An Attack on the Zhou-Fan-Li Authenticated Multiple-Key Agreement Protocol

Sheng Zhong

DOI: https://doi.org/10.1080/01611190701548180

2007-01-01

Cryptologia

Abstract:Recently, an improved protocol for authenticated multiple-key agreement was proposed. In this article, an attack on that protocol is shown in which, with half probability, an adversary can impersonate any participant of the protocol to generate "shared" keys with others.

What problem does this paper attempt to address?

An improved certificateless authenticated key agreement protocol

Haomin Yang,Yaoxue Zhang,Yuezhi Zhou

DOI: https://doi.org/10.1109/ICCT.2012.6511182

2017-01-01

Abstract:Recently, Mokhtarnameh, Ho, Muthuvelu proposed a certificateless key agreement protocol. In this paper, we show that their protocol is unsecured against a man-in-the-middle attack. In addition, the authors claimed that their scheme provides a binding long-term public key with a corresponding partial private key. In fact, their protocol does not achieve the binding. We propose an improved key agreement protocol based on the protocol proposed by Mokhtarnameh et al. The improved protocol can resist the man-in-the-middle attack as well as satisfy the desired security properties for key agreement. It truly achieves the one-to-one correspondence between the long-term public key and the partial private key of a user. Compared with the other related protocols, the protocol has advantages in both security and computational efficiency.
An Improved Authenticated Key Agreement Protocol

Wang Changji,Yang Bo,Wu Jianping

DOI: https://doi.org/10.1007/s11767-005-0007-z

2005-01-01

Abstract:In 1999, Seo and Sweeney proposed a simple authenticated key agreement protocol that was designed to act as a Diffie-Hellman key agreement protocol with user authentication. Various attacks on this protocol are described and enhanced in the literature. Recently, Ku and Wang proposed an improved authenticated key agreement protocol, where they asserted the protocol could withstand the existing attacks. This paper shows that Ku and Wang’s protocol is still vulnerable to the modification attack and presents an improved authenticated key agreement protocol to enhance the security of Ku and Wang’s protocol. The protocol has more efficient performance by replacing exponentiation operations with message authentication code operations.
Security Analysis of Shim's Authenticated Key Agreement Protocols from Pairings

Hung-Min Sun,Bin-Tsan Hsieh

2003-01-01

Abstract:Recently, Shim proposed a tripartite authenticated key agreement pro- tocol from Weil pairing to overcome the security flaw in Joux's protocol. Later, Shim also proposed an ID-based authenticated key agreement pro- tocol which is an improvement of Smart's protocol in order to provide the forward secrecy. In this paper, we show that these two protocols are insecure against the key-compromise impersonation attack and the man- in-the-middle attack respectively.
The Saeed-Liu-Tian-Gao-Li authenticated key agreement protocol is insecure

Chris J Mitchell

DOI: https://doi.org/10.48550/arXiv.1906.09330

2019-06-22

Abstract:A recently proposed authenticated key agreement protocol is shown to be insecure. In particular, one of the two parties is not authenticated, allowing an active man in the middle opponent to replay old messages. The protocol is essentially an authenticated Diffie-Hellman key agreement scheme, and the lack of authentication allows an attacker to replay old messages and have them accepted. Moreover, if the ephemeral key used to compute a protocol message is ever compromised, then the key established using the replayed message will also be compromised. Fixing the problem is simple - there are many provably secure and standardised protocols which are just as efficient as the flawed scheme.

Cryptography and Security
Cryptanalysis and Improvement of a Biometrics-Based Authentication and Key Agreement Scheme for Multi-Server Environments

Li Yang,Zhiming Zheng

DOI: https://doi.org/10.1371/journal.pone.0194093

IF: 3.7

2018-01-01

PLoS ONE

Abstract:According to advancements in the wireless technologies, study of biometrics-based multi-server authenticated key agreement schemes has acquired a lot of momentum. Recently, Wang et al. presented a three-factor authentication protocol with key agreement and claimed that their scheme was resistant to several prominent attacks. Unfortunately, this paper indicates that their protocol is still vulnerable to the user impersonation attack, privileged insider attack and server spoofing attack. Furthermore, their protocol cannot provide the perfect forward secrecy. As a remedy of these aforementioned problems, we propose a biometrics-based authentication and key agreement scheme for multi-server environments. Compared with various related schemes, our protocol achieves the stronger security and provides more functionality properties. Besides, the proposed protocol shows the satisfactory performances in respect of storage requirement, communication overhead and computational cost. Thus, our protocol is suitable for expert systems and other multi-server architectures. Consequently, the proposed protocol is more appropriate in the distributed networks.
Password-based Authenticated Key Agreement Scheme with Mutual Anonymity for Trusted Computation

