Password guessing attack on a key exchange protocol based on ECDLP

Abstract

Authentication and key exchange are fundamental for establishing secure communication channels over public insecure networks. Three-party key exchange protocol is an important technique for two clients to agree a session key with the help of a trusted server who shares a human password with each client. Many protocols have been proposed for the requirements of security and efficiency over the years. For security consideration, we are concerned with the off-line password-guessing attack. We make the attack to a three-party key exchange protocol based on Elliptic Curve Discrete Logarithm Problem(ECDLP) and show that it is vulnerable against the off-line password-guessing attack. In fact, the off-line password-guessing attack is available for malicious participants and is effective to similar protocols. To avoid this problem, we give a suggestion to eliminate it and enforce the security.