Security analysis of password-authenticated key agreement protocols

Abstract

Recently, there have been proposed a number of password-authenticated key agreement protocols for two-party setting or three-party setting. In this paper, we show that recently proposed three password-authenticated key agreement protocols in [11, 12, 10] are insecure against several active attacks including a stolen-verifier attack, an off-line password guessing attack and impersonation attacks. © Springer-Verlag Berlin Heidelberg 2005.