对客户到客户的口令认证密钥协商协议的密码分析和改进(英文)-豆柴文库

您所在位置：网站首页 / 对客户到客户的口令认证密钥协商协议的密码分析和改进(英文).docx / 文档详情

在线预览结束，喜欢就下载吧，查找使用更方便

5 金币

下载文档

/ 2

下载提示

如果您无法下载资料，请参考说明：

1、部分资料下载需要金币，请确保您的账户上有足够的金币

2、已购买过的文档，再次下载不重复扣费

3、资料包下载后请先用软件解压，在使用对应软件打开

文本预览

对客户到客户的口令认证密钥协商协议的密码分析和改进(英文)
PasswordAuthenticationKeyAgreementProtocol(PAKAP)isusedbyclientstoauthenticateeachotherbeforecommencingtheexchangeofsensitivedatainasecuremanner.However,thisprotocolhassomeinherentvulnerabilitiesthatcanbeexploitedbyattackers.ThispaperaimstoanalyzethesecurityofPAKAPandproposeamodifiedversionthataddressestheidentifiedvulnerabilities.
AnalysisofPasswordAuthenticationKeyAgreementProtocol(PAKAP)
PAKAPisasymmetrickeyagreementprotocolthatallowstwoclientstonegotiateasharedsecretkeyoveranunsecuredchannel.Theprotocolinvolvestheexchangeoftwomessagesbetweentheclientsasshownbelow:
1.Thefirstclientsendsausernameandapasswordtothesecondclient.
2.Thesecondclientgeneratesarandomnumberandencryptsitusingthepasswordreceivedfromthefirstclient.Theencryptedrandomnumberisthensentbacktothefirstclient.
3.Thefirstclientdecryptstherandomnumberusingthepassworditsenttothesecondclient.
4.Bothclientscomputethesharedsecretkeyusingtheexchangedrandomnumberandapre-sharedkey.
ThestrengthofPAKAPreliesonthesecrecyofthepassword.However,thefollowingvulnerabilitiescanbeexploitedbyattackerstocompromisethesecurityoftheprotocol.
1.PasswordGuessingAttack:Thepasswordcanbeguessedbyanattackerwhohasknowledgeoftheusername,eitherthroughbruteforceordictionaryattack.
2.Man-in-the-MiddleAttack:Anattackercaninterceptthemessagesexchangedbetweentheclients,modifythem,andthensendthemtotheintendedrecipient.Thisispossiblebecausethesharedsecretkeyisnotauthenticatedduringtheexchange.
3.ReplayAttack:Anattackercancapturethemessagesexchangedbetweentheclientsandre-sendthematalatertimetogainunauthorizedaccess.
4.Key-ExchangeAttack:PAKAPdoesnotprovideforwardsecrecy.Incasethesharedsecretkeyiscompromised,allpastandfuturecommunicationscanbedecryptedbyanattacker.
ProposedModification
Toaddresstheidentifiedvulnerabilities,thefollowingmodificationsareproposed:
1.PasswordHashing:Insteadoftransmittingthepasswordinplaintext,acryptographichashfunctionshouldbeusedtogenerateapasswordhash.Thehashofthepasswordshouldbetr