Paper 2009/476 Original: eprint.iacr.org/2009/476 ↗
On the Security of PAS (Predicate-based Authentication Service)
Abstract
Recently a new human authentication scheme called PAS (predicate-based authentication service) was proposed, which does not require the assistance of any supplementary device. The main security claim of PAS is to resist passive adversaries who can observe the whole authentication session between the human user and the remote server. In this paper we give a detailed security analysis of PAS and show that PAS is insecure against both brute force attack and a probabilistic attack. In particular we show that the security of PAS against brute force attack was strongly overestimated. Furthermore, we introduce a probabilistic attack, which can break part of the password even with a very small number of observed authentication sessions. Although the proposed attack cannot completely break the password, it can downgrade the PAS system to a much weaker system similar to common OTP (one-time password) systems.
Metadata
- Available format(s)
PDF- Category
- Cryptographic protocols
- Publication info
- Preprint.
- History
- 2009-09-29: last updated
- 2009-09-29: published
- Short URL
- https://ia.cr/2009/476
- License
- https://creativecommons.org/licenses/by/4.0/
BibTeX
@misc{cryptoeprint:2009/476,
author = {Shujun Li and Hassan Jameel Asghar and Josef Pieprzyk and Ahmad-Reza Sadeghi and Roland Schmitz and Huaxiong Wang},
title = {On the Security of PAS (Predicate-based Authentication Service)},
howpublished = {Cryptology {ePrint} Archive, Paper 2009/476},
year = {2009},
url = {https://eprint.iacr.org/2009/476}
}