The DOI matches its Crossref record; 15 of the 15 references it cites were found in a registry or an index.
Strong password-only authenticated key exchange
Open accessAbstract
A new simple password exponential key exchange method (SPEKE) is described. It belongs to an exclusive class of methods which provide authentication and key establishment over an insecure channel using only a small password, without risk of offline dictionary attack. SPEKE and the closely-related Diffie-Hellman Encrypted Key Exchange (DH-EKE) are examined in light of both known and new attacks, along with sufficient preventive constraints. Although SPEKE and DH-EKE are similar, the constraints are different. The class of strong password-only methods is compared to other authentication schemes. Benefits, limitations, and tradeoffs between efficiency and security are discussed. These methods are important for several uses, including replacement of obsolete systems, and building hybrid two-factor systems where independent password-only and key-based methods can survive a single event of either key theft or password compromise.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Encrypted key exchange: password-based protocols secure against dictionary attacks
Bellovin, S. M., & Merritt, M. (2003) · IEEE Computer Society Symposium on Research in Security and Privacy · doi:10.1109/risp.1992.213269 · Cited by 1,354
Pohlig, S., & Hellman, M. (1978) · IEEE Transactions on Information Theory · doi:10.1109/tit.1978.1055817 · Cited by 1,199
Authentication and authenticated key exchanges
Diffie, W., van Oorschot, P. C., & Wiener, M. J. (1992) · Designs Codes and Cryptography · doi:10.1007/bf00124891 · Cited by 1,147
Augmented encrypted key exchange
Bellovin, S. M., & Merritt, M. (1993) · Proceedings of the ACM Conference on Computer and Communications Security · doi:10.1145/168588.168618 · Cited by 523
Privacy and authentication: An introduction to cryptography
Diffie, W., & Hellman, M. E. (1979) · Proceedings of the IEEE · doi:10.1109/proc.1979.11256 · Cited by 468
Protecting poorly chosen secrets from guessing attacks
Gong, L., Lomas, M., Needham, R. M., & Saltzer, J. H. (1993) · IEEE Journal on Selected Areas in Communications · doi:10.1109/49.223865 · Cited by 363
Refinement and extension of encrypted key exchange
Steiner, M., Tsudik, G., & Waidner, M. (1995) · ACM SIGOPS Operating Systems Review · doi:10.1145/206826.206834 · Cited by 253
The discrete logarithm problem
McCurley, K. S. (1991) · Proceedings of symposia in applied mathematics · doi:10.1090/psapm/042/1095551 · Cited by 185
On Diffie-Hellman Key Agreement with Short Exponents
van Oorschot, P. C., & Wiener, M. J. (1996) · Lecture notes in computer science · doi:10.1007/3-540-68339-9_29 · Cited by 134
SPX: global authentication using public key certificates
Tardo, J. J., & Alagappan, K. (2002) · IEEE Computer Society Symposium on Research in Security and Privacy · doi:10.1109/risp.1991.130791 · Cited by 126
Research works printed but not linked: 6
- 10.5555/882488.884178 · DOI
- Ellison C., 1996, Proceedings of the Sixth Annual USENIX Security Symposium, 67
- 10.5555/794195.795036 · DOI
- Jaspan B., 1996, Proceedings of the Sixth Annual USENIX Security Conference, 43
- 1996, {Sch96} B. Schneier, "Applied Cryptography
- van Oorschot P. C., 1996, Proceedings of Eurocrypt '96
Cited by
Sorted by citations
Items 401–500 of 526
Baden, R. (2011) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/2018436.2018485 · Cited by 1
Password-based group key agreement protocol for client-server application
Lu, R., Zhenfu, C., Xiaolei, D., Chao, S., & Sun, C. (2006) · Wuhan University Journal of Natural Sciences · doi:10.1007/bf02831854 · Cited by 1
Converting Group Key Agreement Protocol into Password-Based Setting – Case Study
Dutta, R. (2007) · Journal of Computers · doi:10.4304/jcp.2.8.26-33 · Cited by 1
Analysis and Improvement of a User Authentication Improved Protocol
