Strong password-only authenticated key exchange
Open accessAbstract
A new simple password exponential key exchange method (SPEKE) is described. It belongs to an exclusive class of methods which provide authentication and key establishment over an insecure channel using only a small password, without risk of offline dictionary attack. SPEKE and the closely-related Diffie-Hellman Encrypted Key Exchange (DH-EKE) are examined in light of both known and new attacks, along with sufficient preventive constraints. Although SPEKE and DH-EKE are similar, the constraints are different. The class of strong password-only methods is compared to other authentication schemes. Benefits, limitations, and tradeoffs between efficiency and security are discussed. These methods are important for several uses, including replacement of obsolete systems, and building hybrid two-factor systems where independent password-only and key-based methods can survive a single event of either key theft or password compromise.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Encrypted key exchange: password-based protocols secure against dictionary attacks
Bellovin, S. M., & Merritt, M. (2003) · IEEE Computer Society Symposium on Research in Security and Privacy · doi:10.1109/risp.1992.213269 · Cited by 1,354 · see citing works
Pohlig, S., & Hellman, M. (1978) · IEEE Transactions on Information Theory · doi:10.1109/tit.1978.1055817 · Cited by 1,199 · see citing works
Authentication and authenticated key exchanges
Diffie, W., van Oorschot, P. C., & Wiener, M. J. (1992) · Designs Codes and Cryptography · doi:10.1007/bf00124891 · Cited by 1,147 · see citing works
Augmented encrypted key exchange
Bellovin, S. M., & Merritt, M. (1993) · Proceedings of the ACM Conference on Computer and Communications Security · doi:10.1145/168588.168618 · Cited by 523 · see citing works
Privacy and authentication: An introduction to cryptography
Diffie, W., & Hellman, M. E. (1979) · Proceedings of the IEEE · doi:10.1109/proc.1979.11256 · Cited by 468 · see citing works
Protecting poorly chosen secrets from guessing attacks
Gong, L., Lomas, M., Needham, R. M., & Saltzer, J. H. (1993) · IEEE Journal on Selected Areas in Communications · doi:10.1109/49.223865 · Cited by 363 · see citing works
Refinement and extension of encrypted key exchange
Steiner, M., Tsudik, G., & Waidner, M. (1995) · ACM SIGOPS Operating Systems Review · doi:10.1145/206826.206834 · Cited by 253 · see citing works
The discrete logarithm problem
McCurley, K. S. (1991) · Proceedings of symposia in applied mathematics · doi:10.1090/psapm/042/1095551 · Cited by 185 · see citing works
On Diffie-Hellman Key Agreement with Short Exponents
van Oorschot, P. C., & Wiener, M. J. (1996) · Lecture notes in computer science · doi:10.1007/3-540-68339-9_29 · Cited by 134 · see citing works
SPX: global authentication using public key certificates
Tardo, J. J., & Alagappan, K. (2002) · IEEE Computer Society Symposium on Research in Security and Privacy · doi:10.1109/risp.1991.130791 · Cited by 126 · see citing works
Optimal authentification protocols resistant to password guessing attacks
Gong, L. (2002) · doi:10.1109/csfw.1995.518549 · Cited by 115 · see citing works
Establishing identity without certification authorities
Ellison, C. M. (1996) · Cited by 65 · see citing works
An attack on the Interlock Protocol when used for authentication
Bellovin, S. M., & Merritt, M. (1994) · IEEE Transactions on Information Theory · doi:10.1109/18.272497 · Cited by 43 · see citing works
Fortifying key negotiation schemes with poorly chosenpasswords
Anderson, R., & Lomas, T. (1994) · Electronics Letters · doi:10.1049/el:19940697 · Cited by 32 · see citing works
Jaspan, B. (1996) · Cited by 24 · see citing works
Flagged first, then by citations
Research works printed but not linked: 2
- -protocol, SPEKE, which appears to be at least as strong as the closely related DH-EKE method. Using only a small password, these methods provide authentication and key establishment over an insecure channel, and are immune to offline dictionary attack. A review of the classes of attack against these DH-based methods includes some new observations, and new constraints which are required to keep both methods safe. These constraints are listed as a convenience to implementors. Concerns raised about receiving unauthenticated DH parameters argue for the use of either a fixed huge modulus, or certified parameters, or the need for further research. In any case, it is practical to increase speed by using shorter exponents. Strong password-only methods have many uses, by themselves, or in multi-factor authentication systems. It is apparent that password-only methods can achieve things that no stored-key method can achieve, and vice-versa. A well-designed system can leverage the power of small, easily-memorized passwords, adding significant strength to the foundation for remote security.
