I came across some password-based authenticated key exchange (PAKE) protocols that are based on the smooth projective hash function (SPHF) in the standard model. And I checked some related works, and most of them only considered the dictionary attack and forward security. I am wondering if this kind of PAKE via SPHF could prevent replay attacks? If it can prevent, why? Otherwise, how to fix this problem?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
And I checked some related works, and most of them only considered the dictionary attack and forward security.
Actually, a PAKE has two security goals:
That someone cannot recover the password from a number of exchanges (with any greater advantage than being able to test $N$ potential passwords using $N$ active attacks).
That someone will not be authenticated without knowing the password (or having a correct guess to it).
Both of these needs to be true even if the adversary has the transcripts of a large number of successful authentications.
The "replay attack" falls in an attempt to violate the second security property. If the related works did not specifically call that out, the security proofs they presented still need to address that (and if they don't, well, that's a hole in the proof).
All of the PAKEs I'm familiar with handle replay attacks; most of them because the initial message from both sides include some randomness that is different with each exchange, and which is stirred into the later computations; this implies that straight-forward replay attacks will fail. The exception is Opaque, which has a different defense against replay attacks; the difference is on the replay on the client side, The adversary can indeed replay the initial message (and get the repeat of the server side message; it doesn't stir in any randomness for this part of the exchange), however the adversary cannot then retrieve the client's private key (stored in some data encrypted with a key that the adversary does not know), and hence will fail in the next stage of the protocol.
-
$\begingroup$ Hi @poncho. Thanks, but I am still confusing how to prevent replay attack in PAKE, there are some classical PAKE papers, such as link.springer.com/chapter/10.1007/3-540-39200-9_33, eprint.iacr.org/2010/147.pdf, eprint.iacr.org/2014/432.pdf, eprint.iacr.org/2018/286.pdf, even the recent results, eprint.iacr.org/2020/320, eprint.iacr.org/2020/573, they did not discuss the replay attack, however. I guess I missed some important points. Or is it possible to provide some papers about PAKE that discussed replay attacks? $\endgroup$– Z.P.Jul 7, 2020 at 17:57
-
$\begingroup$ @Z.P.: the proof are typically simulation proofs; aimed at showing that if you can distinguish the protocol from a random distribution with greater than some small advantage, then you can solve some hard problem. These proofs assume that the adversary can implement one side of the exchange, and that he can use previous valid exchanges as reference, hence replay attacks are implicitly covered. $\endgroup$– ponchoJul 8, 2020 at 1:52