The Improvement of the 3-pass Password-based Key Exchange Protocol in ICISC ′99

摘要

Since Bellovin and Merriti introduced DH-EDE, which was key exchange protocol based on password, there have been many attempts to provide protocols with additional security and practicality. Despite potential drawbacks of password such as low entropy and choice of bad passwords, such password-based protocols provide the noble methods for preventing password-guessing attack by on-line or off-line. In this paper, we analyze the security and the efficiency of the existing password-based key exchange protocol. Especially we show that Lee et al's protocol of ICISC ′99 is vulnerable to client masquerader. Then we improve their protocol. Besides the security and efficiency of improved protocol are presented.