Cryptanalysis and Enhancement of Modified Gateway-Oriented Password-Based Authenticated Key Exchange Protocol

Kyung-Ah SHIM  

IEICE TRANSACTIONS on Fundamentals of Electronics, Communications and Computer Sciences   Vol.E91-A   No.12   pp.3837-3839
Publication Date: 2008/12/01
Online ISSN: 1745-1337
DOI: 10.1093/ietfec/e91-a.12.3837
Print ISSN: 0916-8508
Type of Manuscript: LETTER
Category: Cryptography and Information Security
cryptography,  password-based authentication protocol,  key exchange,  undetectable on-line password guessing attack,  

Full Text: PDF(65.4KB)>>
Buy this Article

Abdalla et al. proposed a gateway-oriented password-based authenticated key exchange (GPAKE) protocol among a client, a gateway, and an authentication server, where a password is only shared between the client and the authentication server. The goal of their scheme is to securely establish a session key between the client and the gateway by the help of the authentication server without revealing any information on the password to the gateway. Recently, Byun et al. showed that Abdalla et al.'s GPAKE is insecure against undetectable on-line password guessing attacks. They also proposed a modified version to overcome the attacks. In this letter, we point out that Byun et al.'s modified GPAKE protocol is still insecure against the same attacks. We then make a suggestion for improvement.