Analysis of the SPEKE password-authenticated key exchange protocol
Muxiang Zhang
Verizon Commun. Inc., Waltham, MA, USA;
This paper appears in: Communications Letters, IEEE
Publication Date: Jan. 2004
Volume: 8,
Issue: 1
On page(s): 63- 65
ISSN: 1089-7798
INSPEC Accession Number: 7909455
Digital Object Identifier: 10.1109/LCOMM.2003.822506
Current Version Published: 2004-01-30
Abstract
In this letter, we show that for the SPEKE password-authenticated key exchange protocol, an adversary is able to test multiple possible passwords using a single impersonation attempt. In particular, when passwords are short Personal Identification Numbers (PINs), we show that a fully-constrained SPEKE is susceptible to password guessing attack. Our analysis contradicts the claim that the SPEKE protocol appears to be at least as strong as the Bellovin-Merritt EKE protocol. For EKE, an adversary can gain information about at most one possible password in each impersonation attempt.
Index
Terms
Available to subscribers and IEEE members.
References
Available to subscribers and IEEE members.
Citing Documents
Available to subscribers and IEEE members.
Cart
