TL;DR: In this article, the authors present a formalism for the analysis of key exchange protocols that combines previous definitional approaches and results in a definition of security that enjoys some important analytical benefits: (i) any key exchange protocol that satisfies the security definition can be composed with symmetric encryption and authentication functions to provide provably secure communication channels.

...read moreread less

Abstract: We present a formalism for the analysis of key-exchange protocols that combines previous definitional approaches and results in a definition of security that enjoys some important analytical benefits: (i) any key-exchange protocol that satisfies the security definition can be composed with symmetric encryption and authentication functions to provide provably secure communication channels (as defined here); and (ii) the definition allows for simple modular proofs of security: one can design and prove security of key-exchange protocols in an idealized model where the communication links are perfectly authenticated, and then translate them using general tools to obtain security in the realistic setting of adversary-controlled links. We exemplify the usability of our results by applying them to obtain the proof of two classes of key-exchange protocols, Diffie-Hellman and key-transport, authenticated via symmetric or asymmetric techniques.

...read moreread less

1,899 citations

Book Chapter•10.1007/3-540-45539-6_11•

Authenticated key exchange secure against dictionary attacks

[...]

Mihir Bellare¹, David Pointcheval², Phillip Rogaway³•Institutions (3)

University of California, San Diego¹, École Normale Supérieure², University of California, Davis³

14 May 2000

TL;DR: Correctness for the idea at the center of the Encrypted Key-Exchange protocol of Bellovin and Merritt is proved: it is proved security, in an ideal-cipher model, of the two-flow protocol at the core of EKE.

...read moreread less

Abstract: Password-based protocols for authenticated key exchange (AKE) are designed to work despite the use of passwords drawn from a space so small that an adversary might well enumerate, off line, all possible passwords. While several such protocols have been suggested, the underlying theory has been lagging. We begin by defining a model for this problem, one rich enough to deal with password guessing, forward secrecy, server compromise, and loss of session keys. The one model can be used to define various goals. We take AKE (with "implicit" authentication) as the "basic" goal, and we give definitions for it, and for entity-authentication goals as well. Then we prove correctness for the idea at the center of the Encrypted Key-Exchange (EKE) protocol of Bellovin and Merritt: we prove security, in an ideal-cipher model, of the two-flow protocol at the core of EKE.

...read moreread less

1,659 citations

Proceedings Article•10.1109/RISP.1992.213269•

Encrypted key exchange: password-based protocols secure against dictionary attacks

[...]

Steven M. Bellovin¹, Michael Merritt¹•Institutions (1)

Bell Labs¹

4 May 1992

TL;DR: A combination of asymmetric (public-key) and symmetric (secret- key) cryptography that allow two parties sharing a common password to exchange confidential and authenticated information over an insecure network is introduced.

...read moreread less

Abstract: Classic cryptographic protocols based on user-chosen keys allow an attacker to mount password-guessing attacks. A combination of asymmetric (public-key) and symmetric (secret-key) cryptography that allow two parties sharing a common password to exchange confidential and authenticated information over an insecure network is introduced. In particular, a protocol relying on the counter-intuitive motion of using a secret key to encrypt a public key is presented. Such protocols are secure against active attacks, and have the property that the password is protected against offline dictionary attacks. >

...read moreread less

1,654 citations

Journal Article•10.1007/BF00124891•

Authentication and authenticated key exchanges

[...]

Whitfield Diffie¹, Paul C. van Oorschot², Michael J. Wiener²•Institutions (2)

Sun Microsystems¹, bell northern research²

01 Jun 1992-Designs, Codes and Cryptography

TL;DR: A simple, efficient protocol referred to as the station-to-station (STS) protocol is introduced, examined in detail, and considered in relation to existing protocols.

...read moreread less

Abstract: We discuss two-party mutual authentication protocols providing authenticated key exchange, focusing on those using asymmetric techniques. A simple, efficient protocol referred to as the station-to-station (STS) protocol is introduced, examined in detail, and considered in relation to existing protocols. The definition of a secure protocol is considered, and desirable characteristics of secure protocols are discussed.

...read moreread less

1,364 citations

The Internet Key Exchange (IKE)

[...]

D. Harkins, D. Carrel

1 Nov 1998

TL;DR: ISAKMP ([MSST98]) provides a framework for authentication and key exchange but does not define them.

...read moreread less

Abstract: ISAKMP ([MSST98]) provides a framework for authentication and key exchange but does not define them. ISAKMP is designed to be key exchange independant; that is, it is designed to support many different key exchanges.

...read moreread less

1,327 citations