
SuccCDHg,G (∆) = Pr[∆(gx, gy) = gxy] ≥ ε.
We denote by SuccCDHg,G (t) the maximal success probability over every ad-versaries running time within time t. The computational Diffie-Hellman assumption states thatSuccCDHg,G (t) ≤ ε for ant t/ε not too large.
Theorem 9. LetA be an adversary against theAKE-security of thePAKEprotocol
Execute-queries Execute(Ci, Sj)
1. Send1(Ci,start)
c← ZR q, RC ← gc, RC∗ ← RC ×PW,msg-out1 ←< idC, R∗C >, internal-stateiC ←< c, RC >
returnmsg-out1 2. Send2(Sj, m1)
< IDI, α >← m1, RC ← α/PW, s← ZR q, RS ← gs, KS ← RsC, AuthS ← H1(KS, RC),msg-out2 ←< idS, RS,AuthS >
internal-statejS ←< RS, KS >
returnmsg-out2
3. Send3(Ci, m2), where m2 =start
< IDI, RS,AuthS >← m2, < c, RC >←internal-stateiC, KC ← RcS
ifH1(KC, RC) = AuthS
AuthC = H1(KC, RS),msg-out3 ←< idC,AuthC >
SK(Ci) ← H0(KC),SID(Ci) ←<msg-out1, m2,msg-out3 >
PID(Ci) ← idS,ACC(Ci) ←TERM(Ci) ← true elsemsg-out3 ← ∗
returnmsg-out3 4. Send4(Sj, m3)
< IDI,AuthC >← m3, < RB, KS >←internal-statejS ifH1(KS, RS) = AuthC
SK(Sj) ← H0(KS),SID(Sj) ←< m1,msg-out2 >
PID(Sj) ← idC,ACC(Sj) ←TERM(Sj) ← true return null
Figure 6.4: Specification of protocolPAKE
Execute-queries Execute(Ci, Sj)
1. Send1(Ci,start)
c← ZR q, RC ← gc, RC∗ ← RC ×PW,NPW← G(newpw), R†C ← RC ×NPW,msg-out1 ←< idC, R∗C, R†C >,
internal-stateiC ←< c, RC,NPW>
returnmsg-out1 2. Send2(Sj, m1)
< IDI, α, β >← m1, RC ← α/PW,NPW← β/RC, s← ZR q, RS ← gs, KS ← RsC,AuthS ← H1(KS, RC,NPW),
msg-out2 ←< idS, RS,AuthS >,internal-statejS ←< RC, KS,NPW>
returnmsg-out2
3. Send3(Ci, m2), where m2 =start
< IDI, RS,AuthS >← m2, < c, RC,NPW>←internal-stateiC, KC ← RcS
ifH1(KC, RC,NPW) = AuthS
AuthC = H1(KC, RS),msg-out3 ←< idC,AuthC >
SK(Ci) ← H0(KC),SID(Ci) ←<msg-out1, m2,msg-out3 >
PID(Ci) ← idS,ACC(Ci) ←TERM(Ci) ← true elsemsg-out3 ← ∗
returnmsg-out3 4. Send4(Sj, m3)
< IDI,AuthC >← m3, < RB, KS >←internal-statejS ifH1(KS, RS) = AuthC
PW←NPW
SK(Sj) ← H0(KS),SID(Sj) ←< m1,msg-out2 >
PID(Sj) ← idC,ACC(Sj) ←TERM(Sj) ← true return null
Figure 6.5: Specification of protocol PPC
within a time bound t, after qsand qh. Then we have:
AdvAKEPAKE,Dict(t, qs, qh) ≤ Dpw(qs) + qs× qh× SuccCDHg,G (t1) + qs 2κ, where t1is the running time of SuccCDHg,G .
Proof. There are two ways that might lead to A successfully attacking the AKE-security of thePAKEprotocol. First,A might obtain the long-lived key and impersonate C or S by mounting the password guessing attack. Sec-ond, A might directly obtain the session key by solving theCDHproblem.
In the following, we shall analyze the probability of the two situations one by one. To analyze a situation, the others are assumed to be under some known probability.
Dictionary Attacks: C and S separately chooses c ∈R Zq and s ∈R Zq at random, which implies RCand RSare random numbers. Hence,A observes
Dictionary Attacks: C and S separately chooses c ∈R Zq and s ∈R Zq at random, which implies RCand RSare random numbers. Hence,A observes