ZHU Chang-sheng,LIU Peng-hui,WANG Qing-rong,CAO Lai-cheng

DOI: https://doi.org/10.3724/sp.j.1087.2011.01862

2011-01-01

Journal of Computer Applications

Abstract:How to keep mutual anonymity between two entities is one of the critical issues for Trusted Computation(TC).According to the characteristics of TC,an efficient password-based authenticated key exchange scheme was proposed.Adopting threshold cryptography and fuzzy ID set,the scheme achieved mutual anonymity between user and server sharing ID set.On the premise of secure hashing,the analysis and the proving procedure based on the Random Oracle Model(ROM) show this scheme is secure against dictionary attack and resource-depletion DoS(Denial-of-Service) attack under the computational Diffie-Hellman intractability assumption.This scheme effectively preserves the user's privacy and server's privacy,and compared with other schemes such as VIET et al.'s scheme,it is more efficient.
Provably secure and efficient certificateless authenticated tripartite key agreement protocol.

Hu Xiong,Zhong Chen,Fagen Li

DOI: https://doi.org/10.1016/j.mcm.2011.10.001

2012-01-01

Mathematical and Computer Modelling

Abstract:Authenticated key agreement (AKA) protocols are multi-party protocols in which entities exchange public information allowing them to create a common secret key that is known only to those entities over an open network. Recently, in order to circumvent the key escrow problem inherent to ID-based cryptography and the certificate management burden in traditional public key infrastructure, the notion of certificateless public key cryptography (CL-PKC) was introduced. In this paper, we first present a security model for certificateless AKA protocols for three parties, and then propose an efficient construction based on bilinear pairings. The security of the proposed scheme can be proved to be equivalent to the computational Diffie–Hellman problem in the random oracle model.
New identity-based three-party authenticated key agreement protocol with provable security

Hu Xiong,Zhong Chen,Fagen Li

DOI: https://doi.org/10.1016/j.jnca.2012.10.001

IF: 7.574

2013-01-01

Journal of Network and Computer Applications

Abstract:Key agreement allows multi-parties exchanging public information to create a common secret key that is known only to those entities over an insecure network. In the recent years, several identity-based (ID-based) authenticated key agreement protocols have been proposed and most of them broken. In this paper, we formalize the security model of ID-based authenticated tripartite key agreement protocol and propose a provably secure ID-based authenticated key agreement protocol for three parties with formal security proof under the computational Diffie-Hellman assumption. Experimental results by using the AVISPA tool show that the proposed protocol is secure against various malicious attacks.
Collusive Attacks to "Circle-Type" Multi-party Quantum Key Agreement Protocols

Bin Liu,Di Xiao,Heng-Yue Jia

DOI: https://doi.org/10.48550/arXiv.1602.00393

2016-02-01

Abstract:We find that existing multi-party quantum key agreement (MQKA) protocols designed for fairness of the key are, in fact, unfair. Our analysis shows that these protocols are sensitive to collusive attacks; that is, dishonest participants can collaborate to predetermine the key without being detected. In fact, the transmission structures of the quantum particles in those unfair MQKA protocols, three of which have already been analyzed, have much in common. We call these unfair MQKA protocols circle-type MQKA protocols. Likewise, the transmission structures of the quantum particles in MQKA protocols that can resist collusive attacks are also similar. We call such protocols complete-graph-type MQKA protocols. A MQKA protocol also exists that can resist the above attacks but is still not fair, and we call it the tree-type MQKA protocol. We first point out a common, easily missed loophole that severely compromises the fairness of present circle-type MQKA protocols. Then we show that two dishonest participants at special positions can totally predetermine the key generated by circle-type MQKA protocols. We anticipate that our observations will contribute to secure and fair MQKA protocols, especially circle-type protocols.

Quantum Physics
Designing Secure Quantum Key Agreement Protocols Against Dishonest Participants

Wei-cong Huang,Yong-kai Yang,Dong Jiang,Chao-hui Gao,Li-jun Chen

DOI: https://doi.org/10.1007/s10773-019-04275-5

2019-01-01

International Journal of Theoretical Physics

Abstract:Quantum key agreement (QKA) aims to negotiate a secure and consistent key among several participants. In this paper, we find that a type of QKA protocol is not secure when a participant is dishonest. He can make the honest participants obtain wrong final keys, which may lead to serious consequences. To resist such attacks, we design a defense strategy by introducing a trusted third party. The theoretical analysis results show that our defense strategy not only can detect the dishonest participant’s attacks, but also can identify who is dishonest. Finally we design an optical platform for participants, and show that both our attack and defense strategies are feasible with current technologies.
Yet Another Certificateless Three-Party Authenticated Key Agreement Protocol