Tan, Z. (2010) · Journal of Networks · doi:10.4304/jnw.5.5.622-630 · Cited by 1
User-Centric Identification Management for Cross Realm Cloud and Ubiquitous Computing
Wang, R. (2012) · Lecture notes in electrical engineering · doi:10.1007/978-94-007-4516-2_37 · Cited by 1
On Password-Authenticated Key Exchange Security Modeling
Lancrenon, J. (2016) · Lecture notes in computer science · doi:10.1007/978-3-319-29938-9_8 · Cited by 1
Introducing Fault Tolerance into Threshold Password-Authenticated Key Exchange
Pryvalov, I., & Kate, A. (2014) · Cited by 1
Rescorla, E. K., & Korver, B. (2003) · Cited by 1
Cryptography-Based Authentication for Protecting Cyber Systems
Wang, X., & Lin, H. (2013) · IGI Global eBooks · doi:10.4018/978-1-61350-323-2.ch8.8 · Cited by 1
RPAKE: RCA-based Password Authenticated Key Exchange
Tripathy, S., & Nandi, S. (2006) · IEEE India Conference · doi:10.1109/indcon.2006.302796 · Cited by 1
Simple quantum password checking
García-Escartín, J. C., & Chamorro‐Posada, P. (2015) · Physical Review A · doi:10.1103/physreva.91.062310 · Cited by 1
Hashing into Twisted Jacobi Intersection Curves
He, X., Yu, W., & Wang, K. (2018) · Lecture notes in computer science · doi:10.1007/978-3-319-75160-3_9 · Cited by 1
Analysis of passwords: Towards understanding of strengths and weaknesses
Albattah, W. (2018) · International Journal of ADVANCED AND APPLIED SCIENCES · doi:10.21833/ijaas.2018.11.007 · Cited by 1
Password-Based Authenticated Key Establishment Protocols
Lancrenon, J., Khader, D., Ryan, P. Y. A., & Hao, F. (2013) · Elsevier eBooks · doi:10.1016/b978-0-12-803843-7.00049-1 · Cited by 1
Structured and Efficient Password-Based Group Key Agreement Protocol.
Zhu, H. (2014) · J. Inf. Hiding Multim. Signal Process. · Cited by 1
Kwak, J. (2004) · The KIPS Transactions PartC · doi:10.3745/kipstc.2004.11c.4.439 · Cited by 1
Baden, R. (2011) · ACM SIGCOMM Computer Communication Review · doi:10.1145/2043164.2018485 · Cited by 1
User Authentication Protocol Based on Human Memorable Password and Using RSA
Park, I., Park, S., & Oh, B.-K. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-24768-5_75 · Cited by 1
Protoss: Protocol for Tight Optimal Symmetric Security
Giandomenico, E. D., Li, Y., & Schäge, S. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690252 · Cited by 1
Defending Secret-Key Based Authentication Protocols against the Stolen-Secret Attack
Sun, H., & Wang, K.-H. (2008) · International Symposium on Electronic Commerce and Security · doi:10.1109/isecs.2008.36 · Cited by 1
Password-based Authenticated Key Establishment Protocols
Lancrenon, J., Khader, D., Ryan, P. Y. A., & Hao, F. (2013) · Elsevier eBooks · doi:10.1016/b978-0-12-394397-2.00040-4 · Cited by 1
Password-Based Authentication Protocol for Secret-Sharing-Based Multiparty Computation
Kikuchi, R., Chida, K., Ikarashi, D., & Hamada, K. (2017) · IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences · doi:10.1587/transfun.e101.a.51 · Cited by 1
Alekseev, E. K., Руслановна, А. Л., Oshkin, I. B., & Smyshlyaev, S. V. (2016) · Математические вопросы криптографии · doi:10.4213/mvk201 · Cited by 1
Implementation of an eCK-secure Key Exchange Protocol for OpenSSL
Alawatugoda, J., Vivekaanathan, S., Peiris, N., Wickramasinghe, C., & Chuah, C. W. (2018) · International Journal on Advanced Science Engineering and Information Technology · doi:10.18517/ijaseit.8.5.5046 · Cited by 1
Cyber security vulnerabilities in Tonga
Laulaupea'alu, S., & Keegan, T. T. (2019) · Research Commons (University of Waikato) · Cited by 1
Authentication Protocols and Key Establishment
van Oorschot, P. C. (2021) · Information security and cryptography · doi:10.1007/978-3-030-83411-1_4 · Cited by 1
A study of user authentication using mobile phone
Hallsteinsen, S. G. (2007) · BIBSYS Brage (BIBSYS (Norway)) · Cited by 1
Guyot, V. (2007) · Wiley eBooks · doi:10.1002/9780470612118.ch16 · Cited by 1
