Robust biometric-based three-party authenticated key establishment protocols

Abstract

This paper proposes secure and efficient biometric-based three-party authenticated key establishment (B3AKE) protocols to minimize the computation costs of each participant and fit three-party communication. The proposed B3AKE protocols adopts a three-factor authentication mechanism which uses biometric, token, and passwords for users unlike the related protocols. In addition, the proposed B3AKE protocols are composed of four sub-protocols, which are registration, biometric-based three-party authenticated key transport, biometric-based three-party authenticated key agreement (B3AKA), and password update. In order to exploit the key block size, speed, and security jointly, the proposed B3AKA protocol is based on symmetric key cryptosystems and elliptic curve cryptography. As a result, the proposed B3AKE protocols not only are secure against well-known cryptographical attacks but also provide perfect forward secrecy. Furthermore, the number of rounds is smaller by one round than the related protocols and the asymmetric key encryption/decryption operations do not need to establish a session key and authenticate between two users and a server. Thus, the proposed B3AKE protocols are very useful in limited computation and communication resource environments to access remote information systems since it provides security, reliability, and efficiency.

Keywords:

• cryptography
• biometric
• token
• authentication
• password
• three-party

2000 AMS Subject Classifications :

• 94A60
• 94A62
• 11T71
• 68P25

Acknowledgements

We would like to thank the anonymous reviewers for their helpful comments. This is an extended version of a paper published at the 2007 IFIP International Conference on Embedded and Ubiquitous Computing (EUC 2007) 40. This work is supported by the second Brain Korea 21 Project in 2009.