Security enhancement on efficient verifier-based key agreement protocol for three parties without server s public key

Transcription

1 Inernaional Mahemaical Forum, 1, no. 20, 2006, Securiy enhancemen on efficien erifier-based key agreemen proocol for hree paries wihou serer s public key Ren-Chiun Wang 1 and un-ru Mo 2 Deparmen of Informaion Managemen 1 Chaoyang Uniersiy of Technology 1F., No.9, lley 10, Lane 278, Cingshuei Rd., Tucheng Ciy, Taipei Couny 236, Taiwan R.O.C. Corresponding auhor chiunchiunwang@yahoo.com.w Deparmen of Informaion Managemen 2 Min Chuan Uniersiy No. 250, secion 5, Chung Shan Norh Road, Taipei Ciy 111, Taiwan R.O.C. sephen@sanyo.com.w bsrac Recenly Lee e al. proposed an efficien erifier-based key agreemen proocol for hree paries wihou serer s public key. Lee e al. claimed he proposed proocol could resis arious aacks and proide he perfec forward secrecy. Howeer, in his paper, auhors shall show ha heir proocol suffers from he impersonaion aack. he same ime, auhors shall propose an improed mehod o wihsand he aboe aack. eyword: auhenicaion, crypanalysis, impersonaion aack, key agreemen, password. 1. Inroducion When wo paries wan o communicae each oher, he erificaion of he ideniy of he oher pary is an imporan requiremen. For enhancing he performance of he proocol, elloin and Merri [1] proposed an encryped exchange proocol based on password called EE for auhenicaion and key agreemen in 1992.

2 966 Ren-Chiun Wang and un-ru Mo Following and exending he concepions of elloin and Merri s proocol, many hree-pary proocols were proposed [2, 5, 7-10]. Howeer, he preious proocols sill exised some securiy problems such as on-line undeecable password guessing aack [4] and off-line password guessing aack [7] ec. No only ha, some proocols also required serer s public key o proec he shared password [7, 10]. For enhancing he efficiency and preening arious aacks, Lee e al. [6] proposed an efficien erifier-based key agreemen proocol for hree paries wihou serer s public key. Lee e al. s proocol proides he perfec forward secrecy by employing he concepions of he Diffie-Hellman scheme [3] and each clien only needs o remember a memorable password. The proocol is suiable for some applicaions of low compuaions. Howeer, auhors shall show ha Lee e al. s proocol is ulnerable o he impersonaion aack wihou making an off-line password guessing aack. he same ime, auhors shall propose an improed mehod o wihsand he aboe aack. Nex Secion, auhors shall go oer Lee e al. s proocol and show ha heir proocol s weakness. In Secion 3, auhors shall propose an improemen. Finally, auhors shall make a conclusion for his paper. 2. Reiew of Lee e al. s proocol In his secion, auhors shall reiew Lee e al. s proocol show ha he proocol s weakness. efore he inroducion of he proocol, auhors firs denoe some parameers as follows., and denoes he ideniies of lice, ob and uhenicaion Serer respeciely. p is a large prime and g is a generaor in he cyclic group Z p *. uhors omi mod p from expressions for simpliciy. h( denoes a collision-free one-way hash funcion. π is a password and shared beween and. is a erifier ha is compued fromπ. h, ( π is a password and shared beween and. is a erifier ha is compued fromπ. h, ( 2.1 Lee e al. s proocol efore he running of he proocol, lice and ob sends heir erifiers and o

3 , Securiy enhancemen on efficien 967 hrough a secure channel. sores and in a password able. Sep 1: lice ob: lice compues X a and sends he compued resul wih he ideniy o ob, where * a R Z p. Sep 2: ob :, ob lice: b * R Z p ob compues X, where b and respeciely.. ob sends X and (, o lice Sep 3: lice: X ob: X S fer receiing he messages, reriees and from password able. Then c compues X = ( and X S = ( d, where c and d R Z * p. sends X and X S o lice and ob respeciely. Finally, compues = (X and S = (X d bd. c ac Sep 4: lice : ob : S a ac lice compues = ( X and = h(,, X. b bd lice sends o. Similarly, ob compues = ( X and S = h(,, X S, S. ob sends S o. Noe ha = h, and = h(,. ( S S

4 968 Ren-Chiun Wang and un-ru Mo Sep 5: lice: ob: S, erifies wheher and S are rue or no. If hey are rue, sends and S o lice and ob respeciely, where = h,, X, and S = h(,, X, S. ( Sep 6: lice and ob erify wheher and S are rue or no respeciely. If hey are a ba rue, lice compues = (X and ob compues = (X. Finally, lice and ob negoiae a common session key = h(,, = h(,,. We use figure 1 o inroduce Lee e al. s proocol. b ab lice ob = h, = h, ( a ( h(, S, π h(, S, π, X b, X = ( c X X X S = ( d S = (X c ac a ac b bd = ( X S = ( X S S = (X c bc = h(,, S, S = h(,, S S, S = h( S,,, X, S S = h( S,,, X, S Verify and S Verify = (X a ab = h(,, Verify S = (X b ab = h(,, Fig. 1 Inroducion of Lee e al. s proocol 2.2 Weakness on Lee e al. s proocol Once lice s erifier has solen by he aacker. The aacker can impersonae ob o communicae wih lice by performing he following seps. We use figure 2 o inroduce our aack. Sep 1 : When lice wans o communicae wih ob. lice sends ( o ob. Now, he aacker inerceps i and sends ( = o ob. Sep 2 : ob forwards he receied message wih ( o and sends X o he