Practical Password-Based Authenticated Key Exchange Protocol
Wu, S., & Zhu, Y. (2007) · Lecture notes in computer science · doi:10.1007/978-3-540-74377-4_55 · Cited by 1
Forward Secure Password-Enabled PKI with Instant Revocation
Jung, S. W., & Jung, S. (2006) · Lecture notes in computer science · doi:10.1007/11774716_5 · Cited by 1
Securing Contactless Chips with PACE
Kügler, D. (2009) · Vieweg+Teubner eBooks · doi:10.1007/978-3-8348-9283-6_44 · Cited by 1
Secure Password Authentication for Keystroke Dynamics
Choe, Y.-G., & Kim, S. (2005) · Lecture notes in computer science · doi:10.1007/11553939_46 · Cited by 1
An Authentication Scheme Based Upon Face Recognition for the Mobile Environment
Kim, Y.-G., & Kwon, T. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-30497-5_43 · Cited by 1
An elliptic curve authenticated key exchange based approach to key infrastructure
Koduri, P. S. R., Mahajan, A., Montague, P., & Moseley, P. (2003) · International Conference on Knowledge-Based Intelligent Electronic Systems (KES) · doi:10.1109/kes.1999.820235 · Cited by 1
Protocols Security Analysis Based on Ideal
Sun, H.-B. (2005) · Journal of Software · doi:10.1360/jos162150 · Cited by 1
Design and Implementation of Pinpad using Secure Technology from Shoulder Surfing Attack
Kang, M.-S., & Kim, Y. I. (2010) · The KIPS Transactions PartD · doi:10.3745/kipstd.2010.17d.2.167 · Cited by 1
Mobile Security with Smartcards
Kilian‐Kehr, R. (2008) · Technischen Universität Darmstadt · doi:10.26083/tuprints-00000214 · Cited by 1
Cryptanalysis of a Password-based Key Exchange Protocol
Zuo, X.-D., Liu, F., & Ren, C.-L. (2007) · International Conference on Innovative Computing, Information and Control · doi:10.1109/icicic.2007.231 · Cited by 1
Threshold Password-Authenticated Key Retrieval Protocol Using Bilinear Pairings
Lee, S. (2004) · Cited by 1
Alawatugoda, J. (2015) · IACR Cryptology ePrint Archive · Cited by 1
Password Based Key Exchange with Hidden Elliptic Curve Public Parameters.
Bringer, J., Chabanne, H., & Icart, T. (2009) · Cited by 1
Protocols and technologies for security in pervasive computing and communications
Wong, F. L. (2021) · CL Technical Reports · doi:10.48456/tr-709 · Cited by 1
The Ephemeral Pairing ProblemPreprint
Hoepman, J.-H. (2008) · arXiv (Cornell University) · doi:10.48550/arxiv.0802.0834 · Cited by 1
Farashahi, R. R. (2010) · Cited by 1
Secret Public Key Protocols Revisited
Lim, H. W., & Paterson, K. G. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-04904-0_32 · Cited by 1
Security Analysis of Password-based Authenticated Key Exchange ProtocolsPreprint
Mishra, A., Mishra, S., & Panday, S. (2024) · Research Square · doi:10.21203/rs.3.rs-3962016/v1 · Cited by 1
Formal analysis of security properties in trusted computing protocols
Seifi, Y. (2014) · QUT ePrints (Queensland University of Technology)
Discrete Logarithm Cryptography
Karabina, K. (2010) · UWSpace (University of Waterloo)
Key Initialization and Validation of Security Protocol Assumptions in a Home Health Care System
Singh, K., Sithirasenan, E., & Muthukkumarasamy, V. (2012) · Griffith Research Online
A Secret-Key Exponential Key Agreement Protocol with Smart Cards
Yoon, E., & Yoo, K.-Y. (2007) · Lecture notes in computer science · doi:10.1007/978-3-540-73547-2_44
An Improvement on Strong-Password Authentication Protocols
Chang, Y., & Chang, C. (2005) · Lecture notes in computer science · doi:10.1007/11599555_60
An Exquisite Authentication Scheme with Key Agreement Preserving User Anonymity
Kim, M., Kim, S., & Won, D. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-16515-3_31
Various Types of Attacks and Solutions Regarding Secure Remote User Access over Insecure Networks
Yoon, E., & Yoo, K.-Y. (2006) · Lecture notes in computer science · doi:10.1007/11751540_126
Secure Communication Topologies in the Internet of Things
Schweizer, D. (2015) · Repository for Publications and Research Data (ETH Zurich) · doi:10.3929/ethz-a-010421618
