改进的三方口令验证元认证密钥交换协议

在三方口令认证密钥交换（三方PAKE）协议中，每个用户仅仅需要和服务器共享一个口令，就可以在服务器的协助下与他人进行安全的密钥交换.由于有效地减少了用户管理口令的负担，三方PAKE协议在大规模用户集的安全通信中受到了较多关注.然而，已有的三方PAKE协议大多关注的是服务器利用明文存储用户口令的情形，没有考虑服务器口令文件泄露所造成的巨大威胁.在服务器端存放的是相应于用户口令的验证元的情形下，研究三方PAKE协议的分析和设计.首先分析了一个最近提出的基于验证元的三方PAKE协议，指出该协议易于遭受离线字典攻击，因此未能达到所宣称的安全性；其次，在分析已有协议设计缺陷的基础上，提出了一个新的基于验证元的三方PAKE协议，并在标准模型下证明了所设计的协议的安全性，与已有协议的比较表明，新提出的协议在提供了更高安全性的同时具有可接受的计算和通信效率.

Improved Verifier-based Three-party Password-authenticated Key Exchange Protocol

With the aid of three-party password-authenticated key exchange (3PAKE) protocol, two users, each of which shares a low-entropy password with the trusted server, could agree on a common session key securely. Since 3PAKE protocols reduce the burden of password management dramatically when the total number of users is very large, they have attracted much attention recently. However, most of the existing 3PAKE protocols are designed in the scenario where a user stores her/his plain password in the password file of the server, henceforth no protection would be provided once the password file is leaked. This study investigates the analysis and design of verifier-based 3PAKE protocols, where the server holds a verifier of a password other than the plain password. Firstly, it is shown that a recently proposed verifier-based 3PAKE protocol is not secure, which is vulnerable to off-line dictionary attack. Then, aiming to overcome the existed deficits, a new verifier-based 3APKE protocol is proposed and its security is proved in the standard model. Comparisons show that the proposed new scheme takes the advantage of security as well as enjoys practical efficiency.