Skip to main content
SpringerLink
Log in

Cryptanalysis of a chaotic map-based password-authenticated key agreement protocol using smart cards

Nonlinear Dynamics Aims and scope Submit manuscript

Cite this article

Abstract

Chaotic maps have been applied in the design of authenticated key agreement protocols, which allow communication parties to exchange session keys in an authentic and secure manner. Guo and Chang recently proposed a novel password-authenticated key agreement protocol using smart card based on chaotic maps. They claimed that the protocol achieves the security goal of mutual authentication, as well as other essential security requirements. In this paper, we show that this protocol is susceptible to key-compromise impersonation and parallel session attacks. We also identify two weaknesses in the password change phase of the protocol that leads to authentication with old password and denial of service, respectively.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3
Fig. 4

References

  1. Algehawi, M.B., Azman, S.: A new identity based encryption (IBE) scheme using extended chebyshev polynomial over finite fields \({\mathbb{Z}}_p\). Phys. Lett. A 374, 4670–4674 (2010)

    Article  MATH  MathSciNet  Google Scholar 

  2. Alvarez, G., Li, S.: Some basic cryptographic requirements for chaos-based cryptosystems. Int. J. Bifurcat. Chaos 16, 2129–2151 (2006)

    Article  MATH  MathSciNet  Google Scholar 

  3. Bellare, M., Pointcheval, D., Rogaway, P.: Authenticated key exchange secure against dictionary attacks. In: Preneel, B. (ed.) EUROCRYPT. Lecture Notes in Computer Science, vol. 1807, pp. 139–155. Springer, Berlin (2000)

    Google Scholar 

  4. Bellare, M., Rogaway, P.: Entity authentication and key distribution. In: Stinson, D.R. (ed.) CRYPTO. Lecture Notes in Computer Science, vol. 773, pp. 232–249. Springer, Berlin (1993)

    Google Scholar 

  5. Bergamo, P., D’Arco, P., De Santis, A., Kocarev, L.: Security of public-key cryptosystems based on chebyshev polynomials. IEEE Trans. Circuits Syst. I Regul. Pap. 52(7), 1382–1393 (2005)

    Article  MathSciNet  Google Scholar 

  6. Canetti, R., Krawczyk, H.: Analysis of key-exchange protocols and their use for building secure channels. In: Pfitzmann, B. (ed.) EUROCRYPT. Lecture Notes in Computer Science, vol. 2045, pp. 453–474. Springer, Berlin (2001)

    Google Scholar 

  7. Chalkias, K., Baldimtsi, F., Hristu-Varsakelis, D., Stephanides, G.: Two types of key-compromise impersonation attacks against one-pass key establishment protocols. In: Filipe, J., Obaidat, M. (eds.) E-business and Telecommunications, Communications in Computer and Information Science, vol. 23, pp. 227–238. Springer, Berlin Heidelberg (2009)

    Chapter  Google Scholar 

  8. Cheong, K.Y., Koshiba, T.: More on security of public-key cryptosystems based on chebyshev polynomials. IEEE Trans. Circuits Syst. II Express Briefs 54(9), 795–799 (2007)

    Article  Google Scholar 

  9. Chung, H.R., Ku, W.C.: Three weaknesses in a simple three-party key exchange protocol. Inf. Sci. 178(1), 220–229 (2008)

    Article  MATH  MathSciNet  Google Scholar 

  10. Deng, S., Li, Y., Xiao, D.: Analysis and improvement of a chaos-based hash function construction. Commun. Nonlinear Sci. Numer. Simul. 15(5), 1338–1347 (2010)

    Article  MATH  MathSciNet  Google Scholar 

  11. Dojen, R., Jurcut, A., Coffey, T., Györödi, C.: On establishing and fixing a parallel session attack in a security protocol. In: Badica, C., Mangioni, G., Carchiolo, V., Burdescu, D.D. (eds.) IDC, Studies in Computational Intelligence, vol. 162, pp. 239–244. Springer, Berlin (2008)

    Google Scholar 

  12. Fan, C.I., Chan, Y.C., Zhang, Z.K.: Robust remote authentication scheme with smart cards. Comput. Secur. 24(8), 619–628 (2005)

