Multi-factor password-authenticated key exchange
Stebila, Douglas, Udupi, Poornaprajna, & Chang, Sheueling (2010) Multi-factor password-authenticated key exchange. In Boyd, Colin & Susilo, Willy (Eds.) Conferences in Research and Practice in Information Technology, Australian Computer Society, Queensland University of Technology, Brisbane, Queensland.
We consider a new form of authenticated key exchange which we call multi-factor password-authenticated key exchange, where session establishment depends on successful authentication of multiple short secrets that are complementary in nature, such as a long-term password and a one-time response, allowing the client and server to be mutually assured of each other's identity without directly disclosing private information to the other party.
Multi-factor authentication can provide an enhanced level of assurance in higher-security scenarios such as online banking, virtual private network access, and physical access because a multi-factor protocol is designed to remain secure even if all but one of the factors has been compromised.
We introduce a security model for multi-factor password-authenticated key exchange protocols, propose an efficient and secure protocol called MFPAK, and provide a security argument to show that our protocol is secure in this model. Our security model is an extension of the Bellare-Pointcheval-Rogaway security model for password-authenticated key exchange and accommodates an arbitrary number of symmetric and asymmetric authentication factors.
Impact and interest:
Citation counts are sourced monthly from and citation databases.
Citations counts from theindexing service can be viewed at the linked Google Scholar™ search.
|Item Type:||Conference Paper|
|Keywords:||multi-factor authentication, passwords, key exchange, cryptographic protocols|
|Subjects:||Australian and New Zealand Standard Research Classification > INFORMATION AND COMPUTING SCIENCES (080000) > DATA FORMAT (080400) > Data Encryption (080402)|
|Divisions:||Past > Institutes > Information Security Institute|
|Copyright Owner:||Copyright 2010 Australian Computer Society|
|Copyright Statement:||General permission to republish, but not for profit, all or part of this material is granted, provided that the JRPIT copyright notice is given and that reference is made to the publication, to its date of issue, and to the fact that reprinting privileges were granted by permission of the Australian Computer Society Inc.|
|Deposited On:||29 Jan 2010 01:35|
|Last Modified:||29 Feb 2012 14:18|
Repository Staff Only: item control page