title: On the security of a simple three-party key exchange protocol without server's public keys.
abstract: Authenticated key exchange protocols are of fundamental importance in securing communications and are now extensively deployed for use in various real-world network applications. In this work, we reveal major previously unpublished security vulnerabilities in the password-based authenticated three-party key exchange protocol according to Lee and Hwang (2010): (1) the Lee-Hwang protocol is susceptible to a man-in-the-middle attack and thus fails to achieve implicit key authentication; (2) the protocol cannot protect clients' passwords against an offline dictionary attack; and (3) the indistinguishability-based security of the protocol can be easily broken even in the presence of a passive adversary. We also propose an improved password-based authenticated three-party key exchange protocol that addresses the security vulnerabilities identified in the Lee-Hwang protocol.
authors.affiliation: Department of Computer Engineering, Konkuk University, 268 Chungwondaero, Chungju, Chungcheongbuk-do 380-701, Republic of Korea.
authors.forename: Junghyun
authors.initials: J
authors.lastname: Nam
authors.affiliation: Information Assurance Research Group, Advanced Computing Research Centre, University of South Australia, Mawson Lakes, SA 5095, Australia.
authors.forename: Kim-Kwang Raymond
authors.initials: KK
authors.lastname: Choo
authors.affiliation: Department of Computer Engineering, Konkuk University, 268 Chungwondaero, Chungju, Chungcheongbuk-do 380-701, Republic of Korea.
authors.forename: Minkyu
authors.initials: M
authors.lastname: Park
authors.affiliation: Department of Computer Engineering, Sungkyunkwan University, 2066 Seobu-ro, Suwon, Gyeonggi-do 440-746, Republic of Korea.
authors.forename: Juryon
authors.initials: J
authors.lastname: Paik
authors.affiliation: Department of Computer Engineering, Sungkyunkwan University, 2066 Seobu-ro, Suwon, Gyeonggi-do 440-746, Republic of Korea.
authors.forename: Dongho
authors.initials: D
authors.lastname: Won
mesh_terms: D022126:Access to Information; D000465:Algorithms; D003195:Computer Communication Networks / Q000592:standards; D016494:Computer Security / Q000592:standards*; D003219:Confidentiality / Q000592:standards*; D006801:Humans; D015203:Reproducibility of Results; D014584:User-Computer Interface