1 / 13

A password authentication scheme with secure password updating

A password authentication scheme with secure password updating. SEC 期末報告 　　　　　 學號： 89321037 　　　　　 姓名：翁玉芬. Source. Chun-Li Lin and Tzonelih Hwang, Computers & Security, Vol.22, No.1, pp. 68-72, 2003. Outline. Introduction Peryravian-Zunic’s Scheme Hwang-Yen’s Scheme Proposed Scheme

gavin
Download Presentation

A password authentication scheme with secure password updating

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. A password authentication scheme with secure password updating SEC 期末報告 　　　　　 學號：89321037 　　　　　 姓名：翁玉芬

  2. Source • Chun-Li Lin and Tzonelih Hwang, Computers & Security, Vol.22, No.1, pp. 68-72, 2003

  3. Outline • Introduction • Peryravian-Zunic’s Scheme • Hwang-Yen’s Scheme • Proposed Scheme • Conclusions

  4. Introduction • Password scheme • Password authentication protocol • replay attack • password search attack • stolen-verifier attack • Password change protocol • denial of service attack • Key distribution • forward secrecy

  5. Introduction (cont.) • Notations • id: user number • pw: password • Ks: the server public key • {M}Ks : Encryption of M with Ks • rc: random number generated by client • rs: random number generated by server • H(.) : one-way hash function

  6. stolen-verifier attack . id , rc rs id , H( H( id, pw), rc, rs) Access granted or denied Peyarian-Zunic’s Scheme – password transmission Client Server

  7. id , rc rs id , H( H( id, pw), rc, rs), denial of service attack Access granted or denied Peyarian-Zunic’s Scheme – password change Client Server

  8. id , { rc, pw}Ks , H ( rs) id , H (rc, rs) Access granted or denied Hwang-Yen’s Scheme –password transmission Client Server

  9. No forward secrecy id , { rc, pw}Ks receive rc , H ( rs) receive rs id , H (rc, rs) Compute H (rc,rs) Compute H (rc,rs) Access granted or denied one-time token Hwang-Yen’s Scheme -Key distribution Client Server generate rc generate rs

  10. denial of service attack id , { rc, pw}Ks , H( rs) id , H(rc, rs), Access granted or denied Hwang-Yen’s Scheme -password change Client Server

  11. id , { rc, pw}Ks , H( rs) id , H(rc, rs), H( H( new_pw), rs) Access granted or denied Proposed Scheme –password change Client Server

  12. id , Receive receive id , Compute Compute Access granted or denied Proposed Scheme –key distribution Client Server generate x generate y

  13. Conclusions • The password change protocol can protest against denial of service attack • The key distribution protocol can propose forward secrecy

More Related