    Article  Google Scholar 

  13. Gong, P., Li, P., Shi, W.: A secure chaotic maps-based key agreement protocol without using smart cards. Nonlinear Dyn. 70(4), 2401–2406 (2012)

    Article  MathSciNet  Google Scholar 

  14. Gorantla, M.C., Boyd, C., Nieto, J.M.G.: Modeling key compromise impersonation attacks on group key exchange protocols. In: Jarecki, S., Tsudik, G. (eds.) Public Key Cryptography. Lecture Notes in Computer Science, vol. 5443, pp. 105–123. Springer, Berlin (2009)

    Google Scholar 

  15. Gorantla, M.C., Boyd, C., Nieto, J.M.G., Manulis, M.: Modeling key compromise impersonation attacks on group key exchange protocols. ACM Trans. Inf. Syst. Secur. 14(4), 28:1–28:24 (2011)

    Article  Google Scholar 

  16. Guo, C., Chang, C.C.: Chaotic maps-based password-authenticated key agreement using smart cards. Commun. Nonlinear Sci. Numer. Simul. 18(6), 1433–1440 (2013)

    Article  MATH  MathSciNet  Google Scholar 

  17. Han, S.: Security of a key agreement protocol based on chaotic maps. Chaos Solitons Fractals 38(3), 764–768 (2008)

    Article  MATH  MathSciNet  Google Scholar 

  18. Hao, X., Wang, J., Yang, Q., Yan, X., Li, P.: A chaotic map-based authentication scheme for telecare medicine information systems. J. Med. Syst. 37(2), 1–7 (2013)

    Article  Google Scholar 

  19. Hsu, C.L.: Security of Chien et al’.s remote user authentication scheme using smart cards. Comput. Stand. Interfaces 26(3), 167–169 (2004)

    Article  Google Scholar 

  20. Juang, W.S., Chen, S.T., Liaw, H.T.: Robust and efficient password-authenticated key agreement using smart cards. IEEE Trans. Ind. Electron. 55(6), 2551–2556 (2008)

    Article  Google Scholar 

  21. Just, M., Vaudenay, S.: Authenticated multi-party key agreement. In: Kim, K., Matsumoto, T. (eds.) ASIACRYPT. Lecture Notes in Computer Science, vol. 1163, pp. 36–49. Springer, Berlin (1996)

    Google Scholar 

  22. Kocarev, L.: Chaos-based cryptography: a brief overview. IEEE Circuits Syst. Mag. 1(3), 6–21 (2001)

    Article  Google Scholar 

  23. Kocher, P.C., Jaffe, J., Jun, B.: Differential power analysis. In: Proceedings of the 19th Annual International Cryptology Conference on Advances in Cryptology, CRYPTO ’99, pp. 388–397. Springer, London, UK (1999). URL http://dl.acm.org/citation.cfm?id=646764.703989

  24. Krawczyk, H.: HMQV: a high-performance secure Diffie-Hellman protocol. In: Shoup, V. (ed.) CRYPTO. Lecture Notes in Computer Science, vol. 3621, pp. 546–566. Springer, Berlin (2005)

    Google Scholar 

  25. Lee, C.C., Chen, C.L., Wu, C.Y., Huang, S.Y.: An extended chaotic maps-based key agreement protocol with user anonymity. Nonlinear Dyn. 69(1–2), 79–87 (2012)

    Article  MATH  MathSciNet  Google Scholar 

  26. Lee, C.C., Li, C.T., Hsu, C.W.: A three-party password-based authenticated key exchange protocol with user anonymity using extended chaotic maps. Nonlinear Dyn. 73(1–2), 125–132 (2013)

    Article  MATH  MathSciNet  Google Scholar 

  27. Li, X., Qiu, W., Zheng, D., Chen, K., Li, J.: Anonymity enhancement on robust and efficient password-authenticated key agreement using smart cards. IEEE Trans. Ind. Electron. 57(2), 793–800 (2010)

