Cryptanalysis and Improvement of a Password-Based Authenticated Three-Party Key Exchange Protocol

Transcription

1 Internatonal Journal of Securt and Its pplcatons pp rptanalss and Improvement of a Password-ased uthentcated Three-Part e Echange Protocol oungsook Lee Department of ber Investgaton Polce Howon Unverst Gunsan Jeonrabukdo orea sooklee@howon.ac.kr bstract Protocols for password-based authentcated ke echange (PE) n the three-part settng must be desgned to be secure aganst dctonar attacks even n the presence of a malcous nsder. In ths work we revst the three-part PE protocol proposed b m and ho n 2009 and demonstrate that the protocol s vulnerable to an nsder offlne dctonar attack (whch allows an adversar to mpersonate a legtmate part and ntate transactons). We also show that due to the vulnerablt m and ho s protocol s rendered nsecure n the n dstngush ablt-based securt model of ellare Pontcheval and Rogawa (2000). We propose an mproved three-part PE protocol whch s resstant to all classes of dctonar attacks ncludng nsder offlne dctonar attacks and undetectable onlne dctonar attacks. ewords: uthentcated ke echange Password Three-part settng Dctonar attack Insder 1. Introducton Password-based authentcated ke echange (PE) protocols enable two or more partes who hold ther passwords as long-term secrets to establsh a shared crptographcall strong ke (commonl called a sesson ke) whle communcatng over a publc nsecure network [1-4]. Due to the persstent populart of passwords as an accessble authentcaton method n toda s computng envronment PE protocols have been among the most wdel emploed and fundamental prmtves n crptograph. ellovn and Merrtt [1] proposed the frst PE protocols known as Encrpted e Echange (or EE) n the two-part settng where each par of two partes wshng to establsh a sesson ke s assumed to hold the same password. lthough there are some password-based protocols publshed n advance of EE these earler protocols were desgned to work onl n a hbrd settng where partes are assumed to share publc kes n addton to passwords. Over the past 20 ears the EE protocol has been followed b a number of two-part PE protocols ncludng the recent protocol of atz and Vakuntanathan [3] whch runs n a sngle communcaton round and acheves provable securt n the standard model (.e. wthout random oracles). Whle PE protocols are cheap and effectve tools for securng publc communcatons ther desgn has been proven to be notorousl hard. ke challenge n desgnng PE protocols s to preserve password securt aganst dctonar attacks whereb an adversar ends up wth the correct password after ehaustvel testng all possble passwords aganst known password verfers. Ths s partcularl the case n the three-part settng whch we consder n ths work. Unlke the two-part settng the three-part settng supposes that the two partes (called clents) do not hold the same password but hold ther ndvdual password Onlne Verson Onl. ook made b ths fle s ILLEGL. ISSN: IJSI oprght c 2014 SERS

2 Internatonal Journal of Securt and Its pplcatons shared onl wth a trusted authentcaton server. Dctonar attacks pose a more subtle threat n the three-part settng as a malcous et legtmate clent can mount an nsder attack aganst ts partner clent. In fact there have been man three-part PE protocols broken b nsder onlne/offlne dctonar attack; see e.g. Refs. [5-8]. In ths work we revst the three-part PE protocol presented b m and ho n 2009 [9] whch was clamed to be secure aganst onlne/offlne dctonar attacks. m and ho s protocol was proposed as a f to the flaws the found on the protocol of Lu and ao (2007) [10]. ut as we demonstrated n Secton 3 m and ho s protocol s susceptble to an offlne dctonar attack n the presence of a malcous nsder. Due to ths vulnerablt m and ho s protocol s rendered nsecure n the n dstngush ablt-based securt model of ellare Pontcheval and Rogawa [11] - ths model s probabl one of the most wdel accepted models n the provable securt paradgm for protocol analss. We also present an mproved three-part PE protocol whch s secure aganst all classes of dctonar attacks ncludng nsder offlne dctonar attacks and undetectable onlne dctonar attacks. 2. Revew of m and ho s Protocol Here we revew the three-part PE protocol presented b m and ho [9] as an mproved verson of Lu and ao s three-part PE protocol [10]. Let and denote two clents who wsh to establsh a sesson ke and assume that the are regstered wth the same trusted server S who ests to provde ts regstered clents wth a central authentcaton servce. Let pw and pw be the passwords of and respectvel shared wth the server S va a secure channel. pw (resp. pw ) s used as the long-term secret ke of (resp. ) and S. efore the protocol s ever eecuted the server needs to determne and publcze the followng sstem parameters: cclc group G of prme order and a generator g of the group G. Two elements M and N of group G. Two crptographc hash functons G : 0 1 G and H : where s a securt parameter representng the length of sesson kes. Wth these publc parameters and the secret passwords establshed m and ho s protocol runs as follows: u 1. chooses two random numbers u Z and computes U g X g and pw. Then sends X ( U X ) M ID X to. 2. selects two random numbers v Z and computes pw. then sends (V ) N 3. Upon recevng Net S ID X ID to S. V v g ID X ID S frst recovers X and b computng: chooses a random / U ID ID / V ID ID ( / pw ) X X M U ( / N pw ) V z Z and computes g and Onlne Verson Onl. ook made b ths fle s ILLEGL. 152 oprght c 2014 SERS

