Back to Search
Start Over
A Method for Making Three-Party Password-Based Key Exchange Resilient to Server Compromise
- Source :
- IIH-MSP
- Publication Year :
- 2007
- Publisher :
- IEEE, 2007.
-
Abstract
- This paper presents a new password authentication and key-exchange protocol suitable for three-party without a server public key and exchanging keys over an untrusted network. The new protocol resists dictionary attacks mounted by either passive or active network intruders, allowing, in principle, even weak password phrases to be used safely. It also offers perfect forward secrecy, which protects past sessions and passwords against future compromises. Finally, user passwords are stored in a form that is not plaintext-equivalent to the password itself, so an attacker who captures the password database cannot use it directly to compromise security and gain immediate access to the host. Furthermore, the authentication server can't get any information for the session key between the two users and the mutual authentication will carry through between the server and the two users. The proposed protocol's security, simplicity, and speed make it ideal for a wide range of real-world applications in which secure password authentication is required.
- Subjects :
- Password
Password policy
Zero-knowledge password proof
Computer science
business.industry
Password cracking
Computer security
computer.software_genre
One-time password
S/KEY
Password strength
ComputingMilieux_MANAGEMENTOFCOMPUTINGANDINFORMATIONSYSTEMS
Challenge–response authentication
business
computer
Computer network
Subjects
Details
- Database :
- OpenAIRE
- Journal :
- Third International Conference on Intelligent Information Hiding and Multimedia Signal Processing (IIH-MSP 2007)
- Accession number :
- edsair.doi...........8aed586c95925fb0dafd53f241e71102