Elliptic Curve Based Password Authenticated Key Exchange Protocols
We investigate password authenticated key exchange (PAKE) protocols in low resource environments, such as smartcards or mobile devices. In such environments, particularly in the future, it may be that the cryptosystems available for signatures and/or encryptions will be based on elliptic curves, because of their well-known advantages with regard to processing and size constraints. As a result, any PAKE protocols which the device requires should also preferably be implemented over elliptic curves. We show that the direct elliptic curve (EC) analogs of some PAKE protocols are insecure against partition attacks. We go on to propose a new EC based PAKE protocol. A modified version of the protocol for highly constrained devices, such as smartcards, is also presented.
KeywordsElliptic Curve Elliptic Curf Discrete Logarithm Quadratic Residue Dictionary Attack
Unable to display preview. Download preview PDF.
- Mihir Bellare and Phillip Rogaway. The AuthA protocol for password-based authenticated key exchange. In Submission to IEEE P1363 study group, 2000.Google Scholar
- S. Bellovin and M. Merritt. Encrypted key exchange: Password based protocol secure against dictionary attackes. In Proceedings of the Symposium on Security and Privacy, pages 72–84. IEEE, 1992.Google Scholar
- S. Patel. Number theoretic attacks on secure password schemes. In Proceedings of the Symposium on Security and Privacy, pages 236–247. IEEE, 1997.Google Scholar
- S. Patel. Information Leakege in Encrypted Key Exchange. In Proceedings of the DIMACS Workshop on Network Threats, 1997.Google Scholar
- V. Miller. Use of elliptic curves in cryptography. In Advances in Cryptology-Crypto 85, pages 417–426. LNCS vol. 218, Springer-Verlag, 1986.Google Scholar
- Wireless Application Protocol-Wireless Transport Layer Security Specification, Wireless Application Forum Ltd, 2000.Google Scholar
- IEEE P1363 Study Group for Future Public-Key Cryptography Standards. http://grouper.ieee.org/groups/1363/StudyGroup.
- Public Key Cryptography for the Financial Services Industry: The Elliptic Curve Digital Signature Algorithm (ECDSA). American National Standard for Financial Services, X9.62, 1998.Google Scholar
- I.F. Blake, G. Seroussi and N.P. Smart. Elliptic Curves in Cryptography. LMS Lecture Note Series 265, CUP, 1999.Google Scholar
- J.H. Silverman. The Arithmetic of Elliptic Curves. Springer-Verlag, GTM 106, 1986.Google Scholar