Self-authorized Public Key Management for Home Networks
Kim, H., & Oh, S.-G. (2007) · Springer eBooks · doi:10.1007/978-3-540-77090-9_38
Practical Security Improvement of PKCS#5
Song, S., Kwon, T., & Yoon, K. S. (2003) · Lecture notes in computer science · doi:10.1007/978-3-540-39737-3_108
Supporting secure services on dynamic aggregation of heterogeneous networks
Lai, D. (2026) · University of Southern Queensland ePrints (University of Southern Queensland) · doi:10.26192/q0x1w
What Public Keys Can Do for 3-Party, Password-Authenticated Key Exchange
Lancrenon, J. (2014) · Lecture notes in computer science · doi:10.1007/978-3-642-53997-8_6
Securing Password File Using Bezier Curves
Khurana, S., & Khatri, S. K. (2010) · Communications in computer and information science · doi:10.1007/978-3-642-15766-0_119
Security Analysis of Secure Password Authentication for Keystroke Dynamics
Song, H., & Kwon, T. (2006) · Lecture notes in computer science · doi:10.1007/11892960_110
Two’s Company, Three Is a Crowd: A Group-Admission Protocol for WSNs
Girão, J., & Martin, M. (2006) · Lecture notes in computer science · doi:10.1007/11964254_8
A novel software key container in on-line media services
Wang, N.-W., & Huang, Y. (2008) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2008.06.013
A generic method of detecting private key disclosure in digital signature schemes
Bao, F. (2010) · International ICST Conference on Communications and Networking in China · doi:10.4108/chinacom.2010.138
Performance Analysis of Key Establishment Protocols for Secure System
BahadurShahi, T., & Bohara, N. (2013) · International Journal of Computer Applications · doi:10.5120/14416-2530
An Authentication Protocol For Intelligent Home Automation Systems
Leong, & Vun (1998) · International Conference on Consumer Electronics · doi:10.1109/icce.1998.678380
An Off-line Dictionary Attack on Command Authorization in TPM and its Countermeasure
Oh, D.-H., Choi, D.-S., Kim, K.-H., & Ha, J. (2011) · Journal of the Korea Academia-Industrial cooperation Society · doi:10.5762/kais.2011.12.4.1876
Authenticated Key Exchange Protocol for the Secure and Efficient
Park, J., & Park, B. (2010) · The Journal of the Korean Institute of Information and Communication Engineering · doi:10.6109/jkiice.2010.14.8.1843
Efficient Password-Based Authenticated Key Exchange Without Public Information
Shao, J., Cao, Z., Wang, L., & Lu, R. (2007) · Lecture notes in computer science · doi:10.1007/978-3-540-74835-9_20
Complementary Scheme of Remote User Access over Insecure Networks
Jang, I., & Yoo, H. S. (2009) · International Conference on Ubiquitous Information Technologies & Applications (ICUT) · doi:10.1109/icut.2009.5405752
Password Authenticated Key Exchange for Resource-constrained Wireless Communications ?
Wong, D. S., Chan, A. H., & Zhu, F. W. (2005)
Cryptanalysis and improvement of a password-based key exchange protocol
Liu, F., Luo, S., & Ren, C.-L. (2008) · International Conference on Machine Learning and Cybernetics · doi:10.1109/icmlc.2008.4621042
Security of Group Key Exchange Protocols with Different Passwords
Phan, R. C. ‐. (2009) · International Conference on Advanced Information Networking and Applications Workshops (WAINA) · doi:10.1109/waina.2009.38
An agent-based active node architecture
Shao, X., Tajima, Y., & Terada, M. (2004) · IEEE International Conference on Communication Technology (ICCT) · doi:10.1109/icct.2003.1209039
ON END-TO-END ENCRYPTION FOR CLOUD-BASED SERVICES
Majumdar, S. (2014) · Spectrum Research Repository (Concordia University)
Analysis and Improvement of Two-Factor Authenticated Key Exchange Protocols in Public Wireless LANs
Ma, C., Chen, S., & Cheng, Q. (2011) · International Conference on Wireless Communications, Networking and Mobile Computing · doi:10.1109/wicom.2011.6040530
A smart card based authentication protocol for strong passwords
Chang, C., & Tsai, H.-C. (2006)
