Threshold Anonymous Password-Authenticated Key Exchange Secure against Insider Attacks
Threshold Anonymous Password-Authenticated Key Exchange Secure against Insider Attacks
复制标题
DOI：
10.1587/transinf.e94.d.2095
复制
发表时间：
2011-11
期刊：
影响因子：
--
通讯作者：
Seonghan Shin;K. Kobara;H. Imai
中科院分区：
文献类型：
--
作者：
Seonghan Shin;K. Kobara;H. Imai
设计了一个匿名的密码认证密钥交换（PAKE）协议，以提供仅密码认证和客户端匿名对抗半诚实服务器，谁诚实地遵循该协议。在2008年的INDOWITCH PT中，Yang和Zhang [26]提出了一种新的匿名PAKE（NAPAKE）协议及其阈值（D-NAPAKE），他们声称可以防止内部攻击。在本文中，我们首先证明了D-NAPAKE协议[26]对于内部攻击是完全不安全的，这与他们的声明不同。具体来说，只有一个合法的客户端可以自由地向服务器模拟任何客户端子组（阈值t>1）。在给出了一个捕获内部攻击的安全模型后，我们提出了一个门限匿名PAKE协议（TAP++），它提供了对内部攻击的安全性。此外，我们证明了TAP++协议具有语义安全的会话密钥对主动攻击以及内部攻击下的计算Diffie-Hellman问题，并提供客户端匿名对一个半诚实的服务器，谁诚实地遵循协议。最后，我们还讨论了以下几个问题：1）通过将我们的RATIONALE应用于非阈值匿名PAKE（VEAP）协议，我们还给出了另一个阈值匿名PAKE协议[23]; 2）我们给出了TAP++协议的效率比较，安全性考虑和实现问题。
An anonymous password-authenticated key exchange (PAKE) protocol is designed to provide both password-only authentication and client anonymity against a semi-honest server, who honestly follows the protocol. In INDOCRYPT2008, Yang and Zhang [26] proposed a new anonymous PAKE (NAPAKE) protocol and its threshold (D-NAPAKE) which they claimed to be secure against insider attacks. In this paper, we first show that the D-NAPAKE protocol [26]is completely insecure against insider attacks unlike their claim. Specifically, only one legitimate client can freely impersonate any subgroup of clients (the threshold t>1) to the server. After giving a security model that captures insider attacks, we propose a threshold anonymous PAKE (called, TAP++) protocol which provides security against insider attacks. Moreover, we prove that the TAP++ protocol has semantic security of session keys against active attacks as well as insider attacks under the computational Diffie-Hellman problem, and provides client anonymity against a semi-honest server, who honestly follows the protocol. Finally, several discussions are followed: 1) We also show another threshold anonymous PAKE protocol by applying our RATIONALE to the non-threshold anonymous PAKE (VEAP) protocol [23]; and 2) We give the efficiency comparison, security consideration and implementation issue of the TAP++ protocol.