Anonymous gateway-oriented password-based authenticated key exchange based on RSA

Abstract

A gateway-oriented password-based authenticated key exchange (GPAKE) is a three-party protocol, which allows a client and a gateway to establish a common session key with the help of an authentication server. To date, most of the published protocols for GPAKE have been based on Diffie-Hellman key exchange. In this article, we present the first GPAKE protocol based on RSA, then prove its security in the random oracle model under the RSA assumption. Furthermore, our protocol can resist both e-residue and undetectable on-line dictionary attacks. Finally, we investigate whether or not a GPAKE protocol can achieve both client anonymity and resistance against undetectable on-line dictionary attacks by a malicious gateway. We provide an affirmative answer by adding client anonymity with respect to the server.

Preprint submitted to EURASIP JWCN October 16, 2011 to our basic protocol.

1. Introduction

1.1. Password-based authenticated key exchange

Password-based authenticated key exchange (PAKE) protocols allow users to securely establish a common key over an insecure open network only using a low-entropy and human-memorable password. Owing to the low entropy of passwords, PAKE protocols are susceptible to so-called dictionary attacks [1]. Dictionary attacks can be classified into three types [1]: on-line, off-line, and undetectable on-line dictionary attacks. In on-line dictionary attacks, an adversary first guesses a password, and tries to verify the password using responses from a server in an on-line manner. On-line password guessing attacks can be easily detected, and thwarted by counting access failures. In off-line dictionary attacks, an adversary tries to determine the correct password without the involvement of the honest parties based on information obtained during previous executions of the protocol. Thus, the attacker can freely guess a password and then check if it is correct without limitation in the number of guesses. The last type is undetectable on-line dictionary at-2 tacks, where a malicious insider tries to verify a password guess in an on-line manner. However, a failed guess cannot be detected by the honest client or the server. The malicious insider participates in the protocol legally and un-detectably many times to get sufficient information of the password. Among these attacks, on-line dictionary attack is unavoidable when low-entropy pass-words are used, the goal of PAKE protocols is to restrict the adversary to on-line dictionary attacks only. In other words, off-line and undetectable on-line dictionary attacks should not be possible in a PAKE protocol.

In 1992, Bellovin and Merritt first presented a family of password protocols known as encrypted key exchange (EKE) protocols [2] which can resist dictionary attacks. They also investigated the feasibility of implementing EKE using three different types of public-key cryptographic techniques: RSA, ElGamal, and Diffie-Hellman key exchange. They found that RSA-based PAKE in their protocol is not secure against e-residue attacks [2, 3], and pointed out that EKE is only suitable for implementation using Diffie-Hellman key exchange. From then on, lots of PAKE protocols based on Diffie-Hellman have been proposed [1, 2, 4–9]. While the approach of designing PAKE protocols with RSA is far from maturity and perfection. In 1997, Lucks presented a scheme called OKE (open key exchange) [10] which is based on RSA. It was later found to be insecure against a variant of e-residue attacks because of MacKenzie et al. [11]. Furthermore, the authors modified OKE and proposed the first secure RSA-based PAKE protocol SNAPI. Since SNAPI protocol required that the RSA public exponent should be a larger prime than RSA modular, it is not practical. Later, Zhang proposed PEKEP and CEKEP protocols [12], which allow using both large and small prime numbers as RSA public exponents. To resist the e-residue attack, PEKEP protocol needs multiple RSA encryptions, and it is not very efficient. In 2007, Park et al. presented another efficient RSA-EPAKE protocol [13] which can resist the e-residue attack based on number-theoretic techniques. Unfortunately, as pointed by Youn et al. [14], RSA-EPAKE is insecure against a separation attack. Though the attack can be easily avoided by limiting the number of failed trials, an adversary can get remarkably much information of the password from single trial. Therefore, the separation attack is still a threatening attack against RSA-EPAKE protocol.

