作　　者： ; ; ; ;

机构地区： 东北大学

出　　处： 《东北大学学报（自然科学版）》 2009年第7期976-979,共4页

摘　　要： 针对基于口令认证机制的密钥交换协议容易遭受口令猜测和服务器假冒等多种攻击的缺点,提出了基于验证值认证机制的新的三方密钥交换协议.新协议中的验证值是基于口令的变换,并代替口令被保存在服务器端.服务器不仅以验证值来认证用户的身份,并且要通过验证值协助用户之间协商出会话密钥.而口令则作为私钥由用户自己保存.对新协议的安全进行分析,表明该协议可以抵御多种攻击,说明协议是安全的,同时对协议的效率评估还表明该协议具有较高的效率. To eliminate the disadvantages that the password-authentication key exchange protocols are vulnerable to password guessing attacks and server compromised impersonation attack, a new verifier-based key exchange protocol for three-parties is proposed. In the new protocol the verifier is based on the change of password instead of storing it in the server. In this way the verifier enables the server not only to authenticate user＇ s identity but assist the users to determine a common session key through negotiation. Then, a user can store the password as a private key. The security analysis of the new protocol reveals that it can resist many attacks safely, and the computational costs show that the protocol has higher efficiency.

关 键 词： 口令认证 验证值 密钥交换 服务器假冒攻击 口令猜测攻击

领　　域： [自动化与计算机技术] [自动化与计算机技术]