Jianbin Hu,Hu Xiong,Zhi Guan,Cong Tang,Yonggang Wang,Wei Xin,Zhong Chen

DOI: https://doi.org/10.1109/ISPAW.2011.15

2011-01-01

Abstract:Key agreement protocols are multi-party protocols in which entities exchange public information allowing them to create a common secret key that is known only to those entities and which cannot be predetermined by any party. Recently, the notion of certificateless public key cryptography was introduced to mitigate the heavy certificate management burden in traditional public key infrastructure and key escrow problem in ID-based cryptosystem. In this paper, we present an efficient certificateless three-party authenticated key agreement protocol based on certificateless signature scheme. We show that the proposed protocol is secure (i.e. conforms to defined security attributes) while being efficient.
Attacks on the (enhanced) Yang-Shieh Authentication

KF Chen,S Zhong

DOI: https://doi.org/10.1016/s0167-4048(03)00012-9

IF: 5.105

2003-01-01

Computers & Security

Abstract:The Yang-Shieh authentication is a time-stamp based password authentication scheme that uses smart cards [1]. In [2,3], various attacks on this scheme are described. However, an enhancement of the scheme is proposed in [3] and enables the scheme to resist these existing attacks. In this paper, we show two new attack that can break the enhanced scheme. We further point out that the fundamental computational assumption of the Yang-Shieh authentication scheme is incorrect.
Double C-NOT Attack on a Single-State Semi-Quantum Key Distribution Protocol and Its Improvement

Jun Gu,Tzonelih Hwang

DOI: https://doi.org/10.3390/electronics11162522

IF: 2.9

2022-08-13

Electronics

Abstract:Recently, Zhang et al. proposed a single-state semi-quantum key distribution protocol to help a quantum participant share a secret key with a classical participant. However, this study shows that an eavesdropper can use a double C-NOT attack to obtain parts of the final shared key without being detected by the participants. To avoid this problem, a modification is proposed here.

engineering, electrical & electronic,computer science, information systems,physics, applied
Cryptanalysis on Four Two-Party Authentication Protocols

Yalin Chen,Jue-Sam Chou*,Chun-Hui Huang

DOI: https://doi.org/10.48550/arXiv.1007.0060

2010-07-01

Abstract:In this paper, we analyze four authentication protocols of Bindu et al., Goriparthi et al., Wang et al. and Hölbl et al.. After investigation, we reveal several weaknesses of these schemes. First, Bindu et al.'s protocol suffers from an insider impersonation attack if a malicious user obtains a lost smart card. Second, both Goriparthi et al.'s and Wang et al.'s protocols cannot withstand a DoS attack in the password change phase, i.e. an attacker can involve the phase to make user's password never be used in subsequent authentications. Third, Hölbl et al.'s protocol is vulnerable to an insider attack since a legal but malevolent user can deduce KGC's secret key.

Cryptography and Security
Authenticated multi-party quantum key agreement protocol based on cluster states

Li Zhang,Zhaowei Han,Yuehua Li,Qiuyu Ma,Lele Li

DOI: https://doi.org/10.1088/1555-6611/ad6d52

IF: 1.2

2024-08-24

Laser Physics

Abstract:Quantum key agreement (QKA) is an important cryptographic primitive that plays a pivotal role in private communications. Authenticated QKA plays an important role in QKA. In this paper, we propose an authenticated multiparty QKA scheme based on 4-qubit cluster states entanglement swapping. The scheme is divided into two parts, the first part is the quantum identity authentication stage, and the second part is the QKA stage. In the quantum identity authentication stage, the participants determine that the participant communicating with them is the claimed person through mutual authentication, which can avoid the impersonation attack of the eavesdropper Eve. In the QKA phase, the participants adopt a bidirectional transmission structure with the participation of a semi-trusted third party, and based on the entanglement swapping property of the 4-qubit cluster state, the QKA is finally realized. Detailed security analysis shows that the protocol can resist a variety of internal and external attacks, such as participants attack, entangle-measure attack, and so on.

optics,physics, applied
Secure Key Agreement Protocols for Three-Party Against Guessing Attacks

HM Sun,BC Chen,T Hwang

DOI: https://doi.org/10.1016/j.jss.2003.11.017

IF: 3.5

2004-01-01

Journal of Systems and Software

Abstract:Key exchange protocol is important for sending secret messages using the session key between two parties. In order to reach the objective, the premise is to generate a session key securely. Encryption key exchange was first proposed to generate a session key with a weak authenticated password against guessing attacks. Next, another authenticated key exchange protocols for three-party, two clients who request the session key and one server who authenticates the user's identity and assist in generating a session key, were proposed. In this paper, we focus on the three-party authenticated key exchange protocol. In addition to analyzing and improving a password-based authenticated key exchange protocol, a new verified-based protocol is also proposed.
Provably Secure Three-Party Password-Authenticated Key Exchange