1.2. Related work

In 2005, Abdalla et al. [4] put forward the first gateway-oriented password-based authenticated key exchange (GPAKE) protocol among a client, a gateway, and an authentication server. The client and the server initially share a common password for authentication, but the session key is generated between the client and the gateway via the help of the server. In addition to the usual notion of semantic security of the session key, two additional security goals, namely key privacy with respect to honest-but-curious server and pass-word protection with respect to malicious gateway, are considered to capture dishonest behaviors of the server and the gateway, respectively. In 2006, Byun et al. [8] showed that the GPAKE protocol proposed by Abdalla et al. [4] was vulnerable to an undetectable on-line dictionary attack. A malicious gateway can iteratively guess a password and verify its guess without being detected by the server. They also proposed a countermeasure for the attack by exploiting MAC of keying material sent to the authentication server from the client. In 2008, Shim [15] showed that Byun's countermeasure was still insecure against the same undetectable on-line dictionary attack contrary to the claim in [8] that it was. In addition, Shim also designed its enhanced version (S-GPAKE) using a symmetric encryption algorithm to overcome the attack. Nevertheless, Yoon et al. [16] pointed out that the S-GPAKE protocol was inefficiently and incorrectly designed. Recently, Abdalla et al. [6] presented an anonymous variant of the original GPAKE protocol [4] with similar efficiency. They proposed a new model having stronger security which captured all the security goals in a single security game. The new security model also allowed corruption of the participants. They proved the security of the new protocol in the enhanced security model. However, partially owing to client anonymity, the new protocol is still subjected to undetectable on-line dictionary attacks. It is quite interesting to ask whether there exists a GPAKE protocol which can achieve both client anonymity and resistance against undetectable on-line dictionary attacks.

1.3. Our contribution

In this article, we investigate GPAKE protocol based on RSA. We first propose an efficient RSA-based GPAKE protocol. The new protocol involves three entities. The client and the server share a short password while the client and the gateway, respectively, possess a pair of RSA keys. However, all the RSA public/private keys are selected by the entities rather than distributed by a certificate authentication center, so no public-key infrastructure is needed. To resist e-residue attacks, the client uses the public key e of an 80-bit prime. The proposed protocol can be resistant to e-residue attacks and provably-secure under the RSA assumption in the random oracle model.

To achieve previously mentioned requirements, the authenticators and the final session key in the proposed protocol rely on different random numbers. In this way, the authenticators between the client and the server will leak no information of the password to the gateway, and the session key established between the client and the gateway is private to the server. Furthermore, standard techniques in threshold-based cryptography can also be used to achieve threshold version of the proposed protocol. It is worth pointing out that our protocol does not require public parameters. The client and the server only need to establish a shared password in advance and do not need to establish other common parameters such as generators of a finite cyclic group. This is appealing in environments where clients have insufficient resources to authenticate public parameters.

We also investigate whether or not a GPAKE protocol can achieve both client anonymity and resistance against undetectable on-line dictionary attacks by a malicious gateway. These two requirements seem to contradict each other (it seems that the server needs to know who the user is in order to resist undetectable on-line dictionary attacks). Nevertheless, this can be reconciled by saying that a server learns whether it is interacting with a user that belongs to a defined set of authorized users, but nothing more about which user it is in that set. We provide an affirmative answer to the above question by adding client anonymity to our GPAKE protocol based on RSA.

The remainder of this article is organized as follows. In Section 2, we recall the communication model and some security definitions of GPAKE protocols. In Section 3, we present our protocol and show that the new protocol is provably-secure under the RSA assumption in the random oracle model. We show in Section 4 how to add client anonymity to the basic scheme using symmetric private information retrieval (SPIR) protocols [17]. We conclude this article in Section 5.

2. Security model

In this section, we recall the security model for GPAKE protocols introduced in [4]. We will prove security of our protocol in this model. We refer the reader to [4] for more details.

2.1. Overview

A GPAKE protocol allows a client to establish an authenticated session key with a gateway via the help of an authentication server. The password is shared between the client and the server for authentication. It is assumed that the communication channel between the gateway and the server is authenticated and private, but the channel connecting the client to the gateway is insecure and under the control of an adversary.

