1. 1 Three-Party Encrypted Key Exchange Without Server Public-Keys C. L. Lin, H. M. Sun, M. Steiner, and T. Hwang IEEE COMMUNICATIONS LETTER, VOL. 5, NO.12, DEC. 2001 Presented by Tung-Her Chen (2002/05/28)

2. 2 Outline Introduction Related Works LSSH-3PEKE Performance Comparison Conclusions

3. 3 Introduction(1/5) 1976 Diffie and Hellman : Key Distribution  public key authentication issue  Men in the middle attack 1992 Bellovin and Merritt : Encrypted Key Exchange (EKE)  A and B securely share a password in advance  Every two clients share a common secret

4. 4 Introdcution(2/5) Password guessing attacks  Detectable on-line password guessing attacks  Undetectable on-line password guessing attacks  Off-line password guessing attacks

5. 5 Introduction (3/5) 1995 Steiner, Tsudik, and Waidner : Three-party EKE( STW-3PEKE)  Trusted server S  Threatened by on-line password guessing attacks  Threatened by off-line password guessing attacks

6. 6 Introduction (4/5) 2000 Lin, Sun, and Hwang : LSH-3PEKE  Server public-key 2001 Lin, Sun, Steiner, and Hwang : LSSH-3PEKE  Without server public-key

7. 7 Introduction (5/5) 1992 EKE (IEEE Symp. On Research in Security and Privacy) 1995 STW-3PEKE (ACM Operating Syst. Rev.) 2000 LSH-3PEKE (ACM Operating Syst. Rev.) 2001 LSSH-3PEKE (IEEE Communications Letters) Every two users share a common secret Password guessing attack Server’s Public Key

8. 8 Related Work -Notations A, B, S, A*, B*, S* P A, P B, K S [M] K, P I, {M} K f K (M), h(M), H 1 (k), H 2 (k) p, g N A, N B, N S, R A = g N A mod p flow i

9. 9 Related Work -STW-3PEKE (1995) AB S P A A, P A P B R A N S, R B N S K = (R A N S ) N B mod p = g N A N B N S mod p K = (R B N S ) N A mod p = g N A N B N S mod p R B N S, [flow1] K [[flow1] K ] K

10. 10 Related Work (1995) -STW-3PEKE Weakness(1) AB S P A A, P A P B R A N S, R’ A N S P’ A,R’ A, set R B =R’ A Check whether R A N S = R’ A N S P’ A = P A Undetectable On-Line Guessing Attacks

11. 11 Related Work (2000) -STW-3PEKE Weakness(2) A*B S* X A, X P B R’ A N’ S, Y K = (R’ A N’ S ) N B mod p = g N’ A N B N’ S mod p P’ B => R’ B => K’ = (R’ B N’ S ) N’ A Decrypt [flow1] K by K’ and check whether flow1 = X Y, [flow1] K R’ A = g N’ A Off-Line Guessing Attack

12. 12 Related Work (2000) -LSH-3PEKE AB S A, {r a, R A, P A } K S [B, R B ] r a [A, R A ] r b K = (R A ) N B mod p = g N A N B mod p K = (R B ) N A mod p = g N A N B mod p [B,R B ] r a, [h(flow1), C B ] K CBCB A {r a,R A,P A } K S {r b,R B,P B } K S

13. 13 LSSH-3PEKE (2001) A B S (2) P A P B (1)A, B (3)A, R A, f K A,S (A, B, g N S1 ), P B K A,S = (g N s1 ) N A mod p K B,S = (g N s2 ) N B mod p (4) R A, f KA,S (A, B, g N S1 ) R B, f K B,S (A, B, g N S2 ) (5) f KB,S (A, B, R A, R B ) f K A,S (A, B, R A, R B ) (6) R B, f K A,S (A, B, R B, R A ), f K’ (A, B, R A ) (7) f K’ (A, B, R B ) K = H 1 (R B NA (mod p)) K’ = H 2 (R B NA (mod p)) K = H 1 (R A NB (mod p)) K’ = H 2 (R A NB (mod p))

14. 14 Performance analysis LSH-3PEKELSSH- 3PEKE Steps57 ABSABS Modular exponentiation2(7) 0(6)334 Public-key en/decryption1/0 0/2000 Symmetric en(de)cryption222112 MAC000334 Random numbers230112

15. 15 Conclusions LSSH-3PEKE scheme  Both one-line and off-line guessing attack will not work  Perfect forward secrecy  Without Server public-Keys

16. 16 Comments More complex; more insecurity. Public key techniques are unavoidable for password protocols that resist off-line guessing attack.(1999) You can try it…