CL Lin,HA Wen,T Hwang,HM Sun

2004-01-01

IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences

Abstract:We will propose a key-agreement-type three-party password-authenticated key exchange protocol. The proposed protocol is quite efficient and, among the same type of protocols, is the first to be formally proven to be secure. A three-party formal model for security proof is proposed based on [25] and [26]. We construct a simulator in this model to show that our proposed protocol is secure under reasonable and well-defined cryptographic primitives.
Finding and Fixing Vulnerabilities in Several Three-Party Password Authenticated Key Exchange Protocols Without Server Public Keys.

Hu Xiong,Yanan Chen,Zhi Guan,Zhong Chen

DOI: https://doi.org/10.1016/j.ins.2013.02.004

IF: 8.1

2013-01-01

Information Sciences

Abstract:Three-party password-based authenticated key exchange (3PAKE) protocols allow two users (clients) to establish a session key with the support from an authenticated server over an insecure channel. Several 3PAKE protocols, which do not require server public keys, have been proposed recently. In this paper, we use Chang et al.’s protocol as a case study and demonstrate that all of the 3PAKE protocols without server public keys are not secure against Key Compromise Impersonation (KCI) attack. A detailed analysis of flaw in these protocols has been conducted and we hope that by identifying this design flaw, similar structural mistakes can be avoided in future designs. Furthermore, we propose an improved protocol that remedies the weakness of these protocols and prove its security in a widely accepted model.
On the lightweight authenticated semi-quantum key distribution protocol without Trojan horse attack

Jun Gu,Tzonelih Hwang

DOI: https://doi.org/10.48550/arXiv.2010.10236

2020-10-20

Quantum Physics

Abstract:Recently, Tsai et al. (Laser Phys. Lett. 17, 075202, 2020) proposed a lightweight authenticated semi-quantum key distribution protocol for a quantum participant to share a secret key with a classical participant. However, this study points out that an attacker can use a modification attack to make both participants share a wrong key without being detected. To avoid this problem, an improvement is proposed here.
Security Analysis of Yang et al.'s Practical Password-Based Two-Server Authentication and Key Exchange System

Xun Yi

DOI: https://doi.org/10.1109/nss.2010.97

2010-09-01

Abstract:Typical protocols for password-based authentication assumes a single server which stores all the passwords necessary to authenticate users. If the server is compromised, user passwords are disclosed. To address this issue, Yang et al. proposed a practical password-based two-server authentication and key exchange protocol, where a front-end server, keeping one share of a password, and a back-end server, holding another share of the password, cooperate in authenticating a user and, meanwhile, establishing a secret key with the user. In this paper, we present two “half-online and half-offline” attacks to Yang et al.'s protocol. By these attacks, user passwords can be determined once the back-end server is compromised. Therefore, Yang et al.'s protocol has no essential difference from a password-based single-server authentication protocol.

An Attack on the Zhou-Fan-Li Authenticated Multiple-Key Agreement Protocol

An improved certificateless authenticated key agreement protocol

An Improved Authenticated Key Agreement Protocol

Security Analysis of Shim's Authenticated Key Agreement Protocols from Pairings

The Saeed-Liu-Tian-Gao-Li authenticated key agreement protocol is insecure

Cryptanalysis and Improvement of a Biometrics-Based Authentication and Key Agreement Scheme for Multi-Server Environments

Password-based Authenticated Key Agreement Scheme with Mutual Anonymity for Trusted Computation

Provably secure and efficient certificateless authenticated tripartite key agreement protocol.

New identity-based three-party authenticated key agreement protocol with provable security

Collusive Attacks to "Circle-Type" Multi-party Quantum Key Agreement Protocols

Designing Secure Quantum Key Agreement Protocols Against Dishonest Participants

Yet Another Certificateless Three-Party Authenticated Key Agreement Protocol

Attacks on the (enhanced) Yang-Shieh Authentication

Double C-NOT Attack on a Single-State Semi-Quantum Key Distribution Protocol and Its Improvement

Cryptanalysis on Four Two-Party Authentication Protocols

Authenticated multi-party quantum key agreement protocol based on cluster states

Secure Key Agreement Protocols for Three-Party Against Guessing Attacks

Provably Secure Three-Party Password-Authenticated Key Exchange

Finding and Fixing Vulnerabilities in Several Three-Party Password Authenticated Key Exchange Protocols Without Server Public Keys.

On the lightweight authenticated semi-quantum key distribution protocol without Trojan horse attack

Security Analysis of Yang et al.'s Practical Password-Based Two-Server Authentication and Key Exchange System