Weaknesses of 'Security Analysis and Enhancement for Three-Party Password-Based Authenticated Key Exchange Protocol'

摘要

The three-party password-based authenticated key exchange (3PAKE) protocol allows two users to share a session key for future communication with the help of a trusted server in the public network. Recently, Zhao et al. [Zhao J., Gu D., Zhang L., Security analysis and enhancement for three-party password-based authenticated key exchange protocol, Security Communication Networks 2012; 5(3):273-278] proposed an efficient 3PAKE protocol using smart cards. They proved that their protocol can withstand various known attacks found in the previously published schemes. However, in this paper, we point out that their protocol is vulnerable to three kinds of attacks namely, off-line password-guessing attack, privileged insider attack and stolen smart card attack. Hence, Zhao et al.'s scheme is not recommended for practical applications.