    Article  Google Scholar 

  28. Lu, R., Cao, Z.: Simple three-party key exchange protocol. Comput. Secur. 26(1), 94–97 (2007)

    Article  Google Scholar 

  29. Maze, G.: Algebraic Methods for Constructing One-Way Trapdoor Functions. University of Notre Dame (2003)

  30. Menezes, A., van Oorschot, P.C., Vanstone, S.A.: Handbook of Applied Cryptography. CRC Press, Boca Raton, Fl (1996)

    Book  Google Scholar 

  31. Messerges, T., Dabbish, E., Sloan, R.: Examining smart-card security under the threat of power analysis attacks. IEEE Trans. Comput. 51(5), 541–552 (2002). doi:10.1109/TC.2002.1004593

    Article  MathSciNet  Google Scholar 

  32. Nam, J., Kim, S., Park, S., Won, D.: Security analysis of a nonce-based user authentication scheme using smart cards. IEICE Trans. Fundam. Electron. Commun. Comput. Sci. E90–A(1), 299–302 (2007)

    Article  Google Scholar 

  33. Nam, J., Paik, J., Kang, H.K., Kim, U.M., Won, D.: An off-line dictionary attack on a simple three-party key exchange protocol. IEEE Commun. Lett. 13(3), 205–207 (2009)

    Article  Google Scholar 

  34. Niu, Y., Wang, X.: An anonymous key agreement protocol based on chaotic maps. Commun. Nonlinear Sci. Numer. Simul. 16(4), 1986–1992 (2011)

    Article  MATH  MathSciNet  Google Scholar 

  35. Phan, R.C.W., Yau, W.C., Goi, B.M.: Cryptanalysis of simple three-party key exchange protocol (S-3PAKE). Inf. Sci. 178(13), 2849–2856 (2008)

    Article  MATH  MathSciNet  Google Scholar 

  36. Phan, R.C.W., Yau, W.C., Goi, B.M.: Analysis of two pairing-based three-party password authenticated key exchange protocols. In: Xiang, Y., Lopez, J., Wang, H., Zhou, W. (eds.) Proceedings of the Third International Conference on Network and System Security, pp. 102–106. IEEE Computer Society, Gold Coast, Queensland (2009)

    Google Scholar 

  37. Song, R.: Advanced smart card based password authentication protocol. Comput. Stand. Interfaces 32(5–6), 321–325 (2010)

    Article  Google Scholar 

  38. Stern, J.: Why provable security matters? In: Biham, E. (ed.) EUROCRYPT. Lecture Notes in Computer Science, vol. 2656, pp. 449–461. Springer, Berlin (2003)

    Google Scholar 

  39. Strangio, M.: On the resilience of key agreement protocols to key compromise impersonation. In: Atzeni, A., Lioy, A. (eds.) Public Key Infrastructure. Lecture Notes in Computer Science, vol. 4043, pp. 233–247. Springer, Berlin Heidelberg (2006)

    Chapter  Google Scholar 

  40. Sun, D.Z., Huai, J.P., Sun, J.Z., Li, J.X., Zhang, J.W., Feng, Z.Y.: Improvements of Juang ’s password-authenticated key agreement scheme using smart cards. IEEE Trans. Ind. Electron. 56(6), 2284–2291 (2009)

    Article  Google Scholar 

  41. Tan, Z.: A chaotic maps-based authenticated key agreement protocol with strong anonymity. Nonlinear Dyn. 72(1–2), 311–320 (2013)

    Article  MATH  Google Scholar 

  42. Tseng, H.R., Jan, R.H., Yang, W.: A chaotic maps-based key agreement protocol that preserves user anonymity. In: IEEE International Conference on Communications (ICC ’09), pp. 1–6 (2009). doi:10.1109/ICC.2009.5198581

  43. Wang, D., Ma, C.G.: Cryptanalysis of a remote user authentication scheme for mobile client-server environment based on ECC. Inf. Fusion (2013). doi:10.1016/j.inffus.2012.12.002

  44. Wang, X., Liu, L.: Cryptanalysis of a parallel sub-image encryption method with high-dimensional chaos. Nonlinear Dyn. 73(1–2), 795–800 (2013)

    Article  MATH  Google Scholar 

  45. Wang, X., Wang, X., Zhao, J., Zhang, Z.: Chaotic encryption algorithm based on alternant of stream cipher and block cipher. Nonlinear Dyn. 63(4), 587–597 (2011)

