QUT ePrints

Multi-factor password-authenticated key exchange

Stebila, Douglas, Udupi, Poornaprajna, & Chang, Sheueling (2010) Multi-factor password-authenticated key exchange. In Boyd, Colin & Susilo, Willy (Eds.) Conferences in Research and Practice in Information Technology, Australian Computer Society, Queensland University of Technology, Brisbane, Queensland.

View at publisher

Abstract

We consider a new form of authenticated key exchange which we call multi-factor password-authenticated key exchange, where session establishment depends on successful authentication of multiple short secrets that are complementary in nature, such as a long-term password and a one-time response, allowing the client and server to be mutually assured of each other's identity without directly disclosing private information to the other party.

Multi-factor authentication can provide an enhanced level of assurance in higher-security scenarios such as online banking, virtual private network access, and physical access because a multi-factor protocol is designed to remain secure even if all but one of the factors has been compromised.

We introduce a security model for multi-factor password-authenticated key exchange protocols, propose an efficient and secure protocol called MFPAK, and provide a security argument to show that our protocol is secure in this model. Our security model is an extension of the Bellare-Pointcheval-Rogaway security model for password-authenticated key exchange and accommodates an arbitrary number of symmetric and asymmetric authentication factors.

Impact and interest:

Citation countsare sourced monthly from Scopus and Web of Science® citation databases.

These databases contain citations from different subsets of available publications and different time periods and thus the citation count from each is usually different. Some works are not in either database and no count is displayed. Scopus includes citations from articles published in 1996 onwards, and Web of Science® generally from 1980 onwards.

Citations counts from the Google Scholar™ indexing service can be viewed at the linked Google Scholar™ search.

Full-text downloads:

159 since deposited on 29 Jan 2010
34 in the past twelve months

Full-text downloadsdisplays the total number of times this work’s files (e.g., a PDF) have been downloaded from QUT ePrints as well as the number of downloads in the previous 365 days. The count includes downloads for all files if a work has more than one.

ID Code: 30101
Item Type: Conference Paper
Additional URLs:
Keywords: multi-factor authentication, passwords, key exchange, cryptographic protocols
ISBN: 9781920682866
ISSN: 1445-1336
Subjects: Australian and New Zealand Standard Research Classification > INFORMATION AND COMPUTING SCIENCES (080000) > DATA FORMAT (080400) > Data Encryption (080402)
Divisions: Past > Institutes > Information Security Institute
Copyright Owner: Copyright 2010 Australian Computer Society
Copyright Statement: General permission to republish, but not for profit, all or part of this material is granted, provided that the JRPIT copyright notice is given and that reference is made to the publication, to its date of issue, and to the fact that reprinting privileges were granted by permission of the Australian Computer Society Inc.
Deposited On: 29 Jan 2010 11:35
Last Modified: 01 Mar 2012 00:18

Export: EndNote | Dublin Core | BibTeX

Repository Staff Only: item control page