3 Internatonal Journal of Securt and Its pplcatons Onlne Verson Onl. ook made b ths fle s ILLEGL. Fgure 1. m and ho s Three-Part PE Protocol oprght c 2014 SERS 153

4 Internatonal Journal of Securt and Its pplcatons Then S sends 4. fter havng receved and sends 5. Upon recevng X to. to. X z X z pw p w G ( ID ID ID X ) S pw p w G ( ID ID ID ) S X X p w. p w X computes pw p w G ( ID ID ID ) computes S / X X p w X G ( ID ID ) pw p w G ( ID ID ID X ) S / p w and checks f s eual to ( ). If not aborts the protocol. Otherwse computes the sesson ke S H ( ID ID ) and sends the authentcator G ( ID ID ) to. 6. Verfes that s eual to ( ) G ID ID. borts the protocol f the verfcaton fals and otherwse computes the sesson ke S H ( ID ID ). The operaton of the protocol s depcted n Fgure 1. t the end of the protocol eecuton and wll compute the same sesson ke S H ( ID ID ) as can be seen from the euatons and z pw Onlne Verson Onl. ook made b ths fle s ILLEGL. g 154 oprght c 2014 SERS

5 Internatonal Journal of Securt and Its pplcatons X pw X g z. 3. Dctonar ttack and ts Formal nalss Ths secton demonstrates that m and ho s three-part PE protocol descrbed n the prevous secton s susceptble to an nsder offlne dctonar attack. s we have earler mentoned m and ho s protocol was proposed to elmnate the vulnerablt of Lu and ao s protocol [10] to an undetectable onlne dctonar attack. lthough m and ho s protocol ma be secure aganst undetectable onlne dctonar attacks we found that t s not secure aganst an offlne dctonar attack n the presence of a malcous clent. ssume that s a malcous clent who wshes to dscover the password of clent. Then can mount the followng offlne dctonar attack aganst. Phase 1. Frst gathers nformaton reured to verf password guesses b runnng the protocol wth the clent and the server S. Step 1. Proceeds as per the protocol specfcaton ecept that t nterferes wth the message echanges between and S as follows: eavesdrops on the message When S sends the message and sends the forged message X X X f t s from S. Step 2. Wthout notcng that as G ( ID ID ) where ID X ID sent b to S for future use. X to ntercepts the message computes X was replaced wth X pw ( X X ) g z X X pw g X p w X pw. X (nstead of X ) as X wll compute Onlne Verson Onl. ook made b ths fle s ILLEGL. fter the computaton of the protocol. Step 3. s soon as wll send the message to as specfed n s receved the malcous nsder sends a falure message falsfng that due to an unepected fatal error t has faled to compute ts sesson ke and thus has aborted the protocol. oprght c 2014 SERS 155

