An efficient and practical threshold gateway-oriented password-authenticated key exchange protocol in the standard model

With the assistance of an authentication server, a gateway-oriented password-authenticated key exchange (GPAKE) protocol can establish a common session key shared between a client and a gateway. Unfortunately, a GPAKE protocol becomes totally insecure if an adversary can compromise the authentication server and steal the passwords of the clients. In order to provide resilience against adversaries who can hack into the authentication server, we propose a threshold GPAKE protocol and then present its security proof in the standard model based on the hardness of the decisional Diffie-Hellman (DDH) problem. In our proposal, the password is shared among n authentication servers and is secure unless the adversary corrupts more than t+1 servers. Our protocol requires n > 3t servers to work. Compared with existing threshold PAKE protocols, our protocol maintains both stronger security and greater efficiency.创新点网关口令认证密钥交换协议(简称网关口令协议)可以在认证服务器的协助下为用户和网关建立共享的会话密钥。但如果攻击者腐化认证服务器并且窃取了所有用户的口令信息,那么网关口令协议的安全性将无法保证。针对黑客对服务器的入侵攻击给网关口令协议带来的巨大安全威胁,我们设计了一个门限网关口令协议并且在标准模型下基于DDH假设证明了协议的安全性。在我们的协议中,口令被n个服务器以秘密共享的方式分享,攻击者只有腐化t+1个服务器才能够得到用户口令。与已有的同类协议相比,我们的协议不仅具有更强的安全性而且具有更高的效率。