Skip to main content
SpringerLink
Log in

An efficient client–client password-based authentication scheme with provable security

  • Published:
The Journal of Supercomputing Aims and scope Submit manuscript

Abstract

Recently, Tso proposed a three-party password-based authenticated key exchange (3PAKE) protocol. This protocol allows two clients to authenticate each other and establish a secure session key through a server over an insecure channel. The main security goals of such protocols are authentication and privacy. However, we show that Tso’s protocol achieves neither authentication goal nor privacy goal. In this paper, we indicate that the privacy and authentication goals of Tso’s protocol will be broken by off-line password guessing attack and impersonation attack, respectively. To overcome the weaknesses, we propose an improved 3PAKE protocol to achieve more security and performance than related protocols. The security of the proposed improved protocol is proved in random oracle model.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3
Fig. 4

Similar content being viewed by others

References

  1. Farash MS, Bayat M, Attari MA (2011) Vulnerability of two multiple-key agreement protocols. Comput Electr Eng 37(2):199–204

    Article  MATH  Google Scholar 

  2. Farash MS, Attari MA, Bayat M (2012) A certificateless multiple-key agreement protocol without one-way hash functions based on bilinear pairings. IACSIT Int J Eng Technol 4(3):321–325

    Article  Google Scholar 

  3. Farash MS, Attari MA, Atani RE, Jami M (2013) A new efficient authenticated multiple-key exchange protocol from bilinear pairings. Comput Electr Eng 39(2):530–541

    Article  Google Scholar 

  4. Farash MS, Attari MA (2013) Provably secure and efficient identity-based key agreement protocol for independent PKGs using ECC. ISC Int J Inf Secur 5(1):1–15

    Google Scholar 

  5. Farash MS, Attari MA (2014) A pairing-free ID-based key agreement protocol with different PKGs. Int J Netw Secur 16(2):143–148

    MathSciNet  Google Scholar 

  6. Sakalauskas E, Katvickis A, Dosinas G (2010) Key agreement protocol over the ring of multivariate polynomials. Inf Technol Control 39(1):51–54

    Google Scholar 

  7. Lee CC, Lin TC, Hwang MS (2010) A key agreement scheme for satellite communications. Inf Technol Control 39(1):43–47

    Article  Google Scholar 

  8. Hong JW, Yoon SY, Park DI, Choi MJ, Yoon EJ, Yoo KY (2011) An new efficient key agreement scheme for VSAT satellite communications based on elliptic curve cryptosystem. Inf Technol Control 40(3):252–259

    Google Scholar 

  9. Haiyan S, Qiaoyan W, Hua Z, Zhengping J (2013) A strongly secure pairing-free certificateless authenticated key agreement protocol for low-power devices. Inf Technol Control 42(2):105–112

    Google Scholar 

  10. Tseng YM, Yu CH, Wu TY (2012) Towards scalable key management for secure multicast communication. Inf Technol Control 41(2):173–182

    Google Scholar 

  11. Lo JW, Lin SC, Hwang MS (2010) A parallel password-authenticated key exchange protocol for wireless environments. Inf Technol Control 39(2):146–151

    Google Scholar 

  12. Chen BL, Kuo WC, Wuu LC (2012) A secure password-based remote user authentication scheme without smart cards. Inf Technol Control 41(1):53–59

    Google Scholar 

  13. Li CT (2011) Secure smart card based password authentication scheme with user anonymity. Inf Technol Control 40(2):157–162

    Google Scholar 

  14. Li CT, Lee CC (2011) A robust remote user authentication scheme using smart card. Inf Technol Control 40(3):236–245

    Google Scholar 

  15. Jiang Q, Ma J, Li G, Ma Z (2013) An improved password-based remote user authentication protocol without smart cards. Inf Technol Control 42(2):150–158

    Google Scholar 

  16. Bayat M, Farash MS, Movahed A (2010) A novel secure bilinear pairing based remote user authentication scheme with smart card. In: IEEE/IFIP International Conference on Embedded and ubiquitous computing (EUC), pp 578–582

  17. Farash MS, Attari MA (2013) An enhanced authenticated key agreement for session initiation protocol. Inf Technol Control 42(4):333–342

    Google Scholar 

  18. Farash MS, Attari MA (2013) Cryptanalysis and improvement of a chaotic maps-based key agreement protocol using Chebyshev sequence membership testing. Nonlinear Dynam. doi:10.1007/s11071-013-1204-1

  19. Lee CC, Chang YF (2008) On security of a practical three-party key exchange protocol with round efficiency. Inf Technol Control 37(4):333–335

    MathSciNet  Google Scholar 

  20. Xie Q, Dong N, Tan X, Wong DS, Wang G (2013) Improvement of a three-party password-based key exchange protocol with formal verification. Inf Technol Control 42(3):231–237

    Google Scholar 

  21. Liu T, Pu Q, Zhao Y, Wu S (2013) ECC-based password-authenticated key exchange in the three-party setting. Arab J Sci Eng 68(8):2069–2077