- B. Schneier, "Applied Cryptography Second Edition", John Wiley & Sons, 1996.
Cited by
Sorted by citations
Kocher, P. C., Jaffe, J. S., & Jun, B. (1999) · Lecture notes in computer science · doi:10.1007/3-540-48405-1_25 · Cited by 7,569 · see citing works
Authenticated Key Exchange Secure against Dictionary Attacks
Bellare, M., Pointcheval, D., & Rogaway, P. (2000) · Lecture notes in computer science · doi:10.1007/3-540-45539-6_11 · Cited by 1,511 · see citing works
Provably Secure Password-Authenticated Key Exchange Using Diffie-Hellman
Boyko, V., MACKENZIE, P. D., & Patel, S. (2000) · Lecture notes in computer science · doi:10.1007/3-540-45539-6_12 · Cited by 725 · see citing works
The Secure Remote Password Protocol.
Wu, T. D. (1998) · Cited by 448 · see citing works
PKCS #5: Password-Based Cryptography Specification Version 2.0
Kaliski, B. S. (2000) · doi:10.17487/rfc2898 · Cited by 375 · see citing works
Public-key cryptography and password protocols
Halevi, S., & Krawczyk, H. (1999) · ACM Transactions on Information and System Security · doi:10.1145/322510.322514 · Cited by 314 · see citing works
A Survey of SIP Authentication and Key Agreement Schemes
Kılınç, H. H., & Yanık, T. (2013) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2013.091513.00050 · Cited by 312 · see citing works
A Framework for Password-Based Authenticated Key Exchange
Gennaro, R., & Lindell, Y. (2003) · Lecture notes in computer science · doi:10.1007/3-540-39200-9_33 · Cited by 296 · see citing works
Fast, Reliable, and Secure Drone Communication: A Comprehensive Survey
Hassija, V., Chamola, V., Agrawal, A., Goyal, A., Luong, N. C., Niyato, D., Yu, F. R., & Guizani, M. (2021) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2021.3097916 · Cited by 263 · see citing works
Session-Key Generation Using Human Passwords Only
Goldreich, O., & Lindell, Y. (2001) · Lecture notes in computer science · doi:10.1007/3-540-44647-8_24 · Cited by 203 · see citing works
Server-assisted generation of a strong secret from a password
Ford, W. S., & Kaliski, B. S. (2002) · IEEE International Conference on Enabling Technologies: Infrastructure for Collaborative Enterprises (WETICE) · doi:10.1109/enabl.2000.883724 · Cited by 180 · see citing works
Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd
Vanhoef, M., & Ronen, E. (2020) · 2020 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp40000.2020.00031 · Cited by 179 · see citing works
Three-party encrypted key exchange
Lin, C., Sun, H., & Hwang, T. (2000) · ACM SIGOPS Operating Systems Review · doi:10.1145/506106.506108 · Cited by 176 · see citing works
Security considerations for Voice Over IP Systems
Kuhn, D. R., Walsh, T. J., & Fries, S. (2005) · doi:10.6028/nist.sp.800-58 · Cited by 176 · see citing works
Extended password key exchange protocols immune to dictionary attack
Jablon, D. P. (2002) · IEEE International Conference on Enabling Technologies: Infrastructure for Collaborative Enterprises (WETICE) · doi:10.1109/enabl.1997.630822 · Cited by 173 · see citing works
Self-citationThreshold Password-Authenticated Key Exchange
MACKENZIE, P. D., Shrimpton, T., & Jakobsson, M. (2002) · Lecture notes in computer science · doi:10.1007/3-540-45708-9_25 · Cited by 165 · see citing works
