Two-Factor Authenticated Key Exchange Protocol in the Three-Party Setting

Abstract:

This paper proposes a three-party authenticated key exchange protocol using two-factor including a password and a token. The proposed protocol allows two users to establish a session key through a trusted server with whom they both share a human-memorable password and a token. Over the past years, many three-party authenticated key exchange protocols have been proposed. However, many proposed protocols use smart cards with tamper-resistance property as tokens. It is not practical by using smart cards because of the high cost and the infrastructure requirements. Therefore, the proposed paper only uses a common storage device such as a USB memory stick. We believe the proposed protocol is suitable for practical scenarios.

• Periodical: Applied Mechanics and Materials (Volumes 182-183)
• Pages: 2075-2079
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.182-183.2075
• Online since: June 2012
• Authors: Ren Junn Hwang, Feng Fu Su, Loang Shing Huang
• Keywords: Authenticated Key Exchange Protocol, Password, Two-Factor Authentication

References

[1] S. Chakrabarti, M. Singbal: Password-based authentication: preventing dictionary attacks, Computer Vol. 40-6 (2007), pp.68-74.

DOI: 10.1109/mc.2007.216

[2] W. -S. Juang, J. -L. Wu: Two efficient two-factor authenticated key exchange protocols in public wireless LANs, Computers & Electrical Engineering, Vol. 35-1 (2009), pp.33-40.

DOI: 10.1016/j.compeleceng.2008.03.002

[3] G. Yang, D.S. Wong, H. Wang, X. Deng: Two-factor mutual authentication based on smart cards and passwords, Journal of Computer and System Sciences, Vol. 74-7 (2008), pp.1160-1172.

DOI: 10.1016/j.jcss.2008.04.002

[4] M. Steiner, G. Tsudik, M. Waidner: Refinement and extension of encrypted key exchange, ACM Operating System Review, Vol. 29-3 (1995), pp.22-30.

DOI: 10.1145/206826.206834

[5] Y. Ding, P. Horster: Undetectable on-line password guessing attacks, ACM Operating System Review, Vol. 29-4 (1995), pp.77-86.

DOI: 10.1145/219282.219298

[6] J.O. Kwon, I.R. Jeong, D.H. Lee: Three-round smart card-based key exchange scheme, IEICE Trans Commun, Vol. E90-B (2007), pp.3255-3258.

DOI: 10.1093/ietcom/e90-b.11.3255

[7] T. -H. Chen, W. -B. Lee, H. -B. Chen: A round- and computation-efficient three-party authenticated key exchange protocol, The Journal of Systems and Software, Vol. 81-9 (2008), pp.1581-1590.

DOI: 10.1016/j.jss.2007.11.720

[8] M. Abdalla, P. -A. Fouque, D. Pointcheval: Password-based authenticated key exchange in the three-party setting, IEE Proc -Inf Secur, Vol. 153-1 (2006), pp.27-39.

DOI: 10.1049/ip-ifs:20055073

[9] R. Lu, Z. Cao: Simple three-party key exchange protocol, Computers & Security, Vol. 26-1 (2007), pp.94-97.

DOI: 10.1016/j.cose.2006.08.005

[10] P. Kocher, J. Jaffe, B. Jun: Differential power analysis, Proc Crypt (1999), pp.388-97.

[11] T.S. Messerges, E.A. Dabbish, R.H. Sloan: Examining smart-card security under the threat of power analysis attacks, IEEE Trans Comp Vol. 51-5 (2002), pp.541-552.

DOI: 10.1109/tc.2002.1004593

[12] H.S. Rhee, J.O. Kwon, D.H. Lee: A remote user authentication scheme without using smart cards, Computer Standard &Interfaces, Vol. 31-1 (2009), pp.6-13.

DOI: 10.1016/j.csi.2007.11.017

[13] W. -S. Juang, S. -T. Chen, H. -T. Liaw: Robust and efficient password-authenticated key agreement using smart cards, IEEE Trans Indust Electron, Vol. 55-6 (2008), pp.2551-2556.

DOI: 10.1109/tie.2008.921677

[14] RC. -W. Phan, W. -C. Yau, B. -M. Goi: Cryptanalysis of simple three-party key exchange protocol, Information Sciences, Vol. 178 (2008), pp.2849-2856.

DOI: 10.1016/j.ins.2008.02.008