In this paper, we study Password Authenticated Key Exchange (PAKE) in a group. First, we present a generic "fairy-ring dance" construction that transforms any secure two-party PAKE scheme to a group PAKE protocol while preserving the round efficiency in the optimal way. Based on this generic construction, we present two concrete instantiations based on using SPEKE and J-PAKE as the underlying PAKE primitives respectively. The first protocol, called SPEKE+, accomplishes authenticated key exchange in a group with explicit key confirmation in just two rounds. This is more round-efficient than any existing group PAKE protocols in the literature. The second protocol, called J-PAKE+, requires one more round than SPEKE+, but is computationally faster. Finally, we present full implementations of SPEKE+ and J-PAKE+ with detailed performance measurements. Our experiments suggest that both protocols are feasible for practical applications in which the group size may vary from three to several dozen. This makes them useful, as we believe, for a wide range of applications - e.g., to bootstrap secure communication among a group of smart devices in the Internet of Things (IoT).
In this paper, we study Password Authenticated Key Exchange (PAKE) in a group. First, we present a generic "fairy-ring dance" construction that transforms any secure two-party PAKE scheme to a group PAKE protocol while preserving the round efficiency in the optimal way. Based on this generic construction, we present two concrete instantiations based on using SPEKE and J-PAKE as the underlying PAKE primitives respectively. The first protocol, called SPEKE+, accomplishes authenticated key exchange in a group with explicit key confirmation in just two rounds. This is more round-efficient than any existing group PAKE protocols in the literature. The second protocol, called J-PAKE+, requires one more round than SPEKE+, but is computationally faster. Finally, we present full implementations of SPEKE+ and J-PAKE+ with detailed performance measurements. Our experiments suggest that both protocols are feasible for practical applications in which the group size may vary from three to several dozen. This makes them useful, as we believe, for a wide range of applications - e.g., to bootstrap secure communication among a group of smart devices in the Internet of Things (IoT).
Password-based authenticated key exchange (PAKE) allows participants sharing low-entropy passwords to agree on cryptographically strong session keys over insecure networks. In this paper, we present two PAKE protocols from lattices in the two-party and three-party settings, respectively, which can resist quantum attacks and achieve mutual authentication. The protocols in this paper achieve two rounds of communication by carefully utilizing the splittable properties of the underlying primitive, a CCA (Chosen-Ciphertext Attack)-secure public key encryption (PKE) scheme with associated nonadaptive approximate smooth projection hash (NA-ASPH) system. Compared with other related protocols, the proposed two-round PAKE protocols have relatively less communication and computation overhead. In particular, the two-round 3PAKE is more practical in large-scale communication systems.
The Password-Authenticated Key Exchange (PAKE) protocol is a useful tool for establishing secure remote communication between users, especially given the prevalence of amplifying a human-memorable password into a strong session key in the age of hand-held devices. Recent advances in quantum computing have stimulated interest in quantum-safe cryptographic schemes. Therefore, we propose QSPAK and QSPPK, two post-quantum and efficient PAKE protocols which are parallel extensions of PAK and PPK, but based on the hardness assumption over module lattices. Specifically, we make a comprehensive trade-off among multiple significant performance indicators such as the post-quantum security, the failure rate, the communication cost and the running time to guide optimal parameter choices. This rigorous instantiation has never been seen in previous PAKE papers. Additionally, utilizing the flexibility of module lattices, we provide three parameter sets (#1, #2, and #3) matching different security scenarios. We implement and benchmark QSPAK and QSPPK against other competitive proposals. The performance results indicate that our QSPAK and QSPPK, besides being more efficient, exhibit the flexibility and security advantages over the latter schemes. Furthermore, we construct a post-quantum password-authenticated TLS 1.3 framework, aimed towards provide a further suggestion for IETF standardization of quantum-safe PAKE.
Through constructing and utilizing non-malleable,extractable,and weak simulation-sound trapdoor commitment schemes and corresponding smooth projective hash function familes,this paper proposes an efficient two-party password authenticated key exchange(PAKE) protocol within the universal composable(UC) framework,which is the optimal two-round PAKE protocol in this setting.Rigorous security proofs based on standard assumptions in the presence of static corruption adversary are then given out.Comparisons with previously proposed protocols show that,this protocol avoids the use of zero-knowledge protocols,and achieves a higher performance in terms of communication efficiency while attaining a comparable computational complexity.