How to Hash into Elliptic Curves
Icart, T. (2009) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-03356-8_18 · Cited by 162 · see citing works
Thorpe, J., van Oorschot, P. C., & Somayaji, A. B. (2005) · New Security Paradigms Workshop · doi:10.1145/1146269.1146282 · Cited by 156 · see citing works
Password-Authenticated Key Exchange Based on RSA
MACKENZIE, P. D., Patel, S., & Swaminathan, R. (2000) · Lecture notes in computer science · doi:10.1007/3-540-44448-3_46 · Cited by 153 · see citing works
IEEE Standard Specifications for Public-Key Cryptography
Cryptography, P.-K. (2000) · doi:10.1109/ieeestd.2000.92292 · Cited by 143 · see citing works
An unknown key-share attack on the MQV key agreement protocol
Kaliski, B. S. (2001) · ACM Transactions on Information and System Security · doi:10.1145/501978.501981 · Cited by 142 · see citing works
A remote user authentication scheme using hash functions
Lee, C., Li, L.-H., & Hwang, M. (2002) · ACM SIGOPS Operating Systems Review · doi:10.1145/583800.583803 · Cited by 141 · see citing works
AI-Based Mobile Edge Computing for IoT: Applications, Challenges, and Future Scope
Singh, A. P., Satapathy, S. C., Roy, A., & Gutub, A. (2022) · Arabian Journal for Science and Engineering · doi:10.1007/s13369-021-06348-2 · Cited by 139 · see citing works
Provably Secure Password Authenticated Key Exchange Based on RLWE for the Post-Quantum World
Ding, J., Alsayigh, S., Lancrenon, J., Rv, S., & Snook, M. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-52153-4_11 · Cited by 125 · see citing works
A Real-World Analysis of Kerberos Password Security.
Wu, T. D. (1999) · Cited by 120 · see citing works
A password authentication scheme with secure password updating
Lin, C., & Hwang, T. (2003) · Computers & Security · doi:10.1016/s0167-4048(03)00114-7 · Cited by 119 · see citing works
Methods for Protecting Password Transmission
Peyravian, M., & Zunic, N. (2000) · Computers & Security · doi:10.1016/s0167-4048(00)05032-x · Cited by 116 · see citing works
Open key exchange: How to defeat dictionary attacks without encrypting public keys
Lucks, S. (1998) · Lecture notes in computer science · doi:10.1007/bfb0028161 · Cited by 114 · see citing works
Authenticated ID-based Key Exchange and remote log-in with simple token and PIN number.Preprint
Scott, M. (2002) · IACR Cryptology ePrint Archive · Cited by 114 · see citing works
Efficient Indifferentiable Hashing into Ordinary Elliptic Curves
Brier, É., Coron, J.-S., Icart, T., Madore, D., Randriambololona, H., & Tibouchi, M. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-14623-7_13 · Cited by 113 · see citing works
Password-Based Group Key Exchange in a Constant Number of Rounds
Abdalla, M. F., Bresson, E., Chevassut, O., & Pointcheval, D. (2006) · Lecture notes in computer science · doi:10.1007/11745853_28 · Cited by 111 · see citing works
Bard, G. V. (2006) · Cited by 105 · see citing works
A Method for Making Password-Based Key Exchange Resilient to Server Compromise
Gentry, C., MACKENZIE, P. D., & Ramzan, Z. (2006) · Lecture notes in computer science · doi:10.1007/11818175_9 · Cited by 105 · see citing works
Guidelines for Writing RFC Text on Security Considerations
