Password-based user authentication and key distribution protocols for client-server applications

1. Password-based user authentication and key distribution protocols for client-server applications Authors:Her-Tyan Yeh and Hung-Min Sun Sources:The Journal of Systems and Software, Vol.72, pp.97-103, 2004. Adviser:Min-Shiang Hwang Speaker:Chun-Ta Li Date:2004/11/04

2. Outline • Introduction • Description of notations and security requirements • Key transfer authentication protocol (KTAP) • Key agreement authentication protocol (KAAP) • Conclusions • Comments

3. Introduction • Password-based mechanism • User authentication • Password guessing attacks • Server can use strong cryptographic secret • Session key creation • Key transfer protocol (two-party, three-party) • Key agreement protocol (two-party, three-party) KTAP three-party three-party KAAP

4. Introduction (cont.) • Key Transfer Authentication Protocol (KTAP) • Key Agreement Authentication Protocol (KAAP) session key (K) authentication Authentication Server Application Server Client session key (K) session key (K) session key (K) authentication X1 = gx mod P X1 Y1 Authentication Server Application Server Client Y1 = gy mod P, K = gxy mod P

5. Description of notations and security requirements • Notations • A: Client • B: AP server • S: Trust authentication server • PA: Password shared between A and S • SB: Secret key shared between B and S • KS: Public key of the trust authentication server • x, y, ra, rb: Random numbers • [info]K : Symmetric encryption with key K • {info}K: Asymmetric encryption with the Public key K

6. Description of notations and security requirements (cont.) • Security requirements • Guessing attacks • On-line guessing attack • Off-line guessing attack • Replay attacks • Perfect forward secrecy • Assumption • All principals know the server’s public key Ks in the system • A poorly chosen password PA chosen by A is known to S via a secure channel • The application server’s secret key SB is known to S via a secure channel

7. Key transfer authentication protocol (KTAP) S (Trust authentication server) A (Client) B (Application server) [A, B, [A, K]ra, K] SB {A, B, PA, ra}KS [A, K]ra,[B, rb]K rb h(K): session key

8. Key transfer authentication protocol (cont.) • Security analysis • Guessing attacks -- • PA in Message 1 is used only to authenticate A’s status • Replay attacks • Attacker can get is {[A, B, [A, K]ra, K]SB, [A, K]ra, [B, rb]K} • Perfect forward secrecy • Attacker can know PA: doesn’t know server’s private key unknown {A, B, PA, ra}KS unknown

9. Key transfer authentication protocol (cont.) • Comparison with the related works

10. Key agreement authentication protocol (KAAP) S (Trust authentication server) A (Client) B (Application server) [A, gx] SB {A, B, PA, ra, gx}KS gy, [B, rb]K rb K= gxy(session key)

11. Key agreement authentication protocol (cont.) • Security analysis • Guessing attacks -- • PA in Message 1 is used only to authenticate A’s status • The attacker must also guess the value of ra • Replay attacks (forge K`) • Attacker can get is {{A, B, PA, ra, gx}, [A, gx]SB, [B, rb]K} • Perfect forward secrecy • Attacker can know PA: doesn’t know server’s private key unknown {A, B, PA, ra, gx}KS unknown unknown

12. Key agreement authentication protocol (cont.) • Comparison with the related works

13. Conclusions • Authors introduced key distribution protocols: KTAP and KAAP • These two protocols can be applied to various communication systems in distributed computing environments

14. Thanks for your attention