改进的具有PFS特性的口令认证密钥协商方案.PDF

改进的具有 PFS 特性的口令认证密钥协商方案 汪定 1 1 2 2 ，马春光 ，翁臣 ，贾春福 （1.哈尔滨工程大学计算机科学与技术学院，黑龙江 哈尔滨 150001； 2.南开大学信息技术科学学院，天津 300071） 摘要：身份认证和密钥协商是确保信息系统安全的重要手段，基于智能卡的口令认证密钥协商协议由于实用性较 强而成为近期研究热点. 讨论了 Hao 等新近提出的具有完备前向安全性（Perfect Forward Secrecy, PFS ）的基于智 能卡的远程用户口令认证密钥协商方案，指出该方案无法实现所声称的在非抗窜扰智能卡假设下抗离线口令猜测 攻击，对密钥泄露仿冒攻击是脆弱的，并且存在时钟同步问题，不适于分布式网络应用. 给出一个改进方案，用 随机数代替时间戳来实现消息的新鲜性，对其进行了安全性和效率分析. 分析结果表明，改进方案弥补了原方案 的安全缺陷，保持了较高的效率，适于分布式网络应用环境. 关键词：身份认证；智能卡；口令猜测攻击；密钥泄露仿冒攻击 中图分类号：TP309.08 文献标识码：A Improved Password-based Key Agreement Scheme with Perfect Forward Secrecy 1 1 2 2 WANG Ding ，MA Chun-guang ，WENG Chen ，JIA Chun-fu (1. College of Computer Science and Technology, Harbin Engineering University, Harbin 150001, Heilongjiang, China; 2. College of Information Technology Science, Nankai University, Tianjin 30071, China) Abstract: With identity authentication and key agreement becoming an essential mechanism to ensure robust system security in distributed networks, smartcard-based remote user password authentication protocols have been studied intensively for their great practicality. This paper points out that a recent smartcard-based password authentication scheme with Perfect Forward Secrecy (PFS) proposed by Hao et al. cannot achieve the claimed security and reports its following flaws: 1) It is vulnerable to offline password guessing attack and key compromise impersonation attack; 2) It has the problems of no poor repairability and time-synchroni