Paper 2024/1057 Original: eprint.iacr.org/2024/1057 ↗
Password-authenticated Key Exchange and Applications
Abstract
We analyse a two password-authenticated key exchange protocols, a variant of CPace and a protocol related to the well-known SRP protocol. Our security results are tight. The first result gives us some information about trade-offs for design choices in CPace. The second result provides information about the security of SRP. Our analysis is done in a new game-based security definition for password-authenticated key exchange. Our definition accomodates arbitrary password sampling methodologies. Our definition also supports modular security analysis, which we illustrate by giving two example applications of password-authenticated key exchange: password-authenticated secure channels and password-authenticated device authorisation, capturing popular applications of passwords.
Metadata
- Available format(s)
PDF- Category
- Cryptographic protocols
- Publication info
- Preprint.
- History
- 2024-06-28: last updated
- 2024-06-28: published
- Short URL
- https://ia.cr/2024/1057
- License
- https://creativecommons.org/licenses/by/4.0/
BibTeX
@misc{cryptoeprint:2024/1057,
author = {Kristian Gjøsteen},
title = {Password-authenticated Key Exchange and Applications},
howpublished = {Cryptology {ePrint} Archive, Paper 2024/1057},
year = {2024},
url = {https://eprint.iacr.org/2024/1057}
}