This version corrects a few minor typos. Abstract. Password-based protocols for authenticated key exchange (AKE) are designed to work despite the use of passwords drawn from a space so small that an adversary might well enumerate, o line, all possible passwords. While several such protocols have been suggested, the underlying theory has been lagging. We begin by de ning a model for this problem, one rich enough to deal with password guessing, forward secrecy, server compromise, and loss of session keys. The one model can be used to de ne various goals. We take AKE (with \implicit" authentication) as the \basic" goal, and we give de nitions for it, and for entity-authentication goals as well. Then we prove correctness for the idea at the center of the Encrypted Key-Exchange (EKE) protocol of Bellovin and Merritt: we prove security, in an ideal-cipher model, of the two-ow protocol at the core of EKE.
Ballare et al. REF presented a method for the password-based authenticated key exchange (AKE) protocol which shows the correctness of Bellovin and Merritt's idea.
Authenticated Key Exchange Secure against Dictionary Attacks
EUROCRYPT
Computer Science