Defending secret-key based authentication protocols against the stolen-secret attack

Hung Min Sun; King Hang Wang

doi:10.1109/ISECS.2008.36

Defending secret-key based authentication protocols against the stolen-secret attack

Hung Min Sun^*
, King Hang Wang

^*Corresponding author for this work

Department of Computer Science

Research output: Chapter in book/report/conference proceeding › Conference proceeding › peer-review

1 Citation (Scopus)

Abstract

The security of a two-party authentication protocol relies on the stored secrets of each entity are not easily compromised by adversaries. However, in the real world, hackers can always divulge the stored secrets. In this paper, we introduce the concept of the stolen-secret attack and point out that all existing secret-key based authentication protocols and password based authentication protocols suffer from this attack. We also propose two methods that defend against the stolen-secret attack. Security proof and implementation analysis are given for both methods to illustrate their soundness and usefulness.

Original language	English
Title of host publication	Proceedings of the International Symposium on Electronic Commerce and Security, ISECS 2008
Publisher	IEEE
Pages	385-389
Number of pages	5
ISBN (Print)	9780769532585
DOIs	https://doi.org/10.1109/ISECS.2008.36
Publication status	Published - 3 Aug 2008
Event	International Symposium on Electronic Commerce and Security, ISECS 2008 - Guangzhou, China Duration: 3 Aug 2008 → 5 Aug 2008 https://doi.org/10.1109/isecs14120.2008

Publication series

Name	Proceedings of the International Symposium on Electronic Commerce and Security, ISECS 2008

Conference

Conference	International Symposium on Electronic Commerce and Security, ISECS 2008
Country/Territory	China
City	Guangzhou
Period	3/08/08 → 5/08/08
Other	Conference proceeding
Internet address	https://doi.org/10.1109/isecs14120.2008

UN SDGs

This output contributes to the following UN Sustainable Development Goals (SDGs)

SDG 16 Peace, Justice and Strong Institutions

Access to Document

10.1109/ISECS.2008.36

Cite this

@inproceedings{21d0e54c952b4b7ab0f57a806e36fc2c,

title = "Defending secret-key based authentication protocols against the stolen-secret attack",

abstract = "The security of a two-party authentication protocol relies on the stored secrets of each entity are not easily compromised by adversaries. However, in the real world, hackers can always divulge the stored secrets. In this paper, we introduce the concept of the stolen-secret attack and point out that all existing secret-key based authentication protocols and password based authentication protocols suffer from this attack. We also propose two methods that defend against the stolen-secret attack. Security proof and implementation analysis are given for both methods to illustrate their soundness and usefulness.",

author = "Sun, \{Hung Min\} and Wang, \{King Hang\}",

note = "This work was supported in part by the National Science Council, Taiwan, under contract no. NSC 96-2628-E-007-025-MY3 and NSC96-3114-P-001-002-Y. Publisher Copyright: {\textcopyright} 2008 IEEE; International Symposium on Electronic Commerce and Security, ISECS 2008 ; Conference date: 03-08-2008 Through 05-08-2008",

year = "2008",

month = aug,

day = "3",

doi = "10.1109/ISECS.2008.36",

language = "English",

isbn = "9780769532585",

series = "Proceedings of the International Symposium on Electronic Commerce and Security, ISECS 2008",

publisher = "IEEE",

pages = "385--389",

booktitle = "Proceedings of the International Symposium on Electronic Commerce and Security, ISECS 2008",

address = "United States",

url = "https://doi.org/10.1109/isecs14120.2008",

}

Sun, HM & Wang, KH 2008, Defending secret-key based authentication protocols against the stolen-secret attack. in Proceedings of the International Symposium on Electronic Commerce and Security, ISECS 2008. Proceedings of the International Symposium on Electronic Commerce and Security, ISECS 2008, IEEE, pp. 385-389, International Symposium on Electronic Commerce and Security, ISECS 2008, Guangzhou, China, 3/08/08. https://doi.org/10.1109/ISECS.2008.36

Defending secret-key based authentication protocols against the stolen-secret attack. / Sun, Hung Min; Wang, King Hang.
Proceedings of the International Symposium on Electronic Commerce and Security, ISECS 2008. IEEE, 2008. p. 385-389 (Proceedings of the International Symposium on Electronic Commerce and Security, ISECS 2008).

Research output: Chapter in book/report/conference proceeding › Conference proceeding › peer-review

TY - GEN

T1 - Defending secret-key based authentication protocols against the stolen-secret attack

AU - Sun, Hung Min

AU - Wang, King Hang

PY - 2008/8/3

Y1 - 2008/8/3

N2 - The security of a two-party authentication protocol relies on the stored secrets of each entity are not easily compromised by adversaries. However, in the real world, hackers can always divulge the stored secrets. In this paper, we introduce the concept of the stolen-secret attack and point out that all existing secret-key based authentication protocols and password based authentication protocols suffer from this attack. We also propose two methods that defend against the stolen-secret attack. Security proof and implementation analysis are given for both methods to illustrate their soundness and usefulness.

AB - The security of a two-party authentication protocol relies on the stored secrets of each entity are not easily compromised by adversaries. However, in the real world, hackers can always divulge the stored secrets. In this paper, we introduce the concept of the stolen-secret attack and point out that all existing secret-key based authentication protocols and password based authentication protocols suffer from this attack. We also propose two methods that defend against the stolen-secret attack. Security proof and implementation analysis are given for both methods to illustrate their soundness and usefulness.

UR - https://www.scopus.com/pages/publications/54049143673

U2 - 10.1109/ISECS.2008.36

DO - 10.1109/ISECS.2008.36

M3 - Conference proceeding

AN - SCOPUS:54049143673

SN - 9780769532585

T3 - Proceedings of the International Symposium on Electronic Commerce and Security, ISECS 2008

SP - 385

EP - 389

BT - Proceedings of the International Symposium on Electronic Commerce and Security, ISECS 2008

PB - IEEE

T2 - International Symposium on Electronic Commerce and Security, ISECS 2008

Y2 - 3 August 2008 through 5 August 2008

ER -

Defending secret-key based authentication protocols against the stolen-secret attack

Abstract

Publication series

Conference

UN SDGs

Access to Document

Other files and links

Fingerprint

Cite this