Cryptanalysis of an improved client-to-client Password-Authenticated Key Exchange (C2C-PAKE) scheme

Raphael C.W. Phan; Bok Min Goi

doi:10.1007/11496137_3

Cryptanalysis of an improved client-to-client Password-Authenticated Key Exchange (C2C-PAKE) scheme

Raphael C.W. Phan, Bok Min Goi

Research output: Chapter in Book/Report/Conference proceeding › Conference Paper › Research › peer-review

37 Citations (Scopus)

Abstract

Password-Authenticated Key Establishment (PAKE) protocols allow two parties, to share common secret keys in an authentic manner based on an easily memorizable password. At ICCSA 2004, an improved PAKE protocol between two clients of different realms was proposed that was claimed to be secure against attacks including the replay attack. In this paper, we cryptanalyze this protocol by showing two replay attacks that allow an attacker to falsely share a secret key with a legal client.

Original language	English
Title of host publication	Third International Conference on Applied Cryptography and Network Security, ACNS 2005
Pages	33-39
Number of pages	7
Volume	3531
DOIs	https://doi.org/10.1007/11496137_3
Publication status	Published - 2005
Externally published	Yes
Event	International Conference on Applied Cryptography and Network Security 2005 - New York, United States of America Duration: 7 Jun 2005 → 10 Jun 2005 Conference number: 3rd https://link.springer.com/book/10.1007/b137093 (Proceedings)

Publication series

Name	Lecture Notes in Computer Science
ISSN (Print)	0302-9743

Conference

Conference	International Conference on Applied Cryptography and Network Security 2005
Abbreviated title	ACNS 2005
Country/Territory	United States of America
City	New York
Period	7/06/05 → 10/06/05
Internet address	https://link.springer.com/book/10.1007/b137093 (Proceedings)

Keywords

Client-to-client
Cryptanalysis
Password-authenticated key exchange
Replay attack
Unknown key-share

Access to Document

10.1007/11496137_3

Cite this

@inproceedings{66ef674a5df542f3a50dc4f0180453ce,

title = "Cryptanalysis of an improved client-to-client Password-Authenticated Key Exchange (C2C-PAKE) scheme",

abstract = "Password-Authenticated Key Establishment (PAKE) protocols allow two parties, to share common secret keys in an authentic manner based on an easily memorizable password. At ICCSA 2004, an improved PAKE protocol between two clients of different realms was proposed that was claimed to be secure against attacks including the replay attack. In this paper, we cryptanalyze this protocol by showing two replay attacks that allow an attacker to falsely share a secret key with a legal client.",

keywords = "Client-to-client, Cryptanalysis, Password-authenticated key exchange, Replay attack, Unknown key-share",

author = "Phan, {Raphael C.W.} and Goi, {Bok Min}",

note = "Copyright: Copyright 2020 Elsevier B.V., All rights reserved.; International Conference on Applied Cryptography and Network Security 2005, ACNS 2005 ; Conference date: 07-06-2005 Through 10-06-2005",

year = "2005",

doi = "10.1007/11496137_3",

language = "English",

volume = "3531",

series = "Lecture Notes in Computer Science",

pages = "33--39",

booktitle = "Third International Conference on Applied Cryptography and Network Security, ACNS 2005",

url = "https://link.springer.com/book/10.1007/b137093",

}

Phan, RCW & Goi, BM 2005, Cryptanalysis of an improved client-to-client Password-Authenticated Key Exchange (C2C-PAKE) scheme. in Third International Conference on Applied Cryptography and Network Security, ACNS 2005. vol. 3531, Lecture Notes in Computer Science, pp. 33-39, International Conference on Applied Cryptography and Network Security 2005, New York, New York, United States of America, 7/06/05. https://doi.org/10.1007/11496137_3

Cryptanalysis of an improved client-to-client Password-Authenticated Key Exchange (C2C-PAKE) scheme. / Phan, Raphael C.W.; Goi, Bok Min.
Third International Conference on Applied Cryptography and Network Security, ACNS 2005. Vol. 3531 2005. p. 33-39 (Lecture Notes in Computer Science).

Research output: Chapter in Book/Report/Conference proceeding › Conference Paper › Research › peer-review

TY - GEN

T1 - Cryptanalysis of an improved client-to-client Password-Authenticated Key Exchange (C2C-PAKE) scheme

AU - Phan, Raphael C.W.

AU - Goi, Bok Min

N1 - Conference code: 3rd

PY - 2005

Y1 - 2005

N2 - Password-Authenticated Key Establishment (PAKE) protocols allow two parties, to share common secret keys in an authentic manner based on an easily memorizable password. At ICCSA 2004, an improved PAKE protocol between two clients of different realms was proposed that was claimed to be secure against attacks including the replay attack. In this paper, we cryptanalyze this protocol by showing two replay attacks that allow an attacker to falsely share a secret key with a legal client.

AB - Password-Authenticated Key Establishment (PAKE) protocols allow two parties, to share common secret keys in an authentic manner based on an easily memorizable password. At ICCSA 2004, an improved PAKE protocol between two clients of different realms was proposed that was claimed to be secure against attacks including the replay attack. In this paper, we cryptanalyze this protocol by showing two replay attacks that allow an attacker to falsely share a secret key with a legal client.

KW - Client-to-client

KW - Cryptanalysis

KW - Password-authenticated key exchange

KW - Replay attack

KW - Unknown key-share

UR - http://www.scopus.com/inward/record.url?scp=26444613363&partnerID=8YFLogxK

U2 - 10.1007/11496137_3

DO - 10.1007/11496137_3

M3 - Conference Paper

AN - SCOPUS:26444613363

VL - 3531

T3 - Lecture Notes in Computer Science

SP - 33

EP - 39

BT - Third International Conference on Applied Cryptography and Network Security, ACNS 2005

T2 - International Conference on Applied Cryptography and Network Security 2005

Y2 - 7 June 2005 through 10 June 2005

ER -

Cryptanalysis of an improved client-to-client Password-Authenticated Key Exchange (C2C-PAKE) scheme

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Cite this