An Efficient 3D Elliptic Curve Diffie–Hellman (ECDH) Based Two-Server Password-Only Authenticated Key Exchange Protocol with Provable Security

ABSTRACT

In large-scale distributed systems, where adversarial attacks have extensive impact, authentication provides fortification against threats involving impersonation of entities and tampering of data. Towards this, we introduce the first tetrahedron (three-dimensional (3D)) based two-server Password Authenticated and Key Exchange (PAKE) protocol to represent text passwords. A 3D PAKE protocol is a hybrid cryptographic algorithm that requires two servers for authentication; one server engages with users and the other is hidden from the clients. A remarkable aspect of the proposed 3D PAKE protocol is that reclaiming password from the stored credentials is not possible when either one/both the servers gets compromised. In this paper, we discuss the properties of tetrahedron that mesh well with Diffie–Hellman key exchange protocol and elliptic curve cryptography encryption scheme and proved that the protocol is resistant against cryptographic attacks without the involvement of public key infrastructure. The proposed protocol is the first provably secure two-server PAKE protocol against an offline dictionary attack.

KEYWORDS:

• 3D PAKE protocol
• Elliptic curve cryptography
• Diffie–Hellman key exchange
• Security analysis

DISCLOSURE STATEMENT

No potential conflict of interest was reported by the authors.

Additional information

Notes on contributors

K. Anitha Kumari

K. Anitha Kumari is working as an assistant professor (Sr.Gr) in Department of IT in PSG College of Technology, India. Her areas of interest include security in grid and cloud computing, cryptography, and analysis of algorithms. She has published 30 papers in refereed national and international journals and conferences. She was awarded gold medal in BE (CSE) and in ME (SE) degrees in Anna University. She delivered quite a number of guest lectures in cloud security. She acts as the mentor and coordinator for ICICI – Trinity 2014 funded project.

E-mail: [email protected]

G. Sudha Sadasivam

G. Sudha Sadasivam is working as a professor in Department of Computer Science and Engineering in PSG College of Technology, India. Her areas of interest include distributed systems, distributed object technology, and grid and cloud computing. She has published 67 papers in refereed international and national journals, and at conferences. She has published five books in her areas of interest. She has coordinated two AICTE – RPS projects in distributed and grid computing arena. She is also the coordinator for PSG-Yahoo RESEARCH on grid and cloud computing.

E-mail: [email protected]

L. Rohini

L. Rohini received her ME (BCS) degree from the Department of IT in PSG College of Technology, India. She had been a software engineer in HCL Technologies for about two years. Her areas of interest include security in cloud computing and networking.

E-mail: [email protected]