Rescorla, E. K., & Korver, B. (2003) · doi:10.17487/rfc3552 · Cited by 103 · see citing works
Password-based authentication: a system perspective
Conklin, A., Dietrich, G. B., & Walz, D. B. (2004) · Hawaii International Conference on System Sciences (HICSS) · doi:10.1109/hicss.2004.1265412 · Cited by 101 · see citing works
Semal, B., Markantonakis, K., & Akram, R. N. (2018) · IEEE/AIAA Digital Avionics Systems Conference (DASC) · doi:10.1109/dasc.2018.8569730 · Cited by 98 · see citing works
Password Authentication Using Multiple Servers
Jablon, D. P. (2001) · Lecture notes in computer science · doi:10.1007/3-540-45353-9_26 · Cited by 98 · see citing works
Self-citationA secure authentication scheme for Internet of Things
Wang, K.-H., Chen, C., Fang, W., & Wu, T. (2017) · Pervasive and Mobile Computing · doi:10.1016/j.pmcj.2017.09.004 · Cited by 98 · see citing works
A framework for password-based authenticated key exchange 1
Gennaro, R., & Lindell, Y. (2006) · ACM Transactions on Information and System Security · doi:10.1145/1151414.1151418 · Cited by 95 · see citing works
Secure key agreement protocols for three-party against guessing attacks
Sun, H., Chen, B.-C., & Hwang, T. (2004) · Journal of Systems and Software · doi:10.1016/j.jss.2003.11.017 · Cited by 90 · see citing works
Password-authenticated key exchange based on RSA
MACKENZIE, P. D., Patel, S., & Swaminathan, R. (2010) · International Journal of Information Security · doi:10.1007/s10207-010-0120-3 · Cited by 89 · see citing works
Password-Authenticated Key Exchange between Clients with Different Passwords
Byun, J. W., Jeong, I. R., Lee, D. H., & Park, C.-S. (2002) · Lecture notes in computer science · doi:10.1007/3-540-36159-6_12 · Cited by 88 · see citing works
Efficient and secure authenticated key exchange using weak passwords
Katz, J. I., Ostrovsky, R., & Yung, M. M. (2009) · Journal of the ACM · doi:10.1145/1613676.1613679 · Cited by 88 · see citing works
Provably Secure Threshold Password-Authenticated Key Exchange
Raimondo, M. D., & Gennaro, R. (2003) · Lecture notes in computer science · doi:10.1007/3-540-39200-9_32 · Cited by 85 · see citing works
Simultaneous Authentication of Equals: A Secure, Password-Based Key Exchange for Mesh Networks
Harkins, D. (2008) · 2008 Second International Conference on Sensor Technologies and Applications (sensorcomm 2008) · doi:10.1109/sensorcomm.2008.131 · Cited by 83 · see citing works
Public-key cryptography and password protocols
Halevi, S., & Krawczyk, H. (1998) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/288090.288118 · Cited by 81 · see citing works
Networked cryptographic devices resilient to capture
MACKENZIE, P. D., & Reiter, M. K. (2002) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/secpri.2001.924284 · Cited by 80 · see citing works
More Efficient Password-Authenticated Key Exchange
MACKENZIE, P. D. (2001) · Lecture notes in computer science · doi:10.1007/3-540-45353-9_27 · Cited by 80 · see citing works
A Detection and Prevention Technique for Man in the Middle Attack in Fog Computing
Aliyu, F., Sheltami, T., & Shakshuki, E. M. (2018) · Procedia Computer Science · doi:10.1016/j.procs.2018.10.125 · Cited by 79 · see citing works
Authentication and Key Agreement Via Memorable Passwords.