6 Internatonal Journal of Securt and Its pplcatons Phase 2. can now verf password guesses on pw usng the obtaned nformaton ID. ( ) Step 1. Frst computes Step 2. Net makes a guess pw S and p w G ( ID ID ID X ) z pw g. pw on the password / ( pw / ) V ID ID N V G ( ID ID ). pw and computes Step 3. Then verfes the correctness of pw b checkng that s eual to. If pw s the correct password (.e. p w p w ) then and must be eual. Step 4. Repeats Steps 2 and 3 (of ths verfcaton phase) untl a correct password s found. It s straghtforward to see that Lu and ao s three-part PE protocol [10] the predecessor of m and ho s protocol s also vulnerable to the same nsder dctonar attack as descrbed above. The vulnerablt above mples nsecurt n the wdel accepted n dstngush abltbased model of ellare Pontcheval and Rogawa [11] n whch the adversar s gven access to the varous oracles such as Send Eecute Reveal orrupt and Test. Let denote the -th nstance of clent and p d denote the partner dentfer of nstance. (Readers who are unfamlar wth formal securt models are referred to Ref. [11].) ssume that a uer of the form Send ( start: { S } ) prompts to ntate the protocol wth p d { S }. Then an adversar who breaks the n dstngush ablt-based securt of m and ho s protocol can be constructed as descrbed n Table 1. Table 1. onstructon of an dversar who breaks the n Dstngush bltbased Securt of m and ho s Protocol n the Formal Model of ellare Pontcheval and Rogawa [11] Step Descrpton 1 orrupton obtans s password pw b uerng orrupt ( ). 2 Dctonar attack runs a protocol sesson n the eact same wa as dd n the dctonar attack descrbed above. Note that can perfectl smulate s attack b usng the dsclosed password pw and b askng Send ueres appropratel. wll obtan s password pw as a result of the attack. 3 Impersonaton ntates a new protocol sesson b uerng Send( start: { S } ) where s an unused nstance of an uncorrupted clent. runs ths sesson as per the protocol specfcaton but smulatng b tself all the actons of (b usng Onlne Verson Onl. ook made b ths fle s ILLEGL. 156 oprght c 2014 SERS

7 Internatonal Journal of Securt and Its pplcatons pw ). t the end of the sesson the nstance wll accept wth ts sesson ke sk. 4 Test learl the nstance s fresh: (1) no Reveal uer has ever been made for an nstance and (2) no orrupt uer has been asked for an of p d { S }. Thus ma ask the uer Test( ). Snce can compute the same sesson ke as sk the probablt that guesses correctl the bt b chosen b the Test oracle s 1 and so s the advantage of n attackng m and ho s protocol. 4. n Improved Three-Part PE Protocol In ths secton we propose a new three-part PE protocol whch s secure aganst offlne dctonar attacks as well as undetectable onlne dctonar attacks. Our proposed protocol uses a smmetrc encrpton scheme = (Enc Dec) where Enc s the encrpton algorthm and Dec s the decrpton algorthm a message authentcaton code (M) scheme = (Mac Ver) where Mac and Ver are the M generaton and M verfcaton algorthms respectvel and a crptographc hash functon H : where represents the length of kes for the smmetrc encrpton scheme. Let G be a cclc group of prme order and g be a generator of the group G. The mproved protocol s shown n Fgure 2 and ts descrpton s as follows: Step 1. and S generate a common secret ke k from ther shared password pw whle and S generate a secret ke k from the password pw. More precsel k and k are generated as follows: chooses a random Z X p w k p w k computes g P W H ( S p w ) and PW X E n c ( X ) and sends X to S. t the same tme S chooses a random z computes Z S p w ) and E n c ( ) z Z g P W H ( Z Z and sends PW S Z to. Then and S decrpt Z and X respectvel and set z k g. chooses a random Z g P W H ( S p w ) PW computes and E n c ( ) and sends chooses a random z g z Z to S. S computes Z P W H ( S p w ) Z PW and E n c ( Z ) and sends S Z to. Onlne Verson Onl. ook made b ths fle s ILLEGL. Then and S decrpt Z and z respectvel and set k g. oprght c 2014 SERS 157

8 Internatonal Journal of Securt and Its pplcatons Step 2. hooses a random Fgure 2. Our Improved Three-Part PE Protocol u Z computes U u M a c and sends g and k ( U ) v Z U to S. Lkewse chooses a random and k ( V ) M a c and sends V to S. Step 3. S borts the protocol f ether ( U ) 1 k computes V e r or ( V ) 1 k V g V e r does not hold. Otherwse S computes M a c ( ) and M a c ( ) and k V k U sends S V and S U to and respectvel. Step 4. borts f V e r ( V ) 1 does not hold. Otherwse computes the sesson ke Onlne Verson Onl. ook made b ths fle s ILLEGL. S u k V. Meanwhle checks f ( U ) 1 check fals. Otherwse computes the sesson ke V e r s true and aborts f the k S v U. v 158 oprght c 2014 SERS

