Search

SUMMARY Three-party password-authenticated key exchange (3PAKE) protocols allow entities to negotiate a secret session key with the aid of a trusted server with whom they share a human-memorable password. Recently, Lou and Huang proposed a simple 3PAKE protocol based on elliptic curve cryptography, which is claimed to be secure and to provide superior efficiency when compared with similar-purpose solutions. In this paper, however, we show that the solution is vulnerable to key-compromise impersonation and offline password guessing attacks from system insiders or outsiders, which indicates that the empirical approach used to evaluate the scheme's security is flawed. These results highlight the need of employing provable security approaches when designing and analyzing PAKE schemes. Copyright © 2011 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

SUMMARY This paper focuses on two interesting radio-frequency identification (RFID) cryptographic protocols: the server-less RFID authentication protocol that allows readers to authenticate tags without the help of any online backend servers, and the RFID searching protocol in which the verifier explicitly specifies the target tag to be searched and authenticated. These two kinds of RFID protocols play important roles in many RFID applications; however, the existing protocols either had security weaknesses or exhibited poor efficiency. This paper shows the weaknesses, and then proposes our server-less RFID authentication protocol and RFID searching protocol. The proposed protocols greatly enhance the security using one more hashing. Copyright © 2011 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

In 2009, Huang ( Int. J. Commun. Syst., 22, 857-862) proposed a simple and efficient three-party password-based key exchange protocol without server's public key. This work shows that the protocol could be vulnerable to an undetectable online password guessing attack. Furthermore, an improved protocol is proposed to avoid the attack. Copyright © 2011 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]