IEEE Symposium on Computers and Communications (ISCC)

Security analysis and improvement of Smart Card-Based Authenticated Key Exchange protocol with CAPTCHAs for wireless mobile network

Maryam Saeed, Hadi Shahriar Shahhoseini

Published Jun 1, 2011• 0 citations

Abstract

In 2010, Fan et al. proposed a Smart Card-Based Authenticated Key Exchange protocol with CAPTCHAs for wireless mobile networks. In this paper, it is shown that their proposed protocol is vulnerable to Key Compromise Impersonation (KCI) and ephemeral key compromise impersonation attacks while it does not provide the key confirmation attribute. Furthermore, it is inefficient due to number redundancy of rounds and computational costs. To overcome these weaknesses, two secure and efficient smart card-based Authenticated Key Exchange (AKE) protocols combined with CAPTCHAs are proposed for wireless mobile networks that provide many security attributes while they have a remarkable efficiency when compared with Fan et al.'s protocol in the terms of communication costs and computational complexities.

DOI: 10.1109/iscc.2011.5983913

Related papers

Security Analysis of Two Password-Authenticated Multi-Key Exchange Protocols

Min Luo, Xiaotong Zhou, Li Li +2 more

Mobile communications (e.g., emails, Snapchat and Facebook) over a wireless connection is a norm in our Internet-connected society. Ensuring the security of communications between devices is an ongoing challenge. A number of authenticated key exchange (AKE) protocols have been proposed to verify the authenticity of a user and the integrity of messages sent over an insecure wireless communication channel. Recently, Tsai et al. proposed two AKE protocols designed for wireless network systems. In this paper, we demonstrate that their protocols are vulnerable to off-line password guessing attacks through presenting concrete attacks, contrary to their claims.

IEEE AccessJan 1, 20176 citations

Analysis of Two Authenticated Key Exchange Protocols

Qingfeng Cheng, Guangguo Han, Chuangui Ma

The design of secure authenticated key exchange (AKE) protocols has always been a notorious hard problem. Many famous AKE protocols have been found flaws since they were finished. In this paper, we analyze two AKE protocols, which were proposed by Hassan et al. in 2007 and 2008. Then we present key compromise impersonation attack and ephemeral key compromise attack to their two AKE protocols.

International Conference on Multimedia Information Networking and SecurityJan 1, 20092 citations

Provable analysis and improvement of smart card–based anonymous authentication protocols

Saeed Banaeian Far, Mahdi R. Alagheband

Summary Nowadays, authentication protocols are essential for secure communications specially for roaming networks, distributed computer networks, and remote wireless communication. The numerous users in these networks rise vulnerabilities. Thus, privacy‐preserving methods have to be run to provide more reliable services and sustain privacy. Anonymous authentication is a method to remotely authenticate users with no revelation about their identity. In this paper, we analyze 2 smart card–based protocols that the user's identity is anonymous. However, we represent that they are vulnerable to privileged insider attack. It means that the servers can compromise the users' identity for breaking their privacy. Also, we highlight that the Wen et al protocol has flaws in both stolen smart card and stolen server attacks and the Odelu et al protocol is traceable. Then, we propose 2 modified anonymous authentication protocols. Finally, we analyze our improved protocols with both heuristic and formal methods.

International Journal of Communication SystemsApr 16, 20183 citations

A construction of post quantum secure and signal leakage resistant authenticated key agreement protocol for mobile communication

Uddeshaya Kumar, Manish Garg, Saru Kumari +1 more

Abstract Mobile communication is very important for an individual users, enterprisers, industries, businesses, and organizations. Since the nodes communicate through a public channel, security, and privacy become essential component for mobile communication. Both key exchange and authentication are two important security attributes to establish secure communication between two parties. In the past few years, various post‐quantum secure authentication protocols have been designed, but we have found that either some of the protocols are vulnerable to stolen smart card attack, invalid login, or signal leakage attack. In this article, we have discussed how the protocol Dharminder et al (Dharminder D, Chandran KP. J Ambient Intell Humaniz Comput. 2020; 11:4089‐4100.) is vulnerable to modified version of signal leakage attack, and sometimes called improved signal leakage attack. We have also suggested a remedy over the current existing protocol suffering from signal leakage attacks. The proposed protocol is secure against quantum attacks. We have proved the security of the proposed protocol under ring learning with errors assumption. The proposed authentication and key agreement needs only two messages exchange. We have also found the proposed is efficient in terms of computation with respect to relevant protocols.

Transactions on Emerging Telecommunications TechnologiesOct 10, 202222 citations

Impersonation Attack on Two Identity-Based Authenticated Key Exchange Protocols

Shiwu Zhang, Qingfeng Cheng, Xuekui Wang

In 2009, Holbl et al. proposed two new identity-based authenticated key exchange protocols and claimed that their protocols can withstand various attacks. In this paper, we will show that Holbl et al.'s protocols cannot resist basic impersonation attack. It also means that their protocols are vulnerable to key compromise impersonation (KCI) attacks. Furthermore, we propose improvements of their protocols with impersonation attack resilience and KCI resilience.

WASE International Conference on Information EngineeringAug 1, 20107 citations

Secure Deniable Authenticated Key Establishment for Internet Protocols

Meng-Hui Lim, Sang-Gon Lee, Youngho Park +1 more

In 2003, Boyd et al. have proposed two deniable authenticated key establishment protocols for Internet key exchange (IKE). However, both schemes have been broken by Chou et al. in 2005 due to their susceptibility to key-compromise impersonation (KCI) attack. In this paper, we put forward the improved variants of both Boyd et al.'s schemes in order to defeat the KCI attack. On top of justifying our improvements, we further present a detailed security analysis to ensure that the desired security attributes: deniability and authenticity remain preserved.

Apr 1, 20084 citations