可证明安全的基于RSA的远程用户口令认证协议

汪定, 王平, 李增鹏, 马春光

系统工程理论与实践 ›› 2015, Vol. 35 ›› Issue (1) : 191-204.

PDF(880 KB)
PDF(880 KB)
系统工程理论与实践 ›› 2015, Vol. 35 ›› Issue (1) : 191-204. DOI: 10.12011/1000-6788(2015)1-191
论文

可证明安全的基于RSA的远程用户口令认证协议

    汪定1,2,3, 王平1,3, 李增鹏2, 马春光2
作者信息 +

Provably secure RSA-based remote user authentication protocol using passwords

    WANG Ding1,2,3, WANG Ping1,3, LI Zeng-peng2, MA Chun-guang2
Author information +
文章历史 +

摘要

身份认证是确保信息系统安全的基本手段,基于RSA的认证协议由于实用性较强而成为近期研究热点.讨论了Xie等提出的一个基于RSA的双因子远程用户认证协议,指出该协议不能抵抗重放攻击和密钥泄露仿冒攻击,无法实现所声称的安全性,并且存在用户隐私泄露和可修复性差问题,不适于实际应用.给出一个改进方案,在随机预言机模型下,基于RSA假设证明了改进方案的安全性.与现有的基于RSA的同类协议相比,改进协议在保持较高效率的同时,首次实现了可证明安全性,适用于安全需求较高的移动应用环境.

Abstract

With identity authentication becoming an essential mechanism to ensure robust system security in information systems, RSA-based authentication protocols have been studied intensively for their great practicality. This paper points out that a recent RSA-based remote user two-factor authentication protocol proposed by Xie et al. cannot achieve the claimed security and reports its following flaws: (1) It is vulnerable to replay attack and key compromise impersonation attack; (2) It suffers from the problem of user privacy violation and poor repairability. As our main contribution, an improved scheme is put forward and formally proved secure under the RSA assumption in the random oracle model. As compared with other related schemes, our scheme is the first one that can achieve provable security while keeping the merit of high performance. Consequently, our scheme is more well-suited for mobile application scenarios where resource is severely constrained and security is particularly concerned.

关键词

认证协议 / RSA / 随机预言机模型 / 重放攻击 / 智能卡

Key words

authentication protocol / RSA / random oracle model / replay attack / smart card

引用本文

导出引用
汪定 , 王平 , 李增鹏 , 马春光. 可证明安全的基于RSA的远程用户口令认证协议. 系统工程理论与实践, 2015, 35(1): 191-204 https://doi.org/10.12011/1000-6788(2015)1-191
WANG Ding , WANG Ping , LI Zeng-peng , MA Chun-guang. Provably secure RSA-based remote user authentication protocol using passwords. Systems Engineering - Theory & Practice, 2015, 35(1): 191-204 https://doi.org/10.12011/1000-6788(2015)1-191
中图分类号: TP309.08   

