An Enhanced Dragonfly Key Exchange Protocol against Offline Dictionary Attack
- 1 Information Technology Department, King Abdul-Aziz University, Jeddah, KSA
- 2 Information Technology Department, King Abdul-Aziz University, Jeddah, KSA
- 3 Information Technology Department, King Abdul-Aziz University, Jeddah, KSA
Abstract
Dragonfly is Password Authenticated Key Exchange protocol that uses a shared session key to authenticate parties based on pre-shared secret password. It was claimed that this protocol was secure against off-line dictionary attack, but a new research has proved its vulnerability to off-line dictionary attack and proving step was applied by using “Patched Protocol” which was based on public key validation. Unfortunately, this step caused a raise in the computation cost, which made this protocol less appealing than its competitors. We proposed an alternate enhancement to keep this protocol secure without any extra computation cost that was known as “Enhanced Dragonfly”. This solution based on two-pre-shared secret passwords instead of one and the rounds between parties had compressed into two rounds instead of four. We prove that the enhanced-Dragonfly protocol is secure against off-line dictionary attacks by analyzing its security properties using the Scyther tool. A simulation was developed to measure the execution time of the enhanced protocol, which was found to be much less than the execution time of patched Dragonfly. The off-line dictionary attack time is consumed for few days if the dictionary size is 10,000. According to this, the use of the enhanced Dragonfly is more efficient than the patched Dragonfly.
- Stamp, M. (2007) Classic Ciphers in Applied Cryptanalysis: Breaking Ciphers in the Real World. Wiley-IEEE Press, Canada, 25. http://dx.doi.org/10.1002/9780470148778.ch2
- Kendhe, A.K. and Agrawal, H. (2013) A Survey Report on Various Cryptanalysis Techniques. International Journal of Soft Computing and Engineering (IJSCE), 3, 287-293.
- Lauter, K. and Mityagin, A. (2006) Security Analysis of KEA Authenticated Key Exchange Protocol. International Association for Cryptologic Research.
- Saeedetal, M. (2012) An Enhanced Password Authenticated Key Exchange Protocol without Server Public Keys. ICTC, 2012.
- Ali, R., Kumar, A. and Narayan, E. (2013) Encryptioan/Decryption Tool with Cryptanalysis. International Journal of Computer Science & Engineering Technology (IJCSET), 4, 1043-1050.
- Goyal, V., et al. (2005) CompChall: Addressing Password Guessing Attacks. ITCC 1, IEEE Computer Society.
- Bellovin, S.M. and Merritt, M. (1992) Encrypted Key Exchange: Password-Based Protocols Secure against Dictionary Attacks. Proceedings of IEEE Symposium on Security and Privacy, Oakland, 4-6 May 1992, 72-84. http://dx.doi.org/10.1109/RISP.1992.213269
- Kobara, K. and Imai, H. (2002) Pretty-Simple Password-Authenticated Key Exchange under Standard Assumptions. IEICE Transactions, E85-A(10), 2229-2237.
- Bellare, M., Pointcheval, D. and Rogaway, P. (2000) Authenticated Key Exchange Secure against Dictionary Attacks. Proceedings of the 2000 Advances in Cryptology (EUROCRYPT’2000). Springer-Verlag, Berlin, 139-155. http://dx.doi.org/10.1007/3-540-45539-6_11
- Bresson, E., Chevassut, O. and Pointcheval, D. (2004) New Security Results on Encrypted Key Exchange. In: Proc. PKC 2004, Lecture Notes in Computer Science, Vol. 2947, Springer-Verlag, Berlin, 145-158.
- Abdalla, M. and Pointcheval, D. (2005) Simple Password-Based Encrypted Key Exchange Protocols. Proceedings of Topics in Cryptology—CT-RSA, Lecture Notes in Computer Science, Vol. 3376, Springer-Verlag, Berlin, 191-208.
- Clarke, D. and Hao, F. (2013) Cryptanalysis of the Dragonfly Key Exchange Protocol.
- Saeed, M., Shahriar Shahhoseini, H. and Mackvandi, A. (2011) An Improved Two-Party Password Authenticated Key Exchange Protocol without Server’s Public Key. IEEE 3rd International Conference on Communication Software and Networks, Xi’an, 27-29 May 2011, 90-95.