期刊
COMPUTERS & SECURITY
卷 27, 期 1-2, 页码 16-21出版社
ELSEVIER ADVANCED TECHNOLOGY
DOI: 10.1016/j.cose.2008.03.001
关键词
password-authenticated key exchange; cryptanalysis; security; dictionary attack; man-in-the-middle attack
Recently, Lu and Cao published a novel protocol for password-based authenticated key exchanges (PAKE) in a three-party setting in journal of Computers and Security, where two clients, each shares a human-memorable password with a trusted server, can construct a secure session key. They argued that their simple three-party PAKE (3-PAKE) protocol can resist against various known attacks. In this paper, we show that this protocol is vulnerable to a kind of man-in-the-middle attack that exploits an authentication flaw in their protocol and is subject to the undetectable on-line dictionary attack. We also conduct a detailed analysis on the flaws in the protocol and provide an improved protocol. (c) 2008 Elsevier Ltd. All rights reserved.
作者
我是这篇论文的作者
点击您的名字以认领此论文并将其添加到您的个人资料中。
推荐
暂无数据