| 关于S-3PAKE协议的漏洞分析 |
| |
| 引用本文： | 许春香,罗淑丹.关于S-3PAKE协议的漏洞分析[J].电子科技大学学报(社会科学版),2009(4). |
| |
| 作者姓名： | 许春香 罗淑丹 |
| |
| 作者单位： | 电子科技大学计算机科学与工程学院; |
| |
| 基金项目： | 国家863计划(2009AA01Z415);;现代通信国家重点实验室基金(9140C1107010604);;华为公司科技基金(YJCB2006053DC);;计算机网络与信息安全教育部重点实验室基金资助 |
| |
| 摘 要： | 通过分析一种基于CCDH假设的简单三方密钥交换协议(S-3PAKE协议),指出了该协议未对攻击者可能的身份进行全面考虑,缺乏完备认证机制的缺陷,阐明了当攻击者本身就是与服务器共享一对认证口令的合法用户时,该协议不能有效地抵抗在线口令猜测攻击,并提出了一种对S-3PAKE协议进行在线口令猜测攻击的具体方法。使用该方法,攻击者只需与服务器进行通信,即可对其他用户的口令进行猜测分析。
|
| 关 键 词： | 身份认证 密钥交换 在线猜测攻击 口令 |
Security Analysis on S-3PAKE Protocol |
| |
| XU Chun-xiang , LUO Shu-dan.Security Analysis on S-3PAKE Protocol[J].Journal of University of Electronic Science and Technology of China(Social Sciences Edition),2009(4). |
| |
| Authors: | XU Chun-xiang LUO Shu-dan |
| |
| Institution: | School of Computer Science and Engineering;University of Electronic Science and Technology of China Chengdu 610054 |
| |
| Abstract: | The three-party password-based authenticated key exchange protocol based on the CCDH assumption is analyzed. It is demonstrated that this protocol has security vulnerabilities from on-line guessing attack and lacks a perfect authentication mechanism. This paper presents an attack scheme to the protocol. Our attack scheme shows that an adversary can get other legitimate user's password successfully by on-line guessing cyclically. |
| |
| Keywords: | ID authentication key exchange on-line guessing attack password |
| 本文献已被 CNKI 等数据库收录！ |
