一种改进的跨域口令密钥交换协议

跨域的端到端的口令认证密钥交换(C2C-PAKE)协议,可实现不同区域的两个客户通过不同的口令协商出共享的会话密钥.首先对Byun2007的C2C-PAKE协议进行了描述,并针对其安全性进行了分析,发现该协议易遭受口令泄露伪造攻击的安全漏洞,提出了一种高效的改进的跨域口令认证密钥交换协议.该协议引入公钥密码体制能够有效抵抗口令泄露伪造攻击和不可检测在线字典攻击,且只需要6步通信.安全性分析表明该协议是安全有效的.     

基于身份的两方跨域认证密钥协商协议

两方跨域认证密钥协商协议是指来自不同私钥生成中心的两个参与方完成互相认证和协商出相同的会话密钥。基于身份的密码体制能避免公钥基础结构的公钥证书存储问题。双线性对运算复杂度较高,计算成本较大。我们提出了一个新的无双线性对基于身份的两方跨域认证密钥协商协议,并在随机预言模式下证明了协议的安全性。     

基于口令的跨服务器认证密钥交换协议研究

为了满足某些特殊通信服务在跨服务器认证密钥交换时必须由客户直接协商产生会话密钥的要求,该文提出一种新的基于口令的跨服务器认证密钥交换协议。该协议对在线字典攻击的反应灵敏度及发现此类攻击的计算代价和通信代价低;分析结果表明,新协议满足基于口令的认证密钥交换协议的安全性要求。     

基于口令的抵抗字典攻击的密钥交换协议

口令是INTERNET常用的用户身份验证方式，字典攻击方式是攻击者进行口令猜测的常用方法．本文提出了一种基于口令的抵抗字典攻击的密钥交换协议，首先对协议双方的身份进行认证，然后在两者之间生成一个随机密钥用于对后续的会话进行加密．     

基于NTRU公钥密码体制的可认证同态密钥协商协议

分析了常见的密钥协商协议,基于同态加密机制和NTRU公钥密码体制,提出了基于NTRU的可认证同态密钥协商协议.该协议建立的会话密钥是可认证的、等献的和前向保密的.和基于其他公钥密码体制的密钥协商协议相比,所提出的密钥协商协议的效率和安全性都有所提高.使用改进的BAN逻辑对协议进行形式化分析,证明了协议的安全性     

新的三方密钥交换协议

针对基于口令认证机制的密钥交换协议容易遭受口令猜测和服务器假冒等多种攻击的缺点,提出了基于验证值认证机制的新的三方密钥交换协议.新协议中的验证值是基于口令的变换,并代替口令被保存在服务器端.服务器不仅以验证值来认证用户的身份,并且要通过验证值协助用户之间协商出会话密钥.而口令则作为私钥由用户自己保存.对新协议的安全进行分析,表明该协议可以抵御多种攻击,说明协议是安全的,同时对协议的效率评估还表明该协议具有较高的效率.     

采用阈下信道的两方口令认证密钥交换协议

提出一种基于阈下信道的两方口令认证密钥交换协议.协议中,服务器存储用户口令的验证值抵御服务器泄漏伪装攻击,用户的口令明文采用阈下信道生成签名信息传送给服务器,服务器计算出用户的口令明文恢复出阈下信息,再计算口令验证值以实现对用户身份的认证,从而建立起会话密钥.对所提协议的安全性和效率进行分析,结果表明:所提出的协议安全可行且有效.     

无线网中基于ECC的认证和密钥交换协议

为适应密码技术在无线通信中的应用要求,Aydos、Mangipudi等人以椭圆曲线密码为基础,分别提出了适用于无线通信网络的身份认证和密钥交换协议.而研究发现,这些协议中仍存在中间人攻击、服务后否认、假冒攻击等安全隐患,且不能提供前向保密性.为此,本文提出一个安全的身份认证和密钥交换协议,经验证说明该协议不仅能防止上述安全隐患,而且执行效率更好,适于为无线通信环境中用户端与服务器间进行相互认证,建立一个双方共享的会话密钥.     

一种高效的匿名口令认证密钥交换协议

针对云计算等网络新应用中用户隐私保护问题,提出了基于椭圆曲线CDH假设的匿名口令认证密钥交换APAKE协议,通过它用户既能与服务器建立共享会话密钥,又不会暴露其真实身份信息.通过系统模型、安全模型定义及严格的形式化证明,验证了此APAKE协议满足正确性、PAKE安全性及用户匿名性.通过与现有协议对比分析表明:所提APAKE协议既能抵抗身份冒充攻击及离线口令猜测攻击,也提供双向认证;协议效率得到很大提高,客户端及服务器端计算复杂度均有大幅降低.     

