title: Password-only authenticated three-party key exchange proven secure against insider dictionary attacks.
abstract: While a number of protocols for password-only authenticated key exchange (PAKE) in the 3-party setting have been proposed, it still remains a challenging task to prove the security of a 3-party PAKE protocol against insider dictionary attacks. To the best of our knowledge, there is no 3-party PAKE protocol that carries a formal proof, or even definition, of security against insider dictionary attacks. In this paper, we present the first 3-party PAKE protocol proven secure against both online and offline dictionary attacks as well as insider and outsider dictionary attacks. Our construct can be viewed as a protocol compiler that transforms any 2-party PAKE protocol into a 3-party PAKE protocol with 2 additional rounds of communication. We also present a simple and intuitive approach of formally modelling dictionary attacks in the password-only 3-party setting, which significantly reduces the complexity of proving the security of 3-party PAKE protocols against dictionary attacks. In addition, we investigate the security of the well-known 3-party PAKE protocol, called GPAKE, due to Abdalla et al. (2005, 2006), and demonstrate that the security of GPAKE against online dictionary attacks depends heavily on the composition of its two building blocks, namely a 2-party PAKE protocol and a 3-party key distribution protocol.
authors.affiliation: Department of Computer Engineering, Konkuk University, 268 Chungwondaero, Chungcheongbukdo, Chungju 380-701, Republic of Korea.
authors.forename: Junghyun
authors.initials: J
authors.lastname: Nam
authors.affiliation: Information Assurance Research Group, Advanced Computing Research Centre, University of South Australia, Mawson Lakes, SA 5095, Australia.
authors.forename: Kim-Kwang Raymond
authors.initials: KK
authors.lastname: Choo
authors.affiliation: Department of Computer Engineering, Sungkyunkwan University, 2066 Seoburo, Gyeonggido, Suwon 440-746, Republic of Korea.
authors.forename: Juryon
authors.identifier: 0000-0002-0564-6412
authors.initials: J
authors.lastname: Paik
authors.affiliation: Department of Computer Engineering, Sungkyunkwan University, 2066 Seoburo, Gyeonggido, Suwon 440-746, Republic of Korea.
authors.forename: Dongho
authors.identifier: 0000-0002-5208-1338
authors.initials: D
authors.lastname: Won
mesh_terms: D000465:Algorithms; D003195:Computer Communication Networks; D016494:Computer Security; D006801:Humans; D020407:Internet; D059015:Wireless Technology