College of Information Science, Kim Il Sung University, Pyongyang, DPR of Korea.
PLoS One. 2019 Mar 20;14(3):e0213976. doi: 10.1371/journal.pone.0213976. eCollection 2019.
Three-party authentication key exchange (3PAKE) is a protocol that allows two users to set up a common session key with the help of a trusted remote server, which is effective for secret communication between clients in a large-scale network environment. Since chaotic maps have superior characteristics, researchers have recently presented some of the studies that apply it to authentication key exchange and cryptography. Providing user anonymity in the authentication key exchange is one of the important security requirements to protect users' personal secrets. We analyse Lu et al.'s scheme which attempts to provide user anonymity and we prove that his scheme has errors in the key exchange phase and password change phase. We propose a round-effective three-party authentication key exchange (3PAKE) protocol that provides user anonymity and we analyse its security properties based on BAN logic and AVISPA tool.
三方认证密钥交换 (3PAKE) 协议允许两个用户在可信远程服务器的帮助下设置一个公共会话密钥，这对于大规模网络环境中客户端之间的秘密通信非常有效。由于混沌映射具有优越的特性，研究人员最近提出了一些将其应用于认证密钥交换和密码学的研究。在认证密钥交换中提供用户匿名性是保护用户个人隐私的重要安全要求之一。我们分析了 Lu 等人的方案，该方案试图提供用户匿名性，并证明其方案在密钥交换阶段和密码更改阶段存在错误。我们提出了一个轮有效三方认证密钥交换 (3PAKE) 协议，提供用户匿名性，并基于 BAN 逻辑和 AVISPA 工具分析其安全属性。
