Password Authenticated Key Exchange for Resource-Constrained Wireless Communications (Extended Abstract)

  • Duncan S. Wong
  • Agnes H. Chan
  • Feng Zhu
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 3421)


With the advancement of wireless technology and the increasing demand for resource-constrained mobile devices, secure and efficient password authenticated key exchange (PAKE) protocols are needed for various kinds of secure communications among low-power wireless devices. In this paper, we introduce an elliptic curve based password-keyed permutation family and use it to construct a PAKE in such a way that it is suitable for efficient implementation on low-power devices. The computation time on each side of our PAKE is estimated to be about 3.4 seconds and can be reduced to 1.5 seconds with precomputation on an embedded device with a low-end 16MHz DragonBall-EZ microprocessor. On its security, we show that the password-keyed permutation family is secure against offline dictionary attack under the assumption that the elliptic curve computational Diffie-Hellman problem is intractable.

Index Terms: Authentication Protocol, Key Exchange, Wireless Communications.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Bellare, M., Pointcheval, D., Rogaway, P.: Authenticated key exchange secure against dictionary attacks. In: Preneel, B. (ed.) EUROCRYPT 2000. LNCS, vol. 1807, p. 139. Springer, Heidelberg (2000)CrossRefGoogle Scholar
  2. 2.
    Bellare, M., Rogaway, P.: Random oracles are practical: A paradigm for designing efficient protocols. In: First ACM Conference on Computer and Communications Security, pp. 62–73. ACM Press, New York (1993)CrossRefGoogle Scholar
  3. 3.
    Bellovin, S.M., Merritt, M.: Encrypted key exchange: Password based protocols secure against dictionary attacks. In: Proceedings 1992 IEEE Symposium on Research in Security and Privacy, pp. 72–84. IEEE Computer Society, Los Alamitos (1992)CrossRefGoogle Scholar
  4. 4.
    Gong, L., Lomas, M., Needham, R., Saltzer, J.: Protecting poorly chosen secrets from guessing attacks. IEEE J. on Selected Areas in Communications 11(5), 648–656 (1993)CrossRefGoogle Scholar
  5. 5.
    IEEE. P1363 - 2000: Standard Specifications For Public Key Cryptography (2000)Google Scholar
  6. 6.
    IEEE. P1363.2 / D15: Standard Specifications for Password-based Public Key Cryptographic Techniques (May 2004)Google Scholar
  7. 7.
    Jablon, D.: Strong password-only authenticated key exchange. Computer Communication Review, ACM 26(5), 5–26 (1996)CrossRefGoogle Scholar
  8. 8.
    Jablon, D.: Extended password key exchange protocols immune to dictionary attack. In: Proc. of the WETICE 1997 Workshop on Enterprise Security, Cambridge, MA, USA (June 1997)Google Scholar
  9. 9.
    Kobara, K., Imai, H.: Pretty-simple password-authenticated key-exchange under standard assumptions. IEICE Trans. E85-A(10), 2229–2237 (2002)Google Scholar
  10. 10.
    MacKenzie, P.: More efficient password-authenticated key exchange. In: Naccache, D. (ed.) CT-RSA 2001. LNCS, vol. 2020, p. 361. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  11. 11.
    MacKenzie, P., Patel, S., Swaminathan, R.: Password-authenticated key exchange based on RSA. In: Okamoto, T. (ed.) ASIACRYPT 2000. LNCS, vol. 1976, pp. 599–613. Springer, Heidelberg (2000)CrossRefGoogle Scholar
  12. 12.
    Ueli, M.: Maurer and Stefan Wolf. The Diffie-Hellman protocol. Designs, Codes and Cryptography 19, 147–171 (2000)MATHCrossRefGoogle Scholar
  13. 13.
    Menezes, A.: Elliptic Curve Public Key Cryptosystems. Kluwer Academic Publishers, Dordrecht (1993)MATHGoogle Scholar
  14. 14.
    Wang, Y.: EC-SRP. Submission to IEEE P1363 Study Group, June 2001, updated May 2002 (May 2002)Google Scholar
  15. 15.
    Weimerskirch, A., Paar, C., Chang Shantz, S.: Elliptic curve cryptography on a Palm OS device. In: Varadharajan, V., Mu, Y. (eds.) ACISP 2001. LNCS, vol. 2119, pp. 502–513. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  16. 16.
    Wong, D., Chan, A., Zhu, F.: More efficient password authenticated key exchange based on RSA. In: Johansson, T., Maitra, S. (eds.) INDOCRYPT 2003. LNCS, vol. 2904, pp. 375–387. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  17. 17.
    Wu, T.: The secure remote password protocol. In: 1998 Internet Society Symposium on Network and Distributed System Security, pp. 97–111 (1998)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2005

Authors and Affiliations

  • Duncan S. Wong
    • 1
  • Agnes H. Chan
    • 2
  • Feng Zhu
    • 2
  1. 1.Department of Computer ScienceCity University of Hong KongHong Kong
  2. 2.College of Computer and Information ScienceNortheastern UniversityBostonU.S.A

Personalised recommendations