The main security goal of the GPAKE protocol is to securely generate a session key between the client and the gateway without leaking information about the password to the gateway. To achieve this goal, Abdalla et al. [4] defined three security notions to capture dishonest behaviors of the client, the authentication server, and the gateway, respectively. The first one is semantic security of the session key, which is modeled by a Real-Or-Random (ROR) game; the second one is key privacy with respect to the server, which entails that the session key established between the client and the gateway is unknown to the passive server; and the last one is server password protection against a malicious gateway, which means that the gateway cannot learn any information about the client's password from the authentication server.

Protocol participants

The participants in a gateway-oriented password-based key exchange are the client $C\in \mathcal{C}$, the gateway $G\in \mathcal{G}$, and the authentication server $S\in \mathcal{S}$. We denote by $\mathcal{U}$ the set of all the participants (i.e., $\mathcal{U}=\mathcal{C}\cup \mathcal{G}\cup \mathcal{S}$) and by U a non-specific participant in $\mathcal{U}$.

Long-lived keys

Each client $C\in \mathcal{C}$ holds a password pw _c . Each server $S\in \mathcal{S}$ holds a vector of passwords $p{w}_S={⟨p{w}_C⟩}_{C\in \mathcal{C}}$ with an entry for each client. pw _c and pw _s are also called the long-lived keys of client C and server S, respectively.

2.2. Security Model

The security model we adopted here is the ROR model of Abdalla et al. [5]. The adversary's capabilities are modeled through queries. During the execution, the adversary may create several concurrent instances of a participant. Let Uⁱdenote the instance i of a participant U. The list of oracles available to the adversary is as follows:

• Execute(Cⁱ,G^j): This query models passive eavesdropping of a protocol execution between a client instance Cⁱand a gateway instance G^j. At the end of the execution, a transcript is given to the adversary, which logs everything an adversary could see during the execution.

• Send(Uⁱ,m): This query models an active attack against the client or gateway instance Uⁱ, in which the adversary may intercept a message and then modify it, create a new one, or simply forward it to the intended recipient. Instance Uⁱexecutes as specified by the protocol and sends back its response to the adversary.

• Test(Uⁱ): This query is used to measure the semantic security of the session key of instance Uⁱ, if the latter is defined. If the key is not defined, return the undefined symbol ⊥. Otherwise, return either the session key held by instance Uⁱif b = 1 or a random key of the same size if b = 0, where b is a hidden bit chosen uniformly at random at the beginning of the experiment defining the semantic security of session keys.

In the ROR model, the adversary can ask Test queries for all the sessions. All the Test queries will be answered using the same random bit b that was chosen at the beginning of the experiment. In other words, the keys returned by the Test oracle are either all real or all random. However, in the random case, the same random key is returned for two partnered instances (see the notion of partnering below). The goal of the adversary is to guess the value of the hidden bit b used to answer Test queries. The adversary is said to be successful if it guesses b correctly.

It should be noted that Reveal oracle exists in the Find-Then-Guess (FTG) model is not available to the adversary in the ROR model. However, since the adversary in FTG model is restricted to asking only a single query to the Test oracle, the ROR security model is actually stronger than the FTG security model. Abdalla et al. demonstrated that proofs of security in the ROR model can be easily translated into proofs of security in the FTG model. For more details, refer to [5].

2.3. Security notions

We give the main definitions in the following. The definition approach of partnering uses session identifications and partner identifications. The session identification is the concatenation of all the messages of the conversation between the client and the gateway instances before the acceptance. Two instances are partnered if they hold the same non-null session identification.

Definition 1. A client instance Cⁱand a gateway instance G^jare said to be partnered if the following conditions are met: (1) both Cⁱand G^jaccept; (2) both Cⁱand G^jshare the same session identification; (3) the partner identification for Cⁱis G^jand vice versa; (4) no instance other than Cⁱand G^jaccepts with a partner identification equal to Cⁱor G^j.

