Analysing Password Protocol Security Against Off-line Dictionary Attacks

Ricardo Corin; Jeroen Doumen; Sandro Etalle

Analysing Password Protocol Security Against Off-line Dictionary Attacks

Ricardo Corin, Jeroen Doumen, Sandro Etalle

Research output: Book/Report › Report › Professional

90 Downloads (Pure)

Abstract

We study the security of password protocols against off-line dictionary attacks. In addition to the standard adversary abilities, we also consider further cryptographic advantages given to the adversary when considering the password protocol being instantiated with particular encryption schemes. We work with the applied pi calculus of Abadi and Fournet, in which the (new) adversary abilities are modelled as equations between terms. As case studies, we analyse the Encrypted Password Transmission (EPT) protocol of Halevi and Krawczyk, and the wellknown Encrypted Key Exchange (EKE) of Bellovin and Merritt. Finally, we propose a modification to EKE that prevents a particular attack that arises when ciphertexts are distinguishable from random noise.

Original language	English
Place of Publication	Enschede
Publisher	Centre for Telematics and Information Technology (CTIT)
Number of pages	19
Publication status	Published - Dec 2003

Publication series

Name	CTIT technical report series
Publisher	University of Twente, CTIT
No.	2003-52
ISSN (Print)	1381-3625

Keywords

SCS-Cybersecurity

Access to Document

Corin2003analysisFinal published version, 223 KB

1 Conference contribution

Analysing Password Protocol Security Against Off-line Dictionary Attacks
Corin, R., Doumen, J. & Etalle, S., Jun 2004, Proceedings of the 2nd International Workshop on Security Issues with Petri Nets and other Computational Models (WISP 2004). Busi, N., Gorrieri, R. & Martinelli, F. (eds.). Amsterdam: Elsevier, p. 47-63 17 p. (Electronic Notes in Theoretical Computer Science; vol. 121).
Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

Open Access
File
37 Citations (Scopus)

98 Downloads (Pure)

Cite this

@book{1d0c8f4db6c742689fe7e081c970b001,

title = "Analysing Password Protocol Security Against Off-line Dictionary Attacks",

abstract = "We study the security of password protocols against off-line dictionary attacks. In addition to the standard adversary abilities, we also consider further cryptographic advantages given to the adversary when considering the password protocol being instantiated with particular encryption schemes. We work with the applied pi calculus of Abadi and Fournet, in which the (new) adversary abilities are modelled as equations between terms. As case studies, we analyse the Encrypted Password Transmission (EPT) protocol of Halevi and Krawczyk, and the wellknown Encrypted Key Exchange (EKE) of Bellovin and Merritt. Finally, we propose a modification to EKE that prevents a particular attack that arises when ciphertexts are distinguishable from random noise.",

keywords = "SCS-Cybersecurity",

author = "Ricardo Corin and Jeroen Doumen and Sandro Etalle",

year = "2003",

month = dec,

language = "English",

series = "CTIT technical report series",

publisher = "Centre for Telematics and Information Technology (CTIT)",

number = "2003-52",

address = "Netherlands",

}

TY - BOOK

T1 - Analysing Password Protocol Security Against Off-line Dictionary Attacks

AU - Corin, Ricardo

AU - Doumen, Jeroen

AU - Etalle, Sandro

PY - 2003/12

Y1 - 2003/12

N2 - We study the security of password protocols against off-line dictionary attacks. In addition to the standard adversary abilities, we also consider further cryptographic advantages given to the adversary when considering the password protocol being instantiated with particular encryption schemes. We work with the applied pi calculus of Abadi and Fournet, in which the (new) adversary abilities are modelled as equations between terms. As case studies, we analyse the Encrypted Password Transmission (EPT) protocol of Halevi and Krawczyk, and the wellknown Encrypted Key Exchange (EKE) of Bellovin and Merritt. Finally, we propose a modification to EKE that prevents a particular attack that arises when ciphertexts are distinguishable from random noise.

AB - We study the security of password protocols against off-line dictionary attacks. In addition to the standard adversary abilities, we also consider further cryptographic advantages given to the adversary when considering the password protocol being instantiated with particular encryption schemes. We work with the applied pi calculus of Abadi and Fournet, in which the (new) adversary abilities are modelled as equations between terms. As case studies, we analyse the Encrypted Password Transmission (EPT) protocol of Halevi and Krawczyk, and the wellknown Encrypted Key Exchange (EKE) of Bellovin and Merritt. Finally, we propose a modification to EKE that prevents a particular attack that arises when ciphertexts are distinguishable from random noise.

KW - SCS-Cybersecurity

M3 - Report

T3 - CTIT technical report series

BT - Analysing Password Protocol Security Against Off-line Dictionary Attacks

PB - Centre for Telematics and Information Technology (CTIT)

CY - Enschede

ER -

Analysing Password Protocol Security Against Off-line Dictionary Attacks

Abstract

Publication series

Keywords

Access to Document

Fingerprint

Research output

Analysing Password Protocol Security Against Off-line Dictionary Attacks

Cite this