1. Enhancing Security of a Group Key Exchange Protocol for Users with Individual Passwords
- Author
-
Minkyu Park, Sangchul Han, Junghyun Nam, Juryon Paik, and Ung-Mo Kim
- Subjects
Password ,Password policy ,Encrypted key exchange ,Zero-knowledge password proof ,Dictionary attack ,Cognitive password ,computer.internet_protocol ,business.industry ,Salt (cryptography) ,Computer science ,Internet privacy ,Computer security ,computer.software_genre ,One-time password ,S/KEY ,Password strength ,Authentication protocol ,Key stretching ,Session key ,Password authentication protocol ,Key derivation function ,Challenge–response authentication ,Reflection attack ,business ,computer - Abstract
Group key exchange protocols allow a group of parties communicating over a public network to come up with a common secret key called a session key . Due to their critical role in building secure multicast channels, a number of group key exchange protocols have been suggested over the years for a variety of settings. Among these is the so-called EKE-M protocol proposed by Byun and Lee for password-based group key exchange in the different password authentication model , where group members are assumed to hold an individual password rather than a common password. While the announcement of the EKE-M protocol was essential in the light of the practical significance of the different password authentication model, Tang and Chen showed that the EKE-M protocol itself suffers from an undetectable on-line dictionary attack. Given Tang and Chen's attack, Byun et al. have recently suggested a modification to the EKE-M protocol and claimed that their modification makes EKE-M resistant to the attack. However, the claim turned out to be untrue. In the current paper, we demonstrate this by showing that Byun et al.'s modified EKE-M is still vulnerable to an undetectable on-line dictionary attack. Besides reporting our attack, we also figure out what has gone wrong with Byun et al.'s modification and how to fix it.
- Published
- 2009
- Full Text
- View/download PDF