The adversary is only allowed to perform tests on fresh instances. Otherwise, it is trivial for the adversary to guess the hidden bit b. The freshness notion captures the intuitive fact that a session key is not trivially known to the adversary.

Definition 2. An instance of a client or a gateway is said to be fresh in the current protocol execution if it has accepted.

Semantic security

Consider an execution of the key exchange protocol $\mathcal{P}$ by the adversary $\mathcal{A}$ in which the latter is given access to Execute, Send oracles, as well as to Test oracle calls to fresh instances. The goal of the adversary is to guess the value of the hidden bit b used by the Test oracle. Let Succ denote the event in which the adversary successfully guesses the hidden bit b used by Test oracle.

Definition 3. The advantage of an adversary$\mathcal{A}$in violating the AKE semantic security of the protocol$\mathcal{P}$in the ROR sense, when passwords are uniformly drawn from a dictionary$\mathcal{D}$, is defined as

$$Ad{v}_{\mathcal{P},\mathcal{D}}^{ake-ror}\left(\mathcal{A}\right)=2\cdot Pr\left[Succ\right]-1.$$

The advantage function of the protocol $\mathcal{P}$ is defined as

$$Ad{v}_{\mathcal{P},\mathcal{D}}^{ake-ror}\left(t,R\right)=max\left\{Ad{v}_{\mathcal{P},\mathcal{D}}^{ake-ror}\left(\mathcal{A}\right)\right\},$$

where maximum is over all$\mathcal{A}$with time-complexity at most t and using resources at most R (such as the number of oracle queries).

We have the following definition of semantic secure GPAKE protocol, which is the same as in [4].

Definition 4. A GPAKE protocol$\mathcal{P}$is said to be semantically secure if the advantage$Ad{v}_{\mathcal{P},\mathcal{D}}^{ake-ror}\left(t,R\right)$is only negligibly larger than$kn∕\left|\mathcal{D}\right|$, where n is number of active sessions, and k is a constant.

Note that k = 1 is the best one can hope for since an adversary that simply guesses the password in each of the active sessions has an advantage of $n∕\left|\mathcal{D}\right|$.

Key privacy

In GPAKE protocols, the session key between the client and the gateway is established with the help of the server. In order to reduce the amount of trust one puts into the server, we require that the session key should be even indistinguishable to an honest but curious server who knows all the passwords of the clients. The notion of key privacy with respect to the server was first introduced in [5] to capture this security requirement.

To define the notion of key privacy, we consider a server which knows all the passwords of the clients, and behaves in an honest but curious manner. We give the server access to all the oracles, but restricts the server to testing session keys generated by two oracles. To achieve this aim, we use a new type of TestPair oracle which was first introduced in [5]. The TestPair oracle is defined as follows:

• TestPair(Cⁱ,G^j): If the client instance Cⁱand the gateway instance G^jdo not share the same key, then return the undefined symbol ⊥. Otherwise, return either the session key established between Cⁱand G^jif b = 1 or a random key of the same size if b = 0, where b is a hidden bit chosen uniformly at random at the beginning of the experiment defining the key privacy of session keys.

Consider an execution of the key exchange protocol $\mathcal{P}$ by an adversary $\mathcal{A}$ with access to all the passwords held by the server as well as to the Execute, Send, and TestPair oracles. Let Succ denote the event in which the adversary is successful in guessing the hidden bit b used by TestPair oracle. The advantage of an adversary $\mathcal{A}$ in violating the key privacy of the protocol $\mathcal{P}$ in the ROR sense ($Ad{v}_{\mathcal{P},\mathcal{D}}^{ake-kp}\left(\mathcal{A}\right)$) and the advantage function of $\mathcal{P}\left(Ad{v}_{\mathcal{P},\mathcal{D}}^{ake-kp}\left(t,R\right)\right)$, when passwords are uniformly drawn from a dictionary $\mathcal{D}$, can be defined as in Definition 3.