Kwon, T. (2000) · Cited by 79 · see citing works
Security of the J-PAKE Password-Authenticated Key Exchange Protocol
Abdalla, M. F., Benhamouda, F., & MACKENZIE, P. D. (2015) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2015.41 · Cited by 76 · see citing works
Provably secure three-party password-based authenticated key exchange protocol using Weil pairing
Wen, H., Lee, T.-F., & Hwang, T. (2005) · IEE Proceedings - Communications · doi:10.1049/ip-com:20045087 · Cited by 76 · see citing works
van den Broek, F., Verdult, R., & de Ruiter, J. (2015) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2810103.2813615 · Cited by 75 · see citing works
Two-Server Password-Only Authenticated Key Exchange
Katz, J. I., MACKENZIE, P. D., Taban, G., & Gligor, V. D. (2005) · Lecture notes in computer science · doi:10.1007/11496137_1 · Cited by 73 · see citing works
J-PAKE: Authenticated Key Exchange without PKI
Hao, F., & Ryan, P. Y. A. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-17697-5_10 · Cited by 73 · see citing works
Hoepman, J.-H. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-27809-2_22 · Cited by 73 · see citing works
AuCPace: Efficient verifier-based PAKE protocol tailored for the IIoT
Haase, B., & Labrique, B. (2019) · IACR Transactions on Cryptographic Hardware and Embedded Systems · doi:10.46586/tches.v2019.i2.1-48 · Cited by 72 · see citing works
Elliptic Curve Based Password Authenticated Key Exchange Protocols
Boyd, C., Montague, P., & Nguyen, K. (2001) · Lecture notes in computer science · doi:10.1007/3-540-47719-5_38 · Cited by 66 · see citing works
A comprehensive survey of authentication methods in Internet-of-Things and its conjunctions
Kumar, A., Saha, R., Conti, M., Kumar, G., Buchanan, W. J., & Kim, T.-H. (2022) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2022.103414 · Cited by 65 · see citing works
EAP-Based Group Authentication and Key Agreement Protocol for Machine-Type Communications
Jiang, R., Lai, C., Luo, J., Wang, X., & Wang, H. (2013) · International Journal of Distributed Sensor Networks · doi:10.1155/2013/304601 · Cited by 64 · see citing works
An improved bilinear pairing based remote user authentication scheme
Goriparthi, T., Das, M. L., & Saxena, A. (2007) · Computer Standards & Interfaces · doi:10.1016/j.csi.2007.11.016 · Cited by 61 · see citing works
Password-Based Encrypted Group Key Agreement
Dutta, R., & Barua, R. (2006) · International journal of network security · doi:10.6633/ijns.200607.3(1).04 · Cited by 61 · see citing works
Viswanathan, P., & Krishna, P. V. (2013) · IEEE Journal of Biomedical and Health Informatics · doi:10.1109/jbhi.2013.2281322 · Cited by 57 · see citing works
Threshold Password-Authenticated Key Exchange
MACKENZIE, P. D., Shrimpton, T., & Jakobsson, M. (2005) · Journal of Cryptology · doi:10.1007/s00145-005-0232-5 · Cited by 57 · see citing works
On countering online dictionary attacks with login histories and humans-in-the-loop
van Oorschot, P. C., & Stubblebine, S. G. (2006) · ACM Transactions on Information and System Security · doi:10.1145/1178618.1178619 · Cited by 57 · see citing works
Single password authentication
Acar, T., Belenkiy, M., & Küpçü, A. (2013) · Computer Networks · doi:10.1016/j.comnet.2013.05.007 · Cited by 55 · see citing works
Password Authenticated Key Exchange by Juggling
Hao, F., & Ryan, P. Y. A. (2011) · Lecture notes in computer science · doi:10.1007/978-3-642-22137-8_23 · Cited by 55 · see citing works
Secure remote user access over insecure networks
Peyravian, M., & Jeffries, C. D. (2005) · Computer Communications · doi:10.1016/j.comcom.2005.07.025 · Cited by 55 · see citing works
Tiwari, A., Sanyal, S., Abraham, A., Knapskog, S. J., & Sanyal, S. (2011) · arXiv (Cornell University) · doi:10.48550/arxiv.1111.3010 · Cited by 55 · see citing works
Using the mobile phone as a security token for unified authentication
Hallsteinsen, S. G., Jørstad, I., & Thanh, D. V. (2007) · International Conference on Systems and Networks Communications · doi:10.1109/icsnc.2007.82 · Cited by 53 · see citing works
Session-Key Generation Using Human Passwords Only
Goldreich, O., & Lindell, Y. (2006) · Journal of Cryptology · doi:10.1007/s00145-006-0233-z · Cited by 53 · see citing works
Secure authentication system for public WLAN roaming
Matsunaga, Y., Merino, A. S., Suzuki, T., & Katz, R. H. (2003) · Wireless Mobile Applications And Services On WLAN Hotspots · doi:10.1145/941326.941343 · Cited by 52 · see citing works
Secure Password-Based Protocol for Downloading a Private Key.
