Cited by 532Advanced Authentication Protocols SecurityUser Authentication and Security SystemsCryptography and Data Security

The DOI matches its Crossref record; 15 of the 15 references it cites were found in a registry or an index.

Strong password-only authenticated key exchange

Open access
Jablon, David P.·1996·ACM SIGCOMM Computer Communication Review

Abstract

A new simple password exponential key exchange method (SPEKE) is described. It belongs to an exclusive class of methods which provide authentication and key establishment over an insecure channel using only a small password, without risk of offline dictionary attack. SPEKE and the closely-related Diffie-Hellman Encrypted Key Exchange (DH-EKE) are examined in light of both known and new attacks, along with sufficient preventive constraints. Although SPEKE and DH-EKE are similar, the constraints are different. The class of strong password-only methods is compared to other authentication schemes. Benefits, limitations, and tradeoffs between efficiency and security are discussed. These methods are important for several uses, including replacement of obsolete systems, and building hybrid two-factor systems where independent password-only and key-based methods can survive a single event of either key theft or password compromise.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1145/242896.242897

Cites

15 of 15 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Flagged first, then by citations

Show all 15 references

Research works printed but not linked: 6

  1. 10.5555/882488.884178 · DOI
  2. Ellison C., 1996, Proceedings of the Sixth Annual USENIX Security Symposium, 67
  3. 10.5555/794195.795036 · DOI
  4. Jaspan B., 1996, Proceedings of the Sixth Annual USENIX Security Conference, 43
  5. 1996, {Sch96} B. Schneier, "Applied Cryptography
  6. van Oorschot P. C., 1996, Proceedings of Eurocrypt '96

Cited by

Sorted by citations

Metadata

Authors
Jablon, D. P.
Affiliations
Integrity Sciences, Inc., Westboro, MA
Corresponding author
Jablon, David P.
Venue
ACM SIGCOMM Computer Communication Review
Published
1996-10
Volume
26
Issue
5
Pages
5-26
ISSN
0146-4833 (ISSN-L)
OpenAlex
W2133432179
Cited by
532
References
15
Citations by year
2026: 4 · 2025: 6 · 2024: 8 · 2023: 8 · 2022: 12 · 2021: 19 · 2020: 8 · 2019: 13 · 2018: 16 · 2017: 13 · 2016: 11 · 2015: 22 · 2014: 17 · 2013: 25 · 2012: 10
FWCI
8.01
Type
journal article
Language
en
Open access
Locations
ACM SIGCOMM Computer Communication Review (publishedVersion)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
  • Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
  • Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
Keywords
authenticated key agreement, offline dictionary attack, attack analysis, two-factor authentication, password compromise

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review