An Offline Dictionary Attack Against zkPAKE Protocol - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2019

An Offline Dictionary Attack Against zkPAKE Protocol

Résumé

Password Authenticated Key Exchange (PAKE) allows a user to establish a secure cryptographic key with a server, using only knowledge of a pre-shared password. One of the basic security requirements of PAKE is to prevent offline dictionary attacks.In this paper, we revisit zkPAKE, an augmented PAKE that has been recently proposed by Mochetti, Resende, and Aranha (SBSeg 2015). Our work shows that the zkPAKE protocol is prone to offline password guessing attack, even in the presence of an adversary that has only eavesdropping capabilities. Results of performance evaluation show that our attack is practical and efficient. Therefore, zkPAKE is insecure and should not be used as a password-authenticated key exchange mechanism.
Fichier principal
Vignette du fichier
485650_1_En_6_Chapter.pdf (390.31 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03744290 , version 1 (02-08-2022)

Licence

Identifiants

Citer

José Becerra, Peter Ryan, Petra Šala, Marjan Škrobot. An Offline Dictionary Attack Against zkPAKE Protocol. 34th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), Jun 2019, Lisbon, Portugal. pp.81-90, ⟨10.1007/978-3-030-22312-0_6⟩. ⟨hal-03744290⟩
23 Consultations
124 Téléchargements

Altmetric

Partager

Gmail Mastodon Facebook X LinkedIn More