1. Efficient Multi-server Password Authenticated Key Agreement Using Smart Cards Computer and Information Security 92321509 Ming-Hong Shih

2. Source  Wen-Shenq Juang, IEEE Transactions on Consumer Electronics, Vol. 50, No. 1,pp. 251-255, Feb. 2004

3.  we propose a novel user authentication and key agreement scheme using smart cards for multi-server environments with much less computational cost and more functionality.  In this scheme, we assume the registration center can be trusted.

4. major merits  users only need to register at the registration center once and can use permitted services in eligible servers.  the scheme does not need a verification table.  Users can freely choose their passwords.  the computation and communication cost is very low.  servers and users can authenticate each other.  it generates a session key agreed by the user and the server.  it is a nonce-based scheme which does not have a serious time-synchronization problem.

5. Notations  h() : a secure one-way hashing function  E k (m) : the ciphertext of m encrypted using the secret key k of some secure symmetric cryptosystem  D k (c) : the plaintext of c decrypted using the secret key k of the corresponding symmetric cryptosystem  ⊕ : the bitwise exclusive-or operator  RC : the registration center  S j : server j  U i : user i  UID i : a unique identification of U i  SID j : a unique identification of S j  x : the secret key kept secretly by RC  w j = h(x, SID j ) : the secret key shared by S j and RC

6. UiUi RC UID i, PW i v i =h (x, UID i ) μ i =v i ⊕ PW i Smart card (UID i, μ i ) 1. 2.1 2.2 v i,j =h (v i, SID i ) SjSj E wj (v i,j,UID i ) 3.2 3.1 E wj (v i,j,UID i ) Registration Phase

7. Login and Session Key Agreement Phase UiUi N 1, UID i, E v i,j (ru k,h(UID i ||N 1 )) Smart card 1. v i =μ i ⊕ PW i v i,j =h (v i, SID j ) SjSj D w j (E w j (v i,j,UID i )) 用來產生 kth session key sk k 用來確認 U i SjSj D v i,j (E v i,j (ru k,h(UID i ||N 1 ))) v i,j h(UID i ||N 1 ) E wj (v i,j,UID i )

8. UiUi UiUi N 1, UID i, E v i,j (ru k,h(UID i ||N 1 )) Smart card 1. SjSj E v i,j (rs k,N 1 +1,N 2 ) 2. 用來產生 kth session key sk k sk k =h(rs k,ru k,v i,j ) D v i,j (E v i,j (rs k,N 1 +1,N 2 )))

9. UiUi N 1, UID i, E v i,j (ru k,h(UID i ||N 1 )) 1. SjSj E v i,j (rs k,N 1 +1,N 2 ) 2. E sk k (N 2 +1) 3. SjSj D sk k (E sk k (N 2 +1)) UiUi SjSj sk k

10. Shared Key Inquiry Phase UiUi RC UID i, PW i v i =h (x, UID i ) μ i =v i ⊕ PW i Smart card (UID i, μ i ) 1. 2.1 2.2 v i,j =h (v i, SID i ) μ i =v i ⊕ PW i SjSj E wj (v i,j,UID i ) 3.2 3.1 E wj (v i,j,UID i )

11. UiUi N 1, UID i, E v i,j (ru k,h(UID i ||N 1 )) 1. SjSj E v i,j (rs k,N 1 +1,N 2 ) 2. E sk k (N 2 +1) 3. RC N 3, UID i, SID i, E w j (h(UID i ||SID i ||N 3 ) 1.1 RC D w j ( E w j (h(UID i ||SID i ||N 3 )) 用來認證 S j

12. UiUi N 1, UID i, E v i,j (ru k,h(UID i ||N 1 )) 1. SjSj E v i,j (rs k,N 1 +1,N 2 ) 2. E sk k (N 2 +1) 3. RC N 3, UID i, SID i, E w j (h(UID i ||SID i ||N 3 ) 1.1 E w j (v i,j,N 3 +1) 1.2 SjSj D w j (E w j (v i,j,N 3 +1)) v i,j is the share secrete key E wj (v i,j,N 3 +1)

13. SECURITY ANALYSIS  The secret μ i = v i ♁ PW i is stored in U i ’s smart card.  Only the real user U i knows his password PW i can compute the secret v i = μ i ♁ PW i and compute the shared secret v i,j = h(v i, SID j ) between U i and S j.  The replay attacks fail since the freshness of messages in the login and session key agreement phase and that in the shared key inquiry phase are preserved by the nonces N 1, N 2 and N 3.

14.  The session key sk k =h( rs k, ru k, v i,j ) is known to nobody but U i and S j since the random values rs k and ru k are encrypted by the shared secret key v i,j.  A session key sk l =h( rs l, ru l, v i,j ) is no use for computing the other session key sk k =h( rs k, ru k, v i,j ), since without knowing rs k, ru k,v i,j, it is infeasible to compute sk k.

15. Comparisons between this scheme and others ThisLinJuang No verification tableYes Freely chosen passwordYes Communication and computation cost Very LowMedium Very Low Mutual authenticationYesNoYes Session key agreementYesNoYes Single registrationYes No No time synchronization problem YesNoYes