Search

Abstract: This paper proposes verifier-based computation-and communication-efficient three-party encrypted key exchange (VBCC3EKE) protocols to minimize the complexity of computational and communicational costs among all users and fit three-party communication environments. Compared with related verifier-based 3EKE protocols, the proposed VBCC3EKE protocols have enhanced computational and communicational efficiency. As a result, the proposed VBCC3EKE protocols are most suitable for use in various applications over distributed three-party network environments such as the Internet and mobile e-commerce. [Copyright &y& Elsevier]

Abstract: In order to secure communications between two clients with a trusted server''s help in public network environments, a three-party password-based authenticated key exchange (3PAKE) scheme is used to provide the transaction confidentiality and e_ciency. In 2010, Lou-Huang proposed a new simple three-party password-based authenticated key exchange (LH-3PAKE) scheme based on elliptic curve cryptography (ECC). By analysis, Lou-Huang claimed that the proposed LH- 3PAKE scheme is not only secure against various attacks, but also more e_cient than previously proposed 3PAKE schemes. However, this paper demonstrates LH-3PAKE scheme is vulnerable to o_-line password guessing attacks by an attacker. [Copyright &y& Elsevier]

This paper proposes secure and efficient biometric-based three-party authenticated key establishment (B3AKE) protocols to minimize the computation costs of each participant and fit three-party communication. The proposed B3AKE protocols adopts a three-factor authentication mechanism which uses biometric, token, and passwords for users unlike the related protocols. In addition, the proposed B3AKE protocols are composed of four sub-protocols, which are registration, biometric-based three-party authenticated key transport, biometric-based three-party authenticated key agreement (B3AKA), and password update. In order to exploit the key block size, speed, and security jointly, the proposed B3AKA protocol is based on symmetric key cryptosystems and elliptic curve cryptography. As a result, the proposed B3AKE protocols not only are secure against well-known cryptographical attacks but also provide perfect forward secrecy. Furthermore, the number of rounds is smaller by one round than the related protocols and the asymmetric key encryption/decryption operations do not need to establish a session key and authenticate between two users and a server. Thus, the proposed B3AKE protocols are very useful in limited computation and communication resource environments to access remote information systems since it provides security, reliability, and efficiency. [ABSTRACT FROM AUTHOR]

In order to secure communications between two clients with a trusted server's help in public network environments, a three-party authenticated key exchange (3PAKE) protocol is used to provide the transaction confidentiality and the efficiency. In 2009, Huang proposed a simple three-party password-based authenticated key exchange (HS-3PAKE) protocol without any server's public key. By analysis, Huang claimed that the proposed HS-3PAKE protocol is not only secure against various attacks, but also more efficient than previously proposed 3PAKE protocols. However, this paper demonstrates that HS-3PAKE protocol is vulnerable to undetectable online password guessing attacks and off-line password guessing attacks by any other user. Copyright © 2010 John Wiley & Sons, Ltd. In 2009, Huang proposed a simple three-party password-based authenticated key exchange (HS-3PAKE) protocol without any server's public key. By analysis, Huang claimed that the proposed HS-3PAKE protocol is not only secure against various attacks, but also more efficient than previously proposed 3PAKE protocols. However, this paper demonstrates that the HS-3PAKE protocol is vulnerable to undetectable online password guessing attacks and offline password guessing attacks by any other user. Copyright © 2010 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

Abstract: Recently, Yang et al. proposed an improvement to Tseng et al.’s protected password changing scheme that can withstand denial of service attack. However, the improved scheme is still susceptible to stolen-verifier attack and denial of service attack. Accordingly, the current paper demonstrates the vulnerability of Yang et al.’s scheme to two simple attacks and presents a new protected password change scheme using a public server key to resolve such problems. In contrast to Yang et al.’s protected password changing scheme, the proposed scheme can simply update user passwords without a complicated process, and also provides explicit key authentication and perfect forward secrecy in the case of a session key agreement. [Copyright &y& Elsevier]

Abstract: In 2004, Wu-Lin pointed out that Lee et al.’s key authentication scheme is vulnerable to public key substitution attacks. For enhancing the security, Wu-Lin proposed a simply improved key authentication scheme with better efficiency and a robust key authentication scheme resistant to public key substitution attacks. However, in this paper, we will show that Wu-Lin’s robust key authentication scheme is still vulnerable to public key substitution attack. Also, we will show that Lee et al.’s scheme and Wu-Lin’s efficiency improved key authentication scheme are vulnerable to simple public key substitution attack than Wu-Lin’s attack method. [Copyright &y& Elsevier]

Abstract: Recently, Lin et al. proposed an improvement on the OSPA protocol to make the protocol withstand the stolen-verifier attack, using smart card. However, Ku et al. demonstrated that Lin et al.’s protocol is vulnerable to the replay attack and the denial of service attack. In this paper, we will propose an enhancement of the protocol to isolate such problems. As a result, the proposed scheme can simply update user passwords and also provides mutual authentication between the user and a remote server. Besides all the above merits, the proposed has more efficient performance by reducing the number of hash operations. [Copyright &y& Elsevier]