    Article  MathSciNet  Google Scholar 

  46. Wang, X., Zhao, J.: An improved key agreement protocol based on chaos. Commun. Nonlinear Sci. Numer. Simul. 15(12), 4052–4057 (2010)

    Article  MATH  MathSciNet  Google Scholar 

  47. Wang, X.Y., Yang, L., Liu, R., Kadir, A.: A chaotic image encryption algorithm based on perceptron model. Nonlinear Dyn. 62(3), 615–621 (2010)

    Article  MATH  Google Scholar 

  48. Wang, Y., Wong, K.W., Liao, X., Xiang, T.: A block cipher with dynamic s-boxes based on tent map. Commun. Nonlinear Sci. Numer. Simul. 14(7), 3089–3099 (2009)

    Article  MATH  MathSciNet  Google Scholar 

  49. Xiang, T., Wong, Kw, Liao, X.: An improved chaotic cryptosystem with external key. Commun. Nonlinear Sci. Numer. Simul. 13(9), 1879–1887 (2008)

    Article  MATH  MathSciNet  Google Scholar 

  50. Xiao, D., Liao, X., Deng, S.: A novel key agreement protocol based on chaotic maps. Inf. Sci. 177(4), 1136–1142 (2007)

  51. Xue, K., Hong, P.: Security improvement on an anonymous key agreement protocol based on chaotic maps. Commun. Nonlinear Sci. Numer. Simul. 17(7), 2969–2977 (2012)

    Article  MATH  MathSciNet  Google Scholar 

  52. Yang, J.Z., Wang, Y.J., Qian, H.F., Zhou, Y.: On the security of two password authenticated key agreement scheme using smart cards. J. China Univ. Posts Telecommun. 19(Supplement 1), 137–141 (2012)

  53. Yau, W.C., Phan, R.C.W., Goi, B.M., Heng, S.H.: Cryptanalysis of a provably secure cross-realm client-to-client password-authenticated key agreement protocol of CANS ’09. In: Lin, D., Tsudik, G., Wang, X. (eds.) CANS. Lecture Notes in Computer Science, vol. 7092, pp. 172–184. Springer, Berlin (2011)

    Google Scholar 

  54. Yau, W.C., Phan, R.W.: Security analysis of a chaotic map-based authentication scheme for telecare medicine information systems. J. Med. Syst. 37(6), 1–9 (2013)

    Article  Google Scholar 

  55. Yoon, E.J.: Efficiency and security problems of anonymous key agreement protocol based on chaotic maps. Commun. Nonlinear Sci. Numer. Simul. 17(7), 2735–2740 (2012)

    Article  MATH  MathSciNet  Google Scholar 

  56. Zhang, L.: Cryptanalysis of the public key encryption based on multiple chaotic systems. Chaos Solitons Fractals 37(3), 669–674 (2008)

    Article  MATH  MathSciNet  Google Scholar 

  57. Zhang, Y., Li, C., Li, Q., Zhang, D., Shu, S.: Breaking a chaotic image encryption algorithm based on perceptron model. Nonlinear Dyn. 69(3), 1091–1096 (2012)

    Article  MATH  MathSciNet  Google Scholar 

  58. Zhao, F., Gong, P., Li, S., Li, M., Li, P.: Cryptanalysis and improvement of a three-party key agreement protocol using enhanced chebyshev polynomials. Nonlinear Dyn, 74(1–2), 419–427 (2013)

Download references

Author information

Authors and Affiliations

  1. Faculty of Engineering, Multimedia University, Cyberjaya, Selangor, Malaysia

    Wei-Chuen Yau & Raphael C.-W. Phan

Authors
  1. Wei-Chuen Yau
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Raphael C.-W. Phan
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Wei-Chuen Yau.

Rights and permissions

Reprints and Permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Yau, WC., Phan, R.CW. Cryptanalysis of a chaotic map-based password-authenticated key agreement protocol using smart cards. Nonlinear Dyn 79, 809–821 (2015). https://doi.org/10.1007/s11071-014-1704-7

Download citation

  • Received:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s11071-014-1704-7

Keywords

search

Navigation