For the past decades, an extensive variety of cryptographic protocols have been suggested to resolve secure communication problems even in the occurrence of challenger. The assortment of this work varies from developing fundamental security primitives providing confidentiality and authenticity to solving more difficult, application-specific problems. With rapid developments in perimeters and potential of communications and information broadcasts, there is a rising require of authentication protocol. However, when these protocols are deployed in practice, a significant challenge is to ensure not just security but also privacy throughout these protocols’s lifetime. As computer-based devices are more extensively used and the Internet is more globally accessible, new types of applications and new types of privacy threats are being introduced to password privacy in the context of authenticated key exchange (AKE). Especially, we show that AKE protocols provably meeting the existing formal definitions do not accomplish the anticipated level of password privacy when organized in the real world.

Authenticated Key exchanges (AKE), Authentication, AMEA, minimum space complexity, Symmetric Key, attacks

[1] Ding Y, Horster P. Undetectable on-line password guessing attacks. ACM Operat Syst Rev V29 (4), pp.77-86, 1995.
[2] S Lucks, Open key exchange: how to defeat dictionary attacks without encrypting public keys. Proc of Security Protocol Workshop (Springer, Heidelberg, 1997) 1361, pp. 79–90 LNCS
[3] P MacKenzie, S Patel, R Swaminathan, Password-authenticated key exchange based on RSA (Springer, Heidelberg, 2000) 1976, pp. 599–613 SIACRYPT 2000, LNCS
[4] MX Zhang, New approaches to password authenticated key exchange based on RSA (Springer, Heidelberg, 2004) 3329, pp. 230–244 ASIACRYPT 2004, LNCS
[5] S Park, J Nam, S Kim, D Won, Efficient password-authenticated key exchange based on RSA (Springer, Heidelberg, 2007) 4377, pp. 309–323 CT-RSA 2007, LNCS
[6] Chen TH, Lee WB. A new method for using hash functions to solve remote user authentication, Comput Electr Eng, v34 (1), pp.53-62, 2008.
[7] Yeh HT, Sun HM. Password authenticated key exchange protocols among diverse network domains, Comput Electr Eng, v31(3) pp.175-189, 2005.
[8] O. Blazy, D. Pointcheval, and D. Vergnaud. Round-Optimal privacy-preserving protocols with smooth projective hash functions. In TCC'12, pages 94-111. Springer-Verlag, 2012.
[9] J. Camenisch, N. Casati, T. Gross, and V. Shoup. Credential authenticated identification and key exchange. In CRYPTO'10, pages 255{276. Springer-Verlag, 2010.
[10] A. O. Freier, P. Karlton, and P. C. Kocher, The SSL Protocol Version 3.0. INTERNET-DRAFT, Nov. 1996. Available at http://www.netscape.com/eng/ssl3/draft302.txt.
[11] T. Dierks and C. Allen, “The TLS Protocol Version 1.0. IETF RFC 2246, Jan. 1999.
[12] M. Bellare and P. Rogaway, “Provably secure session key distribution the three party cases," in Proc. 27th ACM Symp. On Theory of Computing, (Las Vegas), pp. 57{66, ACM, 1995.
[13] A. Aziz and W. Diffie, “Privacy and authentication for wireless local area networks," IEEE Personal Communications, vol. 1, no. 1, pp. 25-31, 1994.
[14] S. Bellovin and M. Merritt, “Encrypted key exchange: password-based protocols secure against dictionary attacks," IEEE Computer Society Symposium on Research in Security and Privacy, pp. 72-84, May 1992.
[15] W. Diffie and M. E. Hellman, “New directions in cryptography," IEEE Trans. Inform. Theory, vol. IT-22, pp. 644-654, Nov 1976.
[16] Chun-Li Lin, Hung-Min Sun, and Tzonelih Hwang. Three-party encrypted key exchange: attacks and a solution. SIGOPS Oper. Syst. Rev., 34(4):12–20, 2000.
[17] Chun-Li Lin, Hung-Min Sun, M. Steiner, and T. Hwang. Three-party encrypted key exchange without server public-keys. IEEE Communications Letters, 5(12):497–499, Dec 2001.
[18] Shuhua Wu, Kefei Chen, and Yuefei Zhu, “Enhancements of a Three-Party Password-Based Authenticated Key Exchange Protocol” The International Arab Journal of Information Technology, Vol. 10, No. 3, May 2013.
[19] Maryam Saeed, Ali Mackvandi, Mansour Naddafiun, Hamid reza Karimnejad, “An Enhanced password authenticated key exchange protocol without server public keys” 978-1-4673-4828-7/122012.
[20] Detection of Javascript Vulnerability At Client Agent”, International Journal of Scientific & Technology Research Volume 1, Issue 7, August 2012.
[21] Saket Gupta,Saurabh Jain,Rachana Mishra,” Automated Process of Server and Client Environment with attack alert based on DES”, 2014 Fourth International Conference on Communication Systems and NetworkTechnologies,2014.