9 Internatonal Journal of Securt and Its pplcatons The sesson-ke computaton n the protocol s the same as n the Dffe-Hellman ke echange protocol. Hence t s straghtforward to verf the correctness of the protocol. The nsder offlne dctonar attack mounted aganst m and ho s protocol s no longer vald aganst our mproved protocol snce the algebrac propert used b the attack does not est n our protocol. Furthermore our protocol provdes mutual authentcaton between the server and the clents va the M values echanged n Steps 2 and 3 and therefore s secure aganst undetectable onlne dctonar attacks. 5. oncluson Ths work dentfed that the three-part PE protocol due to m and ho s not secure aganst an offlne dctonar attack n the presence of a malcous nsder. Our attack hghlghts agan the dffcult of desgnng a secure et effcent PE protocol n the password-onl three-part protocol. Ths work also demonstrated that the estence of our dctonar attack mples nsecurt of m and ho s protocol n the n dstngush abltbased securt model of ellare Pontcheval and Rogawa. Fnall ths work presented an mproved three-part PE protocol whch s secure aganst nsder offlne dctonar attacks as well as undetectable onlne dctonar attacks. We hope that smlar securt vulnerabltes as dentfed n ths work can be avoded n the future desgn of three-part PE protocols. cknowledgements Ths work was supported b Howon Unverst n References [1] S. ellovn and M. Merrtt Encrpted ke echange: password-based protocols secure aganst dctonar attacks IEEE Smposum on Securt and Prvac (1992) Ma 4-6 pp [2] J. Nam J. Pak and D. Won securt weakness n bdalla et al. Generc constructon of a group ke echange protocol Informaton Scences vol. 181 no. 1 (2011) pp [3] J. atz and V. Vakuntanathan Round-optmal password-based authentcated ke echange Journal of rptolog vol. 26 no. 4 (2013) pp [4] H. Tsa and. hang Provabl secure three part encrpted ke echange scheme wth eplct authentcaton Informaton Scences vol. 238 (2013) pp [5] W. Wang and L. Hu Effcent and provabl secure generc constructon of three-part password-based authentcated ke echange protocols Progress n rptolog - INDORPT 2006 LNS vol (2006) December pp [6] J. Nam J. Pak H. ang U. m and D. Won n off-lne dctonar attack on a smple three-part ke echange protocol IEEE ommuncatons Letters vol. 13 no. 3 (2009) pp [7] S. Wu Q. Pu S. Wang and D. He rptanalss of a communcaton-effcent three-part password authentcated ke echange protocol Informaton Scences vol. 215 (2012) pp [8] J. Nam R. hoo M. m J. Pak and D. Won Dctonar attacks aganst password-based authentcated three-part ke echange protocols SII Transactons on Internet and Informaton Sstems vol. 7 no. 12 (2013) pp [9] H. m and J. ho Enhanced password-based smple three-part ke echange protocol omputers and Electrcal Engneerng vol. 35 no. 1 (2009) pp [10] R. Lu and Z. ao Smple three-part ke echange protocol omputers & Securt vol. 26 no. 1 (2007) pp [11] M. ellare D. Pontcheval and P. Rogawa uthentcated ke echange secure aganst dctonar attacks dvances n rptolog - EURORPT 2000 LNS vol (2000) Ma pp Onlne Verson Onl. ook made b ths fle s ILLEGL. oprght c 2014 SERS 159

10 Internatonal Journal of Securt and Its pplcatons uthor oungsook Leefr3he receved the.e. and the M.S. degrees n Informaton Engneerng and Informaton Securt from Sungkunkwan Unverst orea n 1987 and n She receved the PH. D degree n omputer Engneerng from Sungkunkwan Unverst orea n She s now an assocate professor n Howon Unverst. Her current research nterests nclude crptograph and dgtal forensc. Onlne Verson Onl. ook made b ths fle s ILLEGL. 160 oprght c 2014 SERS