新的口令認(rèn)證密鑰協(xié)商協(xié)議

針對服務(wù)器泄漏攻擊，給出了抵抗這種攻擊的方法，提出了一個新的基于口令的認(rèn)證密鑰協(xié)商協(xié)議。在該方案中，用戶記住自己的口令，而服務(wù)器僅僅存儲與口令對應(yīng)的驗證信息。分析結(jié)果表明，該方案可以抵抗服務(wù)器泄漏攻擊、字典攻擊和Denning-Sacco攻擊等，并且具有前向安全性等性質(zhì)。
關(guān) 鍵 詞 字典攻擊; 密鑰協(xié)商; 口令認(rèn)證; 服務(wù)器泄漏攻擊

Attack, a method of resisting server compromise attack is given and a new password-based authenticated key agreement protocol is proposed. In this protocol, one side (the client) stores a plaintext version of the password, while the other side (the server) only stores a verifier for the password. The analysis of this new protocol shows that the protocol is secure against server compromise attack, dictionary attack,and the Denning-Sacco attack, and provides the property of the perfect forward secrecy.
Key words dictionary attack; key agreement; password authentication; server compromise attack