EFFICIENT AND SECURE PASSWORD-BASED AUTHENTICATION PROTOCOLS AGAINST GUESSING ATTACKS

We propose authentication and key exchange protocols which are both ef ficient and secure against password guessing attacks. Conventional aut hentication protocols have assumed that a strong secret should be shar ed between communicating participants, in the light of a threat of gue ssing attacks. A cryptographically long secret would be favored for se curity reasons, but it is not suitable for users to remember. Recent p assword-based protocols to defeat guessing attacks are more expensive than previous ones, in terms of the computation and communication cost s. Using a one-time pad and a strong one-way hash function, we promote both security and efficiency. Thereby, we also verify our protocol fo rmally. (C) 1998 Elsevier Science B.V.