Improving the Generalized Password-Based Authenticated Key Agreement Protocol
Yoon, E., & Yoo, K.-Y. (2008) · Grid and Pervasive Computing · doi:10.1109/gpc.workshops.2008.59
Performance Comparison of ADSDV and DSDV in MANET
Dahiya, B. P. (2013)
Threshold Password-based Authenticated Key Exchange using Matrix
Park, C. H., Lee, S., & Yoon, H. (2005)
Cifração e autenticação utilizando funções fisicamente não clonáveis (PUFs)
Resende, A. C. D. (2014) · doi:10.26512/2014.11.d.17739
Schirninger, R., & Zeppetzauer, S. (2005) · KTH Publication Database DiVA (KTH Royal Institute of Technology)
Session key reusability using 3-PAKE in symmetric key cryptography
Bhatia, S., & Anand, R. V. (2015) · International Conference on Soft Computing Techniques and Implementations (ICSCTI) · doi:10.1109/icscti.2015.7489567
Applied Cryptography in Electronic Commerce
Grzonkowski, S., Ensor, B. D., & McDaniel, B. (2013) · IGI Global eBooks · doi:10.4018/978-1-4666-2919-6.ch017
An Efficient Authentication Scheme
Aboud, S. J. (2011) · International Journal for Infonomics · doi:10.20533/iji.1742.4712.2011.0058
A Biometrics Based Secure Communication Scheme for Bluetooth Environment
Akhavan-E-saffar, M. (2011)
HASH-BASED RANDOM SALT PASSWORD AUTHENTICATION IN TWO SERVERS
Ampomah, M. O., Hayfron-Acquah, J. B., Twum, F., & Panford, J. K. (2015)
Authentication and identity privacy in the wireless domain
Barnickel, J., & Meyer, U. (2013) · RWTH Publications (RWTH Aachen)
An Efficient Provably Secure Password-Based Authenticated Key Agreement
Xu, H., Wang, Q., Jing, Z., & Ruan, O. (2017) · Advances in intelligent systems and computing · doi:10.1007/978-3-319-61542-4_40
Security Analysis and Implementation of Password-based Cryptosystem
Bakuri, H. (2005)
3-Way Handshake PAKE Based on Reversible Cellular Automata
Baghor, S., & Faraoun, K. M. (2018) · Journal of Information Security Research · doi:10.6025/jisr/2018/9/2/50-62
A Note on Encoding and Hashing into Elliptic and Hyperelliptic Curves
Seck, M., Diarra, N., & Sow, D. (2018) · SAPS EDITIONS eBooks · doi:10.16929/sbs/2018.100-06-01
Decoupling Authentication from the Usage of Services
Horsch, M., Braun, J., & Wiesmaier, A. (2012) · TUbilio (Technical University of Darmstadt)
How to Hash into Elliptic Curves.
Icart, T. (2009)
Key exchange with the help of a public ledgerPreprint
Bui, T., & Aura, T. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1708.03468
The Optimal Combination Mode of Three-digit Cryptography Based on Letters and Numbers
Yang, F., Zhao, J., Yuan, H. L., Zhang, X., Zhao, B., Zhang, Q., Wang, H., Li, Z., Gong, B., Zhi, Y., et al. (2019) · IEEE Advanced Information Management, Communicates, Electronic and Automation Control Conference (IMCEC) · doi:10.1109/imcec46724.2019.8983862
Multi-LHL protocol.Preprint
Mitrengová, M. (2013) · IACR Cryptology ePrint Archive
Efficient Password-based Authenticated Key Exchange without Public Information.
Shao, J., Cao, Z., Wang, L., & Lu, R. (2007)
Metadata
- Authors
- Jablon, D. P.
- Affiliations
- Integrity Sciences, Inc., Westboro, MA
- Corresponding author
- Jablon, David P.
- Venue
- ACM SIGCOMM Computer Communication Review
- Published
- 1996-10
- Volume
- 26
- Issue
- 5
- Pages
- 5-26
- ISSN
- 0146-4833 (ISSN-L)
- OpenAlex
- W2133432179
- Cited by
- 532
- References
- 15
- Citations by year
- 2026: 4 · 2025: 6 · 2024: 8 · 2023: 8 · 2022: 12 · 2021: 19 · 2020: 8 · 2019: 13 · 2018: 16 · 2017: 13 · 2016: 11 · 2015: 22 · 2014: 17 · 2013: 25 · 2012: 10
- FWCI
- 8.01
- Type
- journal article
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- ACM SIGCOMM Computer Communication Review (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
- Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Keywords
- authenticated key agreement, offline dictionary attack, attack analysis, two-factor authentication, password compromise
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
