zkPAKE: A Simple Augmented PAKE Protocol
Resumo
Human memory is notoriously unreliable in memorizing long secrets, such as large cryptographic keys. Password-based Authenticated Key Exchange (PAKE) protocols securely establish a cryptographic key based only on the knowledge of a much shorter password. In this work, an augmented PAKE protocol is designed and proposed for secure banking applications, requiring the server to store only the image of the password under a one-way function. The protocol is more efficient than alternatives because it requires fewer public key operations and a lower communication overhead.Referências
Anderson, R. J. (2001). Security Engineering: A Guide to Building Dependable Distributed Systems. John Wiley & Sons, Inc., New York, NY, USA, 1st edition.
Bellovin, S. M. and Merritt, M. (1992). Encrypted Key Exchange: Password-based Protocols Secure Against Dictionary Attacks. In IEEE Computer Society Symposium on Research in Security and Privacy, Oakland, CA, USA, pages 72–84.
Boyd, C. and Mathuria, A. (2003). Protocols for Authentication and Key Establishment. Information Security and Cryptography. Springer.
Chaum, D., Evertse, J., and van de Graaf, J. (1987). An Improved Protocol for Demonstrating Possession of Discrete Logarithms and Some Generalizations. In Advances in Cryptology (EUROCRYPT), Amsterdam, The Netherlands, pages 127–141.
Engler, J., Karlof, C., Shi, E., and Song, D. (2009). Is it too late for PAKE? In Web 2.0 Security and Privacy Workshop (W2SP).
Hankerson, D., Menezes, A. J., and Vanstone, S. (2003). Guide to Elliptic Curve Cryptography. Springer-Verlag, Secaucus, NJ, USA.
Hao, F. and Ryan, P. (2010). J-PAKE: Authenticated Key Exchange without PKI. Transactions on Computational Science, 11:192–206.
Jablon, D. P. (1996). Strong Password-only Authenticated Key Exchange. Computer Communication Review, 26(5):5–26.
Lomas, T. M. A., Gong, L., Saltzer, J. H., and Needham, R. M. (1989). Reducing Risks from Poorly Chosen Keys. In 12th ACM SOSP, pages 14–18.
Perlman, R. J. and Kaufman, C. (1999). Secure Password-Based Protocol for Downloading a Private Key. In Network and Distributed System Security Symposium (NDSS).
Bellovin, S. M. and Merritt, M. (1992). Encrypted Key Exchange: Password-based Protocols Secure Against Dictionary Attacks. In IEEE Computer Society Symposium on Research in Security and Privacy, Oakland, CA, USA, pages 72–84.
Boyd, C. and Mathuria, A. (2003). Protocols for Authentication and Key Establishment. Information Security and Cryptography. Springer.
Chaum, D., Evertse, J., and van de Graaf, J. (1987). An Improved Protocol for Demonstrating Possession of Discrete Logarithms and Some Generalizations. In Advances in Cryptology (EUROCRYPT), Amsterdam, The Netherlands, pages 127–141.
Engler, J., Karlof, C., Shi, E., and Song, D. (2009). Is it too late for PAKE? In Web 2.0 Security and Privacy Workshop (W2SP).
Hankerson, D., Menezes, A. J., and Vanstone, S. (2003). Guide to Elliptic Curve Cryptography. Springer-Verlag, Secaucus, NJ, USA.
Hao, F. and Ryan, P. (2010). J-PAKE: Authenticated Key Exchange without PKI. Transactions on Computational Science, 11:192–206.
Jablon, D. P. (1996). Strong Password-only Authenticated Key Exchange. Computer Communication Review, 26(5):5–26.
Lomas, T. M. A., Gong, L., Saltzer, J. H., and Needham, R. M. (1989). Reducing Risks from Poorly Chosen Keys. In 12th ACM SOSP, pages 14–18.
Perlman, R. J. and Kaufman, C. (1999). Secure Password-Based Protocol for Downloading a Private Key. In Network and Distributed System Security Symposium (NDSS).
Publicado
09/11/2015
Como Citar
MOCHETTI, Karina; RESENDE, Amanda C. Davi; ARANHA, Diego F..
zkPAKE: A Simple Augmented PAKE Protocol. In: SIMPÓSIO BRASILEIRO DE SEGURANÇA DA INFORMAÇÃO E DE SISTEMAS COMPUTACIONAIS (SBSEG), 15. , 2015, Florianópolis.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2015
.
p. 334-337.
DOI: https://doi.org/10.5753/sbseg.2015.20109.