5 Securiy enhancemen on efficien 969 aacker respeciely. Then, he aacker sends X o lice, where b is chosen by he aacker. b Sep 3 : compues X = ( c d and X S = ( and sends he compued resuls o he aacker and ob respeciely. Finally, compues = (X c = ( c d bd and S = (X. Sep 4 : The aacker sends X = ( c o lice, where c is chosen by he aacker. Sep 5 : The aacker compues = X = (c and sends ' = h(,, X, ' o. We can find can pass he erificaion of because = = (c. Sep 6 : The aacker compues = (X c ac, ab and = h(,, X,. Sep 7 : lice compues a = ( X ' ac', ab and = h,, X,. lice sends o he aacker. The aacker sends o ( lice. We can find lice will accep he receied message because = = g ac. Sep 8 :Finally, lice beliees he common session key = h(,, b a is rue. he same, ob also beliees he owned session key = h(,, = ( b is rue. In fac, he aacker ges he session key = (X b ab and impersonaes ob o communicae wih lice.

6 970 Ren-Chiun Wang and un-ru Mo lice acker ob a = X b X b, X = ( c X S = ( d X = ( c X X S = (X c = ( c S = (X c bc = ( X' ab' a ' = h(,, X ac' = X = ( c ac ab, ' ' = h(,, X S S, ' Verify and S Verify = h(,, Fig. 2 Impersonaion aack in he Lee e al. s proocol 3. Improemen on Lee e al. s proocol uhors shall propose an improed mehod o wihsand he aboe aack. lice and ob should send = h(,, X, c ( X, and S = h(,, X, d ( X, S o respeciely in he Sep 4 of Lee e al. s S proocol. Een if boh lice and ob s erifiers and are solen by he aacker. The aacker sill canno make an impersonaion aack on our improemen wihou = h, and = h(,. We use figure 3 o inroduce our improemen. (

7 Securiy enhancemen on efficien 971 lice ob = h, = h, = ( X ( = h(,, X a X b a X, g ac c, S S ( = ( X S = h(,, X, b X S, g bd d, S h(, h(, X = ( c X S = ( d = (X c ac S = (X c bc, = h(,, X, X, S S = h(,, X, X, S Verify and S Verify = (X a ab = h(,, Verify S = (X b ab = h(,, Fig. 3 Our improemen 4. Conclusion In his paper, auhors show ha Lee e al. s efficien erifier-based key agreemen proocol for hree paries is ulnerable o he impersonaion aack wihou making an off-line password guessing aack. he same ime, auhors propose heir improemen o wihsand he aboe aack. Reference [1] S. M. elloin and M. Merri, Encryped key exchange: password-based proocols secure agains dicionary aacks, Proceedings of he IEEE Symposium on Research in Securiy and Priacy, (1992, [2] C.-C. Chang and Y.-F. Cheng, noel hree-pary encryped key exchange proocol, Compuer Sandards & Inerfaces, 26 (5 (2004, [3] W. Diffie and M. Hellman, New direcions in crypography, IEEE Trans. Inform. Theory, 22 (1976, [4] Y. Ding and P. Horser, Undeecable on-line password guessing aack, CM

8 972 Ren-Chiun Wang and un-ru Mo SIGOPS Operaing Sysems Reiew, 29 (4 (1995, [5] T.-F. Lee, T. Hwang and C.-L. Lin, Enhanced hree-pary encryped key exchange wihou serer public keys, Compuers & Securiy, 23 (2004, [6] S.-W. Lee, H.-S. im and.-y. Yoo, Efficien erifier-based key agreemen proocol for hree paries wihou serer s public key, pplied Mahemaics and Compuaion, 167 (2005, [7] C.-L. Lin, H.-M. Sun and T. Hwang, Three-pary encryped key exchange: aacks and a soluion, CM Operaing Sysems Reiew, 34 (4 (2000, [8] C.-L. Lin, H.-M. Sun, M. Seiner and T. Hwang, Three-pary encryped key exchange wihou serer public-keys, IEEE Communicaion Leers, 5 (12 (2001, [9] M. Seiner, G. Tsudik and M. Waidner, Refinemen and exension of encryped key exchange, CM Operaing Sysems Reiew, 29 (3 (1995, [10] H.-M. Sun,.-C. Chen and T. Hwang, Secure key agreemen proocols for hree-pary agains guessing aacks, The Journal of Sysems and Sofware, 75 (1-2 (2005, Receied: Sepember 24, 2005