Two More Efficient Variants of the J-PAKE Protocol
Recently, the password-authenticated key exchange protocol J-PAKE of Hao and Ryan (Workshop on Security Protocols 2008) was formally proven secure in the algebraic adversary model by Abdalla et al. (IEEE S&P 2015). In this paper, we propose and examine two variants of J-PAKE - which we call RO-J-PAKE and CRS-J-PAKE - that each makes the use of two less zero-knowledge proofs than the original protocol. We show that they are provably secure following a similar strategy to that of Abdalla et al. We also study their efficiency as compared to J-PAKE’s, also taking into account how the groups are chosen. Namely, we treat the cases of subgroups of finite fields and elliptic curves. Our work reveals that, for subgroups of finite fields, CRS-J-PAKE is indeed more efficient than J-PAKE, while RO-J-PAKE is much less efficient. On the other hand, when instantiated with elliptic curves, both RO-J-PAKE and CRS-J-PAKE are more efficient than J-PAKE, with CRS-J-PAKE being the best of the three. Regardless of implementation, we note that RO-J-PAKE enjoys a looser security reduction than both J-PAKE and CRS-J-PAKE. CRS-J-PAKE has the tightest security proof, but relies on an additional trust assumption at setup time.
KeywordsPassword-authenticated key exchange J-PAKE Efficiency Random oracle Common reference string Zero-knowledge proof
We thank the anonymous reviewers for their helpful comments. The first and third authors are supported by the National Research Fund, Luxembourg (projects CORE-AToMS and INTER-Sequoia for the first, and project CORE-BRAIDS (junior track) for the second). The third author is also supported by the University of Luxembourg in an internal project REQUISITE. We want to thank Husen Wang for his help with respect to the EC instantiation in Sect. 2.4.
- 1.BlueKrypt (2015). http://www.keylength.com/en/4/
- 2.Firefox Sync (2015). https://www.mozilla.org/en-US/firefox/sync/
- 3.OpenSSL (2015). https://www.openssl.org/
- 4.Thread Protocol (2015). http://threadgroup.org/
- 5.Abdalla, M., Benhamouda, F., MacKenzie, P.: Security of the J-PAKE password-authenticated key exchange protocol. In: 2015 IEEE Symposium on Security and Privacy, SP 2015, pp. 571–587. IEEE Computer Society (2015)Google Scholar
- 6.Abdalla, M., Benhamouda, F., Pointcheval, D.: Public-Key encryption indistinguishable under plaintext-checkable attacks. In: Katz, J. (ed.) PKC 2015. LNCS, vol. 9020, pp. 332–352. Springer, Heidelberg (2015)Google Scholar
- 9.Bellare, M., Rogaway, P.: Random oracles are practical: a paradigm for designing efficient protocols. In: ACM Conference on Computer and Communications Security, pp. 62–73. ACM Press (1993)Google Scholar
- 10.Bellovin, S.M., Merritt, M.: Encrypted key exchange: password-based protocols secure against dictionary attacks. In: 1992 IEEE Symposium on Research in Security and Privacy, SP 1992, pp. 72–84 (1992)Google Scholar
- 24.MacKenzie, P.: The PAK Suite: Protocols for Password-Authenticated Key Exchange. DIMACS Technical report 2002-46 (2002)Google Scholar
- 28.Schnorr, C.-P.: Efficient identification and signatures for smart cards. In: Brassard, G. (ed.) CRYPTO 1989. LNCS, vol. 435, pp. 239–252. Springer, Heidelberg (1990)Google Scholar