摘要
研究在认证服务器拥有公私钥对和客户端有容易记忆的弱口令条件下,实现强认证和密钥交换的安全协议。对Wangr的方案进行了安全性分析,发现该协议不能抵抗许多种攻击方式。提出一种在不安全网络上集口令认证、口令更改和密钥建立的方案,通过对新方案与Hwang-Yeh方案、Peyravian-Zunic方案、Peyravian-Jeffries方案和Wang方案进行的安全性对比分析,分析结果表明新口令认证方案具有更高的安全性和实用性。
The protocols for strong authentication and key exchange are studied in asymmetric scenarios where the authentication server possesses a pair of private and public keys while the client has a weak human-memorizable password.Wang＇s password authentication scheme is analyzed in this scenario, and the results show that it is vulnerable to many attacks.A new scheme is proposed for remote user authentication, password change and session key establishment over insecure networks.According to security analysis, the proposal is resistant to known attacks and the most secure scheme among Hwang-Yeh＇s, Peyravian-Zunic＇s, Peyravian-Jeffries＇s, Wang＇s and mine authentication key.Several simple password protocols are analyzed in this scenario, and the results show that under the choice of suitable public key encryption functions the security of these protocols can be formally proven based on stanlord cryptographic assumptions.In particular, our analysis shows optimal resistance to off line password guessing attacks.
出处
《计算机工程与设计》
CSCD
北大核心
2009年第23期5337-5339,5343,共4页
Computer Engineering and Design
基金
国家973重点基础研究发展计划基金项目(TG1999035801)
关键词
口令认证
密钥交换
哈希函数
攻击
认证协议
password authentication
key distribution
Hash function
attack
authentication protocol