Nowadays many crucial network applications rely on the existence of a confidential channel established by authenticated key exchange (AKE) protocols over public networks.With the rapid development of cyber technology, novel attacks to cryptosystem emerge in an endless stream.This has also led to the development of AKE solutions to provide increasingly stronger security guarantees.In this thesis we focus on provision of practical constructions for AKE protocols which are provably secure in a strong sense without resorting to random oracles.We first we present three new efficient compilers to generically turn passively secure key exchange protocols (KE) into authenticated key exchange protocols (AKE) where security also holds in the presence of active adversaries.Our compilers are not only a useful tool for the design of new AKE systems with many additional security properties in a modular and less error-prone fashion, but they also help to relax the assumptions on existing, practical key exchange mechanisms which are not known to be provably secure AKE protocols.Security of our compilers is shown in a strong modified CK model where the adversary is allowed to reveal either long-term secret key or state information of the protocol participants.On the second, we study the open problem on constructing eCK secure two party AKE protocol without random oracles and NAXOS trick.A generic construction satisfying those requirements is given based on well-known cryptographic primitives following the guideline of efficiency.Then a concrete protocol is proposed which is the first eCK secure protocol in the standard model under both standard assumptions and post-specified peer setting (i.e.without knowing any cryptographic information about its communication peer).Both proposed schemes can be more efficiently implemented with secure device than previous works which are eCK secure in the standard model, where the secure device might be normally used to store the long-term private key and to implement codes of protocol which need to be resilience of state leakage.Finally, we generalize our one-round two party AKE construction to group case that yields an efficient tripartite AKE protocol based on bilinear maps and a candidate group AKE protocol (with more than three members) based on multilinear maps.Up to now they are the first solutions which can be proved secure in the g-eCK model without random oracles.Meanwhile we make first step to show how to simplify the security proof for one-round group AKE under g-eCK model.i
Password authentication is a prevalent method of user verification across the Internet, and its use extends to scenarios where resources are limited. However, current password authentication protocols primarily rely on traditional password authenticated key exchange (PAKE) protocols (e.g., SRP, OPAQUE), which are vulnerable to attacks by quantum adversaries. To date, no efficient quantum algorithm has been found to solve the common challenges in lattice-based cryptography. Therefore, quantum-resistant PAKE protocols are generally built upon lattice-based cryptography. In this work, we propose a threshold verifiable oblivious pseudorandom function () protocol based on secret sharing. We then integrate it into a PAKE protocol and present an instantiation of a quantum-safe threshold PAKE protocol () based on the Ring Learning with Errors (RLWE) assumption. This integration gives our PAKE protocol resistance to precomputation attacks, similar to OPAQUE. Furthermore, by incorporating thresholding techniques into the PAKE protocol, we mitigate the risk of single points of failure on the server side. Our protocol not only preserves the security guarantees of traditional PAKE schemes but also resists attacks from quantum adversaries. We also provide a comprehensive security analysis and evaluation of, providing valuable insights for its practical implementation.
A Password-Authenticated Key Exchange (PAKE) protocol allows two parties to agree upon a cryptographic key, when the only information shared in advance is a low-entropy password. The standard security notion for PAKE (Canetti et al., Eurocrypt 2005) is in the Universally Composable (UC) framework. We show that unlike most UC security notions, UC PAKE does not imply correctness. While Canetti et al. has briefly noticed this issue, we present the first comprehensive study of correctness in UC PAKE: We show that TrivialPAKE, a no-message protocol that does not satisfy correctness, is a UC PAKE; We propose nine approaches to guaranteeing correctness in the UC security notion of PAKE, and show that seven of them are equivalent, whereas the other two are unachievable; We prove that a direct solution, namely changing the UC PAKE functionality to incorporate correctness, is impossible; Finally, we show how to naturally incorporate correctness by changing the model—we view PAKE as a three-party protocol, with the man-in-the-middle adversary as the third party. In this way, we hope to shed some light on the very nature of UC-security in the man-in-the-middle setting.