Perlman, R., & Kaufman, C. (1999) · Cited by 51 · see citing works
Secure password-based cipher suite for TLS
Steiner, M., Bühler, P., Eirich, T., & Waidner, M. (2001) · ACM Transactions on Information and System Security · doi:10.1145/501963.501965 · Cited by 51 · see citing works
Password Authenticated Key Exchange Based on RSA for Imbalanced Wireless Networks
Zhu, F. W., Wong, D. S., Chan, A. H., & Ye, R. (2002) · Lecture notes in computer science · doi:10.1007/3-540-45811-5_11 · Cited by 49 · see citing works
A hierarchical key management scheme for secure group communications in mobile ad hoc networks
Wang, N.-C., & Fang, S.-Z. (2007) · Journal of Systems and Software · doi:10.1016/j.jss.2006.12.564 · Cited by 48 · see citing works
Simple authenticated key agreement and protected password change protocol
Chang, T., Yang, W., & Hwang, M. (2005) · Computers & Mathematics with Applications · doi:10.1016/j.camwa.2004.11.007 · Cited by 47 · see citing works
Cryptanalysis of recently proposed Remote User Authentication Schemes.Preprint
Goriparthi, T., Das, M. L., Negi, A., & Saxena, A. (2006) · IACR Cryptology ePrint Archive · Cited by 47 · see citing works
Security analysis of a password-based authentication protocol proposed to IEEE 1363
Zhao, Z., Dong, Z., & Wang, Y. (2005) · Theoretical Computer Science · doi:10.1016/j.tcs.2005.11.038 · Cited by 44 · see citing works
Decaf: Eliminating Cofactors Through Point Compression
Hamburg, M. (2015) · Lecture notes in computer science · doi:10.1007/978-3-662-47989-6_34 · Cited by 43 · see citing works
Authentication by Encrypted Negative Password
Luo, W., Hu, Y., Jiang, H., & Wang, J. (2018) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2018.2844854 · Cited by 43 · see citing works
An Efficient Two-Party Identity-Based Key Exchange Protocol
Tseng, Y. (2007) · Informatica · doi:10.15388/informatica.2007.168 · Cited by 43 · see citing works
A lightweight protection mechanism against signaling attacks in a SIP-based VoIP environment
Geneiatakis, D., & Lambrinoudakis, C. (2007) · Telecommunication Systems · doi:10.1007/s11235-008-9065-5 · Cited by 42 · see citing works
Wang, W., & Hu, L. (2006) · Lecture notes in computer science · doi:10.1007/11941378_10 · Cited by 42 · see citing works
Faster and Shorter Password-Authenticated Key Exchange
Gennaro, R. (2008) · Springer eBooks · doi:10.1007/978-3-540-78524-8_32 · Cited by 42 · see citing works
Mechanisms for increasing the usability of grid security
Beckles, B., Welch, V., & Basney, J. (2005) · International Journal of Human-Computer Studies · doi:10.1016/j.ijhcs.2005.04.017 · Cited by 42 · see citing works
Software smart cards via cryptographic camouflage
Hoover, D. N., & Kausik, B. N. (2003) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/secpri.1999.766915 · Cited by 42 · see citing works
Cryptanalysis of Microsoft’s PPTP Authentication Extensions (MS-CHAPv2)
Schneier, B., Mudge, & Wagner, D. A. (1999) · Lecture notes in computer science · doi:10.1007/3-540-46701-7_17 · Cited by 41 · see citing works
Networked cryptographic devices resilient to capture
MACKENZIE, P. D., & Reiter, M. K. (2003) · International Journal of Information Security · doi:10.1007/s10207-003-0022-8 · Cited by 41 · see citing works
