One-Round Password-Based Authenticated Key Exchange

We show a general framework for constructing password-based authenticated key exchange protocols with optimal round complexity — one message per party, sent simultaneously — in the standard model, assuming the existence of a common reference string. When our framework is instantiated using bilinear-map cryptosystems, the resulting protocol is also (reasonably) efficient. Somewhat surprisingly, our framework can be adapted to give protocols (still in the standard model) that are universally composable while still using only one (simultaneous) round. ∗Dept. of Computer Science, University of Maryland. Work done while visiting IBM. Email: jkatz@cs.umd.edu. Research supported by NSF grant #0627306 and NSF CAREER award #0447075. †IBM Research. vinodv@alum.mit.edu. 1 Password-Based Authenticated Key Exchange Protocols for authenticated key exchange enable two parties to generate a shared, cryptographically strong key while communicating over an insecure network under the complete control of an adversary. Such protocols are among the most widely used and fundamental cryptographic primitives; indeed, agreement on a shared key is necessary before “higher-level” tasks such as encryption and message authentication become possible. Parties must share some information in order for authenticated key exchange to be possible. It is well known that shared cryptographic keys — either in the form of public keys or a long, uniformly random symmetric key — suffice, and several protocols in this model (building on the classic Diffie-Hellman protocol [22], which protects only against an eavesdropping adversary and provides no authentication at all) are known [8, 5, 6, 3, 43, 18, 19, 36, 37]. Password-based protocols allow users to “bootstrap” even a very weak (e.g., short) shared secret into a (much longer) cryptographic key. The canonical application here is authentication using passwords, though protocols developed in this context can be useful even when the shared secret has high min-entropy (but is not uniform) [13]. The security guaranteed by password-based protocols (roughly speaking) is that if the password is chosen uniformly1 from a dictionary of size D then an adversary who initiates Q “on-line” attacks — i.e., who actively interferes in Q sessions — has “advantage” at most Q/D. (This is inherent, as an adversary can always carry out Q impersonation attempts and succeed with this probability.) In particular, “off-line” dictionary attacks where an adversary enumerates all passwords from the (presumably small) dictionary of potential passwords, and tries to match observed protocol executions to each one, are of no use. Early work [27, 30] considered a “hybrid” setting where users share public keys in addition to a password. In the setting where only a password is shared, Bellovin and Merritt [7] proposed the first protocols for password-based authenticated key exchange (PAK) with heuristic arguments for their security. Several years later, provably secure PAK protocols were constructed [4, 14, 38] in the random oracle/ideal cipher models, and many improvements and generalizations of these protocols are known. In contrast, only a handful of PAK protocols are known in the so-called “standard model” (i.e., without random oracles): General assumptions: Goldreich and Lindell [26] gave the first PAK protocol in the standard model. Subsequent work of Barak et al. [2] shows a general feasibility result for computation over unauthenticated networks which implies a solution for PAK as a special case. These approaches gives the only PAK protocols for the plain model where there is no setup. (Nguyen and Vadhan [40] show efficiency improvements to the Goldreich-Lindell protocol, but achieve a weaker notion of security.) Unfortunately, all these approaches are completely impractical in terms of communication, computation, and round complexity. Moreover, they do not tolerate concurrent executions by the same party (unless additional setup is assumed). Efficient protocols: Katz, Ostrovsky, and Yung [34] demonstrated the first efficient PAK protocol with a proof of security based on standard assumptions; extensions and improvements of their protocol were given in [25, 17, 33, 24, 35]. Different constructions of efficient PAK protocols in the CRS model are given in [32, 28]. In contrast to the work of Goldreich and Lindell, these approaches are secure even under concurrent executions by the same party. On the Although the usual presentation of PAK assumes a uniform password, all known protocols work with passwords chosen from an arbitrary (efficiently sampleable) distribution.