Search

In three-party password-based key exchange protocol, a client is allowed to share a human-memorable password with a trusted server such that two clients can negotiate a session key to communicate with each other secretly. Recently, many three-party password-based key exchange protocols have been developed. However, these proposed schemes cannot simultaneously achieve security and efficiency. Based on elliptic curve cryptography (ECC), this paper will propose a new simple three-party password-based authenticated key exchange scheme. The proposed method not only reduces computation cost for remote users and a trusted server but also is more efficient than previously proposed schemes. It is better suited for resource constrained devices, such as smart cards or mobile units. Copyright © 2010 John Wiley & Sons, Ltd. Recently, many three-party password-based key exchange protocols have been developed. However, these proposed schemes cannot simultaneously achieve security and efficiency. Based on elliptic curve cryptography (ECC), this paper, will propose a new simple three-party password-based authenticated key exchange protocol. The proposed method not only reduces computation cost for remote users and a trusted server but also is more efficient than previously proposed schemes. It is better suited for resource constrained devices, such as smart cards or mobile units. Copyright © 2010 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

In order to secure communications between two clients with a trusted server's help in public network environments, a three-party authenticated key exchange (3PAKE) protocol is used to provide the transaction confidentiality and the efficiency. In 2009, Huang proposed a simple three-party password-based authenticated key exchange (HS-3PAKE) protocol without any server's public key. By analysis, Huang claimed that the proposed HS-3PAKE protocol is not only secure against various attacks, but also more efficient than previously proposed 3PAKE protocols. However, this paper demonstrates that HS-3PAKE protocol is vulnerable to undetectable online password guessing attacks and off-line password guessing attacks by any other user. Copyright © 2010 John Wiley & Sons, Ltd. In 2009, Huang proposed a simple three-party password-based authenticated key exchange (HS-3PAKE) protocol without any server's public key. By analysis, Huang claimed that the proposed HS-3PAKE protocol is not only secure against various attacks, but also more efficient than previously proposed 3PAKE protocols. However, this paper demonstrates that the HS-3PAKE protocol is vulnerable to undetectable online password guessing attacks and offline password guessing attacks by any other user. Copyright © 2010 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

In three-party password-based key exchange (3PAKE) protocol, a client is allowed to share a human-memorable password with a trusted server such that two clients can agree on a secret session key for secure connectivity. Recently, many 3PAKE protocols have been developed. However, not all of them can simultaneously achieve security and efficiency. Without any server's public key, this article will propose a simple three-party password-based authenticated key exchange scheme. Compared with the existing schemes, the proposed scheme is not only more efficient, but also is secure. Copyright © 2009 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

Recently, Hsu et al. showed that Ku and Wang''s authenticated key agreement protocol is vulnerable to the modification attack and then proposed an improved protocol, called HWWM protocol. In this paper, we argue that the HWWM protocol is still vulnerable to the modification attack and cannot also withstand the password guessing attack. Then, we propose an improved protocol to solve these problems. [Copyright &y& Elsevier]