Recently, Lu and Cao proposed a password-authenticated key exchange protocol in the three party setting, and the authors claimed that their protocol works within three rounds. In this paper, we analyze the protocol and show the protocol cannot work within three rounds. We also find two security flaws in the protocol. The protocol is vulnerable to an undetectable password guessing attack and an off-line password guessing attack.
목차
Abstract I. Introduction II. Review of Lu and Cao's III. Count the Number of Round IV. Cryptanalysis of Lu and Cao's Protocol 1. Undetectable On-Line Password Guessing Attack 2. Off-Line Password Guessing Attack V. Conclusion 참고문헌