参考文献

[1] 冯登国, 陈伟东. 基于口令的安全协议的模块化设计与分析[J]. 中国科学(E辑), 2007, 37(2): 223-237.Feng Dengguo, Chen Weidong. Modular approach to the design and analysis of password-based security protocols[J]. Science in China Series E, 2007, 37(2): 223-237.
[2] Chen T H, Hsiang H C, Shih W K. Security enhancement on an improvement on two remote user authentication schemes using smart cards[J]. Future Generation Computer Systems, 2011, 27(4): 377-380.
[3] Das M L. Two-factor user authentication in wireless sensor networks[J]. IEEE Transactions on Wireless Communications, 2009, 8(3): 1086-1090.
[4] Wang Y Y, Liu J Y, Xiao F X, et al. A more efficient and secure dynamic ID-based remote user authentication scheme[J]. Computer Communications, 2009, 32(4): 583-585.
[5] Yoon E J, Yoo K Y, Ha K S. A user friendly authentication scheme with anonymity for wireless communications[J]. Computers & Electrical Engineering, 2011, 37(3): 356-364.
[6] Messerges T S, Dabbish E A, Sloan R H. Examining smart card security under the threat of power analysis attacks[J]. IEEE Transactions on Computers, 2002, 51(5): 541-552.
[7] Markantonakis K, Tunstall M, Hancke F, et al. Attacking smart card systems: Theory and practice[J]. Information Security Technical Report, 2009, 14(2): 46-56.
[8] Kim T H, Kim C, Park I. Side channel analysis attacks using am demodulation on commercial smart cards with seed[J]. Journal of Systems and Software, 2012, 85(12): 2899-2908.
[9] Khan M K, Kim S K, Alghathbar K. Cryptanalysis and security enhancement of a more efficient & secure dynamic ID-based remote user authentication scheme[J]. Computer Communications, 2011, 34(3): 305-309.
[10] Sood S K. Secure dynamic identity-based authentication scheme using smart cards[J]. Information Security Journal: A Global Perspective, 2011, 20(2): 67-77.
[11] Wen F, Li X. An improved dynamic ID-based remote user authentication with key agreement scheme[J]. Computers & Electrical Engineering, 2012, 38(2): 381-387.
[12] Hsieh W, Leu J. Exploiting hash functions to intensify the remote user authentication scheme[J]. Computers & Security, 2012, 31(6): 791-798.
[13] He D B, Chen J H, Zhang R. Weakness of a dynamic ID-based remote user authentication scheme[J]. International Journal of Electronic Security and Digital Forensics, 2010, 3(4): 355-362.
[14] Shim K. Security flaws in three password-based remote user authentication schemes with smart cards[J]. Cryptologia, 2012, 36(1): 62-69.
[15] Wang D, Ma C G. Robust smart card based password authentication scheme against smart card security breach[R]. Cryptology ePrint Archive, 2012, Report 2012/439: 1-32. http://eprint.iacr.org/2012/439.pdf.
[16] He D B, Hu J. Cryptanalysis of a dynamic ID-based remote user authentication scheme with access control for multi-server environments[J]. IEICE Transactions on Information and Systems, 2013, 96(1): 138-140.
[17] Lee T F, Liu C M. A secure smart-card based authentication and key agreement scheme for telecare medicine information systems[J]. Journal of Medical Systems, 2013, Doi: 10.1007/s10916-013-9933-8.
[18] Ma C G, Wang D, Zhao S D. Security flaws in two improved remote user authentication schemes using smart cards[J]. International Journal of Communication Systems, 2014, 27(10): 2215-2227.
[19] Zhu F. RSA-based password authenticated key exchange for imbalanced wireless networks[C]//Proceedings of the 5th Information Security Conference (ISC 2002), Berlin: Springer-Verlag, LNCS 2433, 2002: 150-161.
[20] 汪定, 马春光, 翁臣, 等. 一种适于受限资源环境的远程用户认证方案的分析 与改进[J]. 电子与信息学报, 2012, 34(10): 2520-2526.Wang Ding, Ma Chunguang, Weng Chen, et al. Cryptanalysis and improvement of a remote user authentication scheme for resource-limited environment[J]. Journal of Electronics & Information Technology, 2012, 34(10): 2520-2526.
[21] Park J K, Lee J S, Chang J H.An efficient remote user authentication scheme secure against the offline password guessing attack by power analysis[C]//Proceedings of the 11th IEEE International Conference on Advanced Communication Technology, Feb 2-5, Phonenix, U.S.A. Phonenix: IEEE Press, 2009: 1289-1292.
[22] 谢琪, 陈德人, 于秀源. Park等远程用户认证协议的分析与改进[J]. 系统工程 理论与实践, 2010, 30(10): 1877-1882.Xie Qi, Chen Deren, Yu Xiuyuan. Cryptanalysis and improvement of Park et al.'s remote user authentication protocol[J]. Systems Engineering——Theory & Practice, 2010, 30(10): 1877-1882.
[23] Awasthi A K, Srivastava K, Mittal R C. An improved timestamp-based remote user authentication scheme[J]. Computers & Electrical Engineering, 2011, 37(6): 869-874.
[24] Ramasamy R, Muniyandi A P. An efficient password authentication scheme for smart card[J]. International Journal of Network Security, 2012, 14(3): 180-186.
[25] Zhu Z A. An efficient authentication scheme for telecare medicine information systems[J]. Journal of Medical Systems, 2012, 36(6): 3833-3838.
[26] Tsai C S, Lee C C, Hwang M S. Password authentication schemes: Current status and key issues[J]. International Journal of Network Security, 2006, 3(2): 101-115.
[27] Krawczyk H. HMQV: A high-performance secure Diffie-Hellman protocol[C]//Proceedings of the 25th Annual International Cryptology Conference (CRYPTO 2005), Aug 14-18, 2005, Santa Barbara, CA, USA, Berlin: Springer-Verlag, LNCS 3621, 2005: 546-566.
[28] Li X, Qiu W, Zheng D, et al. Anonymity enhancement on robust and efficient password-authenticated key agreement using smart cards[J]. IEEE Transactions on Industrial Electronics, 2010, 57(2): 793-800.
[29] Florencio D, Herley C. A large-scale study of web password habits[C]//Proceedings of the 16th International World Wide Web Conference (WWW 2007), New York: ACM, 2007: 657-666.
[30] Mangipudi K, Katti R. A secure identification and key agreement protocol with user anonymity[J]. Computers & Security, 2006, 25(6): 420-425.
[31] Menezes A. Another look at provable security[C]//Proceedings of the 31th International Conference on the Theory and Application of Cryptographic Techniques (EUROCRYPT 2012), Berlin: Springer-Verlag, LNCS 7237, 2012: 8. Keynote, http://www.cs.bris.ac.uk/eurocrypt2012/Program/Weds/Menezes.pdf.
[32] Bellare M, Pointcheval D, Rogaway P. Authenticated key exchange secure against dictionary attacks[C]//Proceedings of the 19th International Conference on the Theory and Application of Cryptographic Techniques (EUROCRYPT 2000), May 14-18, 2000, Bruges, Belgium, Berlin: Springer-Verlag, LNCS 1807, 2000: 139-155.
[33] Xu J, Zhu W, Feng D. An improved smart card based password authentication scheme with provable security[J]. Computer Standards & Interfaces, 2009, 31(4): 723-728.
[34] Scott M. Cryptanalysis of a recent two factor authentication scheme[R]. Cryptology ePrint Archive, 2012, Report 2012/527: 1-3. http://eprint.iacr.org/2012/527.pdf.
[35] Wang Y G. Password protected smart card and memory stick authentication against off-line dictionary attacks[C]//Proceedings of the 27th IFIP International Information Security and Privacy Conference (SEC 2012), June 4-6, 2012, Heraklion, Greece, Berlin: Springer-Verlag, IFIP AICT 376, 2012: 489-500.
[36] Zhang M X. New approaches to password authenticated key exchange based on RSA[C]//Proceedings of 10th International Conference on the Theory and Application of Cryptology and Information Security (AsiaCrypt 2004), Dec 5-9, 2004, Jeju Island, Korea, Berlin: Springer-Verlag, LNCS 3329, 2004: 230-244.

基金

国家自然科学基金(61472016, 61170241);黑龙江省自然科学基金(F201229);哈尔滨市科技创新人才专项资金(2012 RFXXG086)

PDF(880 KB)

297

Accesses

0

Citation

Detail

段落导航
相关文章

/