Analysis of the SPEKE Password Authenticated Key Exchange

Analysis of the SPEKE Password. Authenticated Key Exchange Protocol n n Source: IEEE COMMUNICATIONS LETTERS, Vol. 8, No. 1, Jan. 2004, pp. 63 -65 Authors: Muxiang Zhang Speaker: Chia-Chi Wu Date: 2004/10/6 1

Outline § SPEKE Password-authenticated Key Exchange n A Fully constrained SPEKE n Password Guessing Attack on SPEKE n Conclusions 2

Notations n n n n Role: A, B : The password shared by A and B. : The set of all possible passwords. r. A, r. B: random numbers chosen by A, and B. f (S): a function that converts S into suitable DH base. h( ) : a strong one-way hash function. K: generated session key. 3

Primitive Roots n If p is a prime, g Gp, then g is a primitive root mod p if for each b from 1 to p-1, there exists some a where ga b mod p. 21=1 mod 11 22=2 mod 11 23=8 mod 11 24=5 mod 11 25=10 mod 11 26=9 mod 11 27=7 mod 11 28=3 mod 11 29=6 mod 11 210=1 mod 11 P=11, g=2, T=10 (10)=4 , {1, 3, 7, 9} 21=2 mod 11 23=8 mod 11 27=7 mod 11 29=6 mod 11 4

SPEKE Password-authenticated Key Exchange SPEKE(Simple Password Exponential Key Exchange) x. A =f( )r. A mod p, r. A Zp* x. B=f( )r. B mod p , r. B Zp* h(h(K)) K= x. Br. A mod p h(K) A B K= x. Br. A mod p = f( )r. B*r. A mod p = f( ) r. A*r. B mod p = x. Ar. B mod p 5

Subgroups of ZP* for a safe prime p=2 q+1 GP-1 Gq G 2 P-1 1 G 1 generator of Gq primitive roots We know XA(p-1)/t is of order q. Consider any Gt and Gq, q is prime, and t<q. We can see that intersection Gt Gq=G 1. Since K Gq, if K is also confined to Gt, then K G 1, or K=1. 6

A Fully constrained SPEKE n n Assume that the password space is a small subset of Zp*. P is a safe prime: n n P=2 q+1 and q is also a prime. f( )= 2 mod P n =0, 1, p-1 are excluded. 7

A Fully constrained SPEKE x. A =( 2)r. A mod p, r. A Zp* x. B, h(h(h(K))) x. B =( 2 )r. B mod p , r. B Zp* K= (x. A 2)r. B mod p (Note: K>2) h(h(K)) A B K= (x. A 2)r. B mod p =(( 2) r. A)2*r. B mod p = (( 2) r. B)2*r. A mod p = (x. B 2)r. A mod p session key: h(K) 8

Password Guessing Attack on SPEKE n n a=bi mod p i=logab (without mod p) We say that b and a are exponentially equivalent Assume that there are m passwords, say 1, 2, …, m, which are exponentially equivalent to a integer a, that is, 1=aj 1, 2=aj 2, …, m=ajm n {2, 4, 8, …}, {3, 9, 27, …}, {5, 25, 125, …}, {6, 36, 216…} 9

Password Guessing Attack on SPEKE 1. E picks a random r and compute x=ar mod p x x. B, h(h(h(K))) 2. x. B =( 2 )r. B mod p , r. B Zp* K= (x 2)r. B mod p , V=h(h(h(K))) (Note: K>2) 3. E aborts after receiving x. B and V from B. E B 10

Password Guessing Attack on SPEKE n n n § E performs off-line password guessing on . E computes the inverse of j 1, j 2, …, jm mod p-1. For each i , 1 i m, E computes -1 Ki=(x. B)rji mod p Vi=h(h(h(Ki))) If the password of B is equal to i=aji, then -1 Ki= (x. B)r ji mod p -1 =( i 2)r. B r ji mod p -1 =(a 2 ji)r. B r ji mod p =x 2 r. B mod p =K E checks if V=Vi for every 1 i m. If V=Vi , then the password of B is i. . 11

Conclusions n n n It can attack generic SPEKE protocol. (when f( ) is used as the base for exponentiation) The adversary can test multiple possible passwords in an impersonation. A hash function is no guarantee that all passwords are exponentially inequivalent. 12