    Article  MathSciNet  Google Scholar 

  22. Tu H, Shen H, He D, Chen J (2014) Security analysis and improvements of a three-party password-based key exchange protocol. Inf Technol Control 43(1):57–63

    Google Scholar 

  23. Zhao J, Gu D (2012) Provably secure three-party password-based authenticated key. Inf Sci 184(1):310–323

    Article  MathSciNet  MATH  Google Scholar 

  24. Yang JH, Cao TJ (2012) Provably secure three-party password authenticated key exchange protocol in the standard model. J Systems Softw 85(2):340–350

    Article  Google Scholar 

  25. Xiong H, Chen Y, Guan Z, Chen Z (2013) Finding and fixing vulnerabilities in several three-party password authenticated key exchange protocols without server public keys. Inf Sci 235(1):329–340

    Article  MathSciNet  MATH  Google Scholar 

  26. Nam J, Paik J, Won D (2011) A security weakness in Abdalla et al’.s generic construction of a group key exchange protocol. Inf Sci 181(1):234–238

    Article  MathSciNet  MATH  Google Scholar 

  27. Zhao J, Gu D (2012) Provably secure three-party password-based authenticated key exchange protocol. Inf Sci 184(1):310–323

    Article  MathSciNet  MATH  Google Scholar 

  28. Lee TF, Hwang T (2010) Simple password-based three-party authenticated key exchange without server public keys. Inf Sci 180(9):1702–1714

    Article  MATH  Google Scholar 

  29. Lou DC, Huang HF (2010) Efficient three-party password-based key exchange scheme. Int J Commun Systems 24(4):504–512

    Article  Google Scholar 

  30. Wu S, Pu Q, Wang S, He D (2012) Cryptanalysis of a communication-efficient three-party password authenticated key exchange protocol. Inf Sci 215(1):83–96

    Article  MathSciNet  MATH  Google Scholar 

  31. Chien H (2011) Secure verifier-based three-party key exchange in the random oracle model. J Inf Sci Eng 27(4):1487–1501

    MathSciNet  MATH  Google Scholar 

  32. Pu Q, Wang J, Wu S, Fu J (2013) Secure verifier-based three-party password-authenticated key exchange. Peer-to-peer networking and applications 6(1):15–25

    Article  Google Scholar 

  33. Tallapally S (2012) Security enhancement on simple three party PAKE protocol. Inf Technol Control 41(1):15–22

    Google Scholar 

  34. Farash MS, Attari MA (2014) An enhanced and secure three-party password-based authenticated key exchange protocol without using server’s public-keys and symmetric cryptosystems. Inf Technol Control 43(2):143–150

    MathSciNet  Google Scholar 

  35. Farash MS, Attari MA (2014) An efficient and provably secure three-party password-based authenticated key exchange protocol based on Chebyshev chaotic maps. Nonlinear Dynam. doi:10.1007/s11071-014-1304-6

  36. Yang H, Zhang Y, Zhou Y, Fu X, Liu H, Vasilakos AV (2014) Provably secure three-party authenticated key agreement protocol using smart cards. Comput Netw 58:29–38

    Article  Google Scholar 

  37. Youn TY, Kang ES, Lee C (2013) Efficient three-party key exchange protocols with round efficiency. Telecommun Systems 52(2):1367–1376

    Google Scholar 

  38. Huang HF (2009) A simple three-party password-based key exchange protocol. Int J Commun Systems 22(7):857–862

    Article  Google Scholar 

  39. Yoon EJ, Yoo KY (2011) Cryptanalysis of a simple three-party password-based key exchange protocol. Int J Commun Systems 24(4):532–542

    Article  Google Scholar 

  40. Wu S, Chen K, Zhu Y (2013) Enhancements of a three-party password-based authenticated key exchange protocol. Int Arab J Inf Technol (IAJIT) 10(3):215

  41. Chang TY, Hwang MS, Yang WP (2011) A communication-efficient three-party password authenticated key exchange protocol. Inf Sci 181(1):217–226

    Article  MathSciNet  Google Scholar 

  42. Tso R (2013) Security analysis and improvements of a communication-efficient three-party password authenticated key exchange protocol. J Supercomput. doi:10.1007/s11227-013-0917-8

  43. Abdalla M, Pointcheval D (2005) Interactive Diffie–Hellman assumptions with applications to password-based authentication. In: Proceedings of FC’05, LNCS 3570, pp 341–356

Download references

Author information

Authors and Affiliations

  1. Faculty of Mathematical Sciences and Computer, Kharazmi University, Tehran, Iran

    Mohammad Sabzinejad Farash

  2. Faculty of Electrical and Computer Engineering, K.N. Toosi University of Technology, Tehran, Iran

    Mahmoud Ahmadian Attari

Authors
  1. Mohammad Sabzinejad Farash
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Mahmoud Ahmadian Attari
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Mohammad Sabzinejad Farash.

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Farash, M.S., Attari, M.A. An efficient client–client password-based authentication scheme with provable security. J Supercomput 70, 1002–1022 (2014). https://doi.org/10.1007/s11227-014-1273-z

Download citation

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s11227-014-1273-z

Keywords

Search

Navigation