Secure Authentication System for Public WLAN Roaming
Merino, A. S., Matsunaga, Y., Shah, M., Suzuki, T., & Katz, R. H. (2005) · Mobile Networks and Applications · doi:10.1007/s11036-005-6428-y · Cited by 40 · see citing works
Offline dictionary attack on TCG TPM weak authorisation data, and solution
Chen, L., & Ryan, M. D. (2009) · Vieweg+Teubner eBooks · doi:10.1007/978-3-8348-9324-6_20 · Cited by 38 · see citing works
Investigating User Behavior for Authentication Methods
Ma, Y., Feng, J. H., Kumin, L., & Lazar, J. K. (2013) · ACM Transactions on Accessible Computing · doi:10.1145/2493171.2493173 · Cited by 38 · see citing works
Analysis of the SPEKE Password-Authenticated Key Exchange Protocol
Zhang, M. (2004) · IEEE Communications Letters · doi:10.1109/lcomm.2003.822506 · Cited by 38 · see citing works
Forward Secrecy and Its Application to Future Mobile Communications Security
Park, D., Boyd, C., & Moon, S. (2000) · Lecture notes in computer science · doi:10.1007/978-3-540-46588-1_29 · Cited by 38 · see citing works
New Approaches to Password Authenticated Key Exchange Based on RSA
Zhang, M. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-30539-2_17 · Cited by 38 · see citing works
Password authenticated key exchange using hidden smooth subgroups
Gentry, C., MACKENZIE, P. D., & Ramzan, Z. (2005) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/1102120.1102160 · Cited by 37 · see citing works
Wang, S., Wang, J., & Xu, M. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-24852-1_30 · Cited by 37 · see citing works
Ephemeral Pairing on Anonymous Networks
Hoepman, J.-H. (2005) · Lecture notes in computer science · doi:10.1007/978-3-540-32004-3_12 · Cited by 37 · see citing works
A Scalable Transitive Human-Verifiable Authentication Protocol for Mobile Devices
Chen, C., Wang, K.-H., Wu, T., Pan, J., & Sun, H. (2013) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2013.2270106 · Cited by 36 · see citing works
Uni-directional trusted path: Transaction confirmation on just one device
Filyanov, A., McCuney, J. M., Sadeghiz, A.-R., & Winandy, M. (2011) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn.2011.5958202 · Cited by 34 · see citing works
- Authors
- Jablon, D. P.
- Affiliations
- Integrity Sciences, Inc., Westboro, MA
- Corresponding author
- Jablon, David P.
- Venue
- ACM SIGCOMM Computer Communication Review
- Published
- 1996-10
- Volume
- 26
- Issue
- 5
- Pages
- 5-26
- ISSN
- 0146-4833 (ISSN-L)
- OpenAlex
- W2133432179
- Cited by
- 532
- References
- 15
- Citations by year
- 2026: 4 · 2025: 6 · 2024: 8 · 2023: 8 · 2022: 12 · 2021: 19 · 2020: 8 · 2019: 13 · 2018: 16 · 2017: 13 · 2016: 11 · 2015: 22 · 2014: 17 · 2013: 25 · 2012: 10
- FWCI
- 8.01
- Type
- journal article
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- ACM SIGCOMM Computer Communication Review (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
- Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptography and Data Security
- Keywords
- authenticated key agreement, offline dictionary attack, attack analysis, two-factor authentication, password compromise
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
