Key-Exchange Protocol

Title: Key-Exchange Protocol

Abstract: This research proposes a simple and efficient password-authenticated key-exchange protocol. The protocol is based on the difficulty of solving the DDH problem and has several advantages. It allows both y1 and y2 to be independent and sent independently, which speeds up the protocol without leaking information about the passwords. Additionally, clients and servers can use almost the same algorithm, reducing implementation costs and eliminating the risk of replay attacks and abuse of entities as oracles.

Main Research Question: How can we create a password-authenticated key-exchange protocol that is simple, efficient, and secure?

Methodology: The research proposes a protocol that is defined over a finite cyclic group G=< g > with a large prime q. The group G can be a prime order subgroup over a finite field Fp. The protocol consists of two phases: a secrecy-amplification phase and a verification phase.

In the secrecy-amplification phase, the secrecy of a pre-shared weak secret (a human memorable password) is amplified to a strong secret (a keying material). In the verification phase, an ordinal challenge-response protocol is used to verify whether the other entity has the same secret or not. The point to notice is that challenges should be unique at every session and at every entity to avoid replay attacks and abuse of one entity as an oracle.

Results: The research shows that the proposed protocol is efficient, secure, and user-friendly. It allows for independent and simultaneous transmission of y1 and y2, reducing the protocol's latency. Additionally, clients and servers can use almost the same algorithm, reducing implementation costs.

Implications: The research has significant implications for the field of cryptography and computer security. It provides a simple and efficient method for establishing secure channels between entities, especially in situations where users cannot carry verification keys or perform verification of public-keys. The protocol's user-friendliness and security make it an attractive option for remote logins and other secure communication channels.

Link to Article: https://arxiv.org/abs/0110024v1 Authors: arXiv ID: 0110024v1