关键词: 信息安全, 密钥协商, 口令, 中间人攻击

Abstract: Password-based Authenticated Key Agreement (PAKA) is an important research point of Authenticated Key Agreement (AKA) protocols. The authors analyzed a new protocol named three-party Round Efficient Key Agreement (3REKA) and found that if the verification values were stolen or lost, the adversary could initiate the man-in-the-middle attack. The result of this attack was serious: the adversary could establish two session keys with two different participants. This attack was described and an improved protocol called Improved 3REKA (I-3REKA) was proposed in this paper. The analysis on the security and performance show that the proposed protocol can realize secure communication with lower computational cost.

Key words: information security, key agreement, password, man-in-the-middle attack