一个高效的匿名口令认证密钥协商协议

匿名口令密钥协商(APAKE)协议在保持用户匿名性的同时,可以为网络上共享口令的通信双方建立会话密钥.分析了一个高效APAKE协议存在的安全问题,进而提出了新的高效匿名口令认证密钥协商协议,并对所提协议的安全性、匿名性和抗字典攻击等安全需求进行了分析.服务器和用户完成协议需要2次模幂运算,运算效率较高.     

Analysis and improvement of cross-realm client-to-client password authenticated key exchange protocols

Because cross-realm C2C-PAKE （client-to-client password authenticated key exchange） protocols can not resist some attacks, this paper writes up new attacks on two representative protocols, then designs a new cross-realm C2C-PAKE protocol with signature and optimal number of rounds for a client （only 2-rounds between a client and a server）. Finally, it is proved that the new protocol can be resistant to all known attacks through heuristic analysis and that it brings more security through the comparisons of security properties with other protocols.     

An efficient two-party key exchange protocol with strong security

Combined public key (CPK) cryptography does not need certificates to guarantee the authenticity of public keys and avoids the inherent key escrow problem of identity-based cryptography. Based on the efficient CPK scheme, we present an efficient three-round two-party authenticated key exchange protocol with strong security, which is provably secure in the standard model under the decisional Diffie-Hellman (DDH) assumption. The protocol can keep the session key secret from the adversary except that one party’s ephemeral private key and static private key are all revealed to the adversary. Compared to the existing protocols, this protocol not only assures strong security but also is more efficient.     

基于Pairing的可认证的群密钥协商协议

基于Pairing计算和密钥树提出了一种高效的动态群密钥协商方案.通过引入群公钥证书并在群密钥中结合群以及成员的长期密钥和临时密钥,提供了隐含密钥认证,以有效地对抗中间人攻击.此外,该方案的设计思想可以作为一种通用方法,把可认证两方Diffile-Hellman协议扩展到群环境.     

Provable Efficient Certificateless Group Key Exchange Protocol

Certificateless public key cryptography （CL-PKC） avoids the inherent escrow of identity-based cryptography and does not require certificates to guarantee the authenticity of public keys. Based on CL-PKC, we present an efficient constant-round group key exchange protocol, which is provably secure under the intractability of computation Diffie-Hellman problem. Our protocol is a contributory key exchange with perfect forward secrecy and has only two communication rounds. So it is more efficient than other protocols. Moreover, our protocol provides a method to design efficient constant-round group key exchange protocols and most secret sharing schemes could be adopted to construct our protocol.     

Two-Party Authenticated Key Agreement in Certificateless Public Key Cryptography

0 Introduction To simplify the management of certificates of tradi- tional PKI, Shamir[1] proposed the identity-based public key cryptography (ID-PKC) in which the public key of each party is derived directly from certain aspects of its identity, for exam…     

The New Enhanced Simple Authenticated Key Agreement Algorithm

IntroductionDiffie-Hell man key agreement[1]is a well-knownmethod by which two authenticated parties may use aninsecure channel to agree a session key for use withconventional symmetric encryption algorithm. However ,itis vulnerable to the man-in-the-middle attack. Adoptingcertificates (e .g . digital signature) into a key exchangeprotocol can foil man-in-the-middle attack,but its extensionto a larger system may be difficult for the key exchange withcertificates requiring some more trusted aut…     

Efficient Authenticated Key Agreement Protocol Using Self-Certified Public Keys from Pairings

An efficient authenticated key agreement protocol is proposed, which makes use of bilinear pairings and selfcertified public keys. Its security is based on the security assumptions of the bilinear Diffie-Hellman problem and the computational Diffic-Hellman problem. Users can choose their private keys independently. The public keys and identities of users can bc verified implicitly when the session key being generating in a logically single step. A trusted Key Generation Center is no longer required as in the ID-based authenticated key agreement protocols. Compared with existing authenticated key agreement protocols from pairings, the new proposed protocol is more efficient and secure.     

一种新的域间基于身份认证密钥协商协议

目前对于密钥交换协议的研究越来越多,如基于Diffie-Hellman的密钥交换协议。但是对于密钥的认证却没有很好地解决,如何保证参与方的认证？例如在Diffie-Hellman密钥交换协议中,如何防止中间人攻击。目前的方案需要可信的第三方TTP（Trusted Third Party）的支持;密钥的更新和管理有困难,不同的域无法完成密钥交换。现提出一种新的域间基于身份认证的密钥交换协议,一方面使得在不同域间的用户也可以交换密钥;另一方面用户使用基于身份的密钥产生方案可以对用户进行认证。