Forward Secrecy in Password-Only Key Exchange Protocols

  • Jonathan Katz
  • Rafail Ostrovsky
  • Moti Yung
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 2576)


Password-only authenticated key exchange (PAKE) protocols are designed to be secure even when users choose short, easilyguessed passwords. Security requires, in particular, that the protocol cannot be broken by an off-line dictionary attack in which an adversary enumerates all possible passwords in an attempt to determine the correct one based on previously-viewed transcripts. Recently, provably-secure protocols for PAKE were given in the idealized random oracle/ideal cipher models [2],[8],[19] and in the standard model based on general assumptions [11] or the DDH assumption [14].

The latter protocol (the KOY protocol ) is currently the only known practical solution based on standard assumptions. However, only a proof of basic security for this protocol has appeared. In the basic setting the adversary is assumed not to corrupt clients (thereby learning their passwords) or servers (thereby modifying the value of stored passwords). Simplifying and unifying previous work, we present a natural definition of security which incorporates the more challenging requirement of forward secrecy. We then demonstrate via an explicit attack that the KOY protocol as originally presented is not secure under this definition. This provides the first natural example showing that forward secrecy is a strictly stronger requirement for PAKE protocols. Finally, we present a slight modification of the KOY protocol which prevents the attack and — as the main technical contribution of this paper — rigorously prove that the modified protocol achieves forward secrecy.


Random Oracle Forward Secrecy Test Query Protocol Execution Dictionary Attack 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    M. Bellare, R. Canetti, and H. Krawczyk. A Modular Approach to the Design and Analysis of Authentication and Key Exchange Protocols. STOC’ 98.Google Scholar
  2. 2.
    M. Bellare, D. Pointcheval, and P. Rogaway. Authenticated Key Exchange Secure Against Dictionary Attacks. Eurocrypt’ 00.Google Scholar
  3. 3.
    M. Bellare and P. Rogaway. Entity Authentication and Key Distribution. Crypto’ 93.Google Scholar
  4. 4.
    M. Bellare and P. Rogaway. Provably-Secure Session Key Distribution: the Three Party Case. STOC’ 95.Google Scholar
  5. 5.
    S.M. Bellovin and M. Merritt. Encrypted Key Exchange: Password-Based Protocols Secure Against Dictionary Attacks. IEEE Symposium on Research in Security and Privacy, IEEE, 1992, pp. 72–84.Google Scholar
  6. 6.
    R. Bird, I. Gopal, A. Herzberg, P. Janson, S. Kutten, R. Molva, and M. Yung. Systematic Design of Two-Party Authentication Protocols. Crypto’ 91.Google Scholar
  7. 7.
    M. Boyarsky. Public-Key Cryptography and Password Protocols: The Multi-User Case. ACM CCCS’ 99.Google Scholar
  8. 8.
    V. Boyko, P. MacKenzie, and S. Patel. Provably-Secure Password-Authenticated Key Exchange Using Difie-Hellman. Eurocrypt’ 00.Google Scholar
  9. 9.
    W. Difie and M. Hellman. New Directions in Cryptography. IEEE Transactions on Information Theory, 22(6): 644–654 (1976).CrossRefGoogle Scholar
  10. 10.
    W. Difie, P. van Oorschot, and M. Wiener. Authentication and Authenticated Key Exchanges. Designs, Codes, and Cryptography, 2(2): 107–125 (1992).CrossRefMathSciNetGoogle Scholar
  11. 11.
    O. Goldreich and Y. Lindell. Session-Key Generation Using Human Passwords Only. Crypto’ 01.Google Scholar
  12. 12.
    S. Halevi and H. Krawczyk. Public-Key Cryptography and Password Protocols. ACM Transactions on Information and System Security, 2(3): 230–268 (1999).CrossRefGoogle Scholar
  13. 13.
    J. Katz. Efficient Cryptographic Protocols Preventing “Man-in-the-Middle” Attacks. PhD thesis, Columbia University, 2002.Google Scholar
  14. 14.
    J. Katz, R. Ostrovsky, and M. Yung. Efficient Password-Authenticated Key Exchange Using Human-Memorable Passwords. Eurocrypt’ 01.Google Scholar
  15. 15.
    T.M.A. Lomas, L. Gong, J.H. Saltzer, and R.M. Needham. Reducing Risks from Poorly-Chosen Keys. ACM Operating Systems Review, 23(5): 14–18 (1989).CrossRefGoogle Scholar
  16. 16.
    P. MacKenzie. More Efficient Password-Authenticated Key Exchange. RSA’ 01.Google Scholar
  17. 17.
    P. MacKenzie. On the Security of the SPEKE Password-Authenticated Key-Exchange Protocol. Manuscript, 2001.Google Scholar
  18. 18.
    P. MacKenzie. Personal communication. April, 2002.Google Scholar
  19. 19.
    P. MacKenzie, S. Patel, and R. Swaminathan. Password-Authenticated Key Exchange Based on RSA. Asiacrypt’ 00.Google Scholar
  20. 20.
    V. Shoup. On Formal Models for Secure Key Exchange. Available at
  21. 21.
    T. Wu. The Secure Remote Password Protocol. Proceedings of the Internet Society Symposium on Network and Distributed System Security, 1998, pp. 97–111.Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2003

Authors and Affiliations

  • Jonathan Katz
    • 1
  • Rafail Ostrovsky
    • 2
  • Moti Yung
    • 3
  1. 1.Department of Computer ScienceUniversity of Maryland (College Park)Maryland
  2. 2.Telcordia Technologies, Inc.Maryland
  3. 3.Department of Computer ScienceColumbia UniversityMaryland

Personalised recommendations