Definition 5. A GPAKE protocol$\mathcal{P}$is said to achieve key privacy if the advantage$Ad{v}_{\mathcal{P},\mathcal{D}}^{ake-kp}\left(t,R\right)$is negligible.

Server password protection

One of the security goals of GPAKE protocol is to prevent the gateway from learning the client's password that is stored in the server. If the adversary interacts q times with the server, then the probability that it can distinguish the true password from a random one in the dictionary should be only negligibly larger than $q∕\left|\mathcal{D}\right|$. However, this does not rule out the possibility of undetectable on-line dictionary attacks by a malicious gateway. A malicious gateway can iteratively guess a password and verify its guess until it finds the correct password. To resist such attacks, we consider a malicious gateway $\mathcal{A}$ who guesses a password and verifies its guess by interacting with the server. If a failed guess will not be detected by the server, then we say the malicious gateway is successful. Let $Ad{v}_{\mathcal{P},\mathcal{D}}^{ake-uoda}\left(\mathcal{A}\right)$ denotes the success probability of the gateway.

Definition 6. A GPAKE protocol$\mathcal{P}$can resist undetectable on-line dictionary attacks if$Ad{v}_{\mathcal{P},\mathcal{D}}^{ake-uoda}\left(\mathcal{A}\right)$is negligibly larger than$kn∕\left|\mathcal{D}\right|$, where n is number of active sessions, and k is a constant.

3. Our GPAKE protocol based on RSA

In this section, we describe our GPAKE protocol based on RSA, and present its security results.

3.1. Description

Define hash functions H₁,H₂, H₃ : {0,1}* → {0, 1}^k, and H : {0,1}* → Z _n , where k is a security parameter, e.g., k = 160. We assume that H₁,H₂,H₃, and H are independent random functions in the following.

The protocol runs among a client, a gateway, and an authentication server. Its description is given in Figure 1. The client and the authentication server initially share a lightweight string pw, the password, uniformly drawn from the dictionary $\mathcal{D}$. The client has generated a pair of RSA keys n, e, and d, where n is a large positive integer equal to the product of two primes of the same size, e is an 80-bit prime relatively prime to ϕ(n), and d is a positive integer such that ed ≡ 1 mod ϕ(n). The gateway also has generated a pair of RSA keys n',e', and d', where n' is a large positive integer equal to the product of two primes of the same size, e' is a positive integer relatively prime to ϕ(n'), and d' is a positive integer such that e'd' ≡ 1 mod ϕ(n'). The channel connecting the gateway to the authentication server is assumed to be authenticated and private. The protocol proceeds as follows:

Figure 1

Gateway-oriented password-authenticated key exchange protocol based on RSA.

• 1. The client C sends her public key (n, e) and a random number r ₁ ∈ {0, 1}^kto the gateway G, and G just forwards the message and her RSA public key (n', e') to the authentication server.

• 2. The authentication server S verifies if e is an 80-bit prime, and n is an odd integer. S may also verify that the integer n is large enough, e.g., n > 2¹⁰²³. If e is not an 80-bit prime or n is not an odd integer, S rejects; otherwise, S selects three random numbers $x_1,x_2\in Z_n^{*}$, and r ₂ ∈ {0, 1}^k. S then computes $y_1=x_1^e$ mod n and $y_2=x_2^e$ mod n, S also computes w = H (pw, x ₂, C, G, n, e, n', e', r ₁,r ₂,y ₂) and checks whether gcd (w, n) = 1. If gcd (w, n) = 1, S computes z = y ₁ · w mod n and sends (r ₂,z, y ₂) to the gateway. Upon receiving (r ₂,z, y ₂), G sends (n', e', r ₂,z, y ₂) to C.

• 3. Upon receiving (n', e', r ₂, z, y ₂) from G, C verifies if n' is an odd integer and n' is large enough, e.g., n' > 2¹⁰²³. C selects a random number $b_1\in Z_{n^{\prime }}^{*}$. C then decrypts $x_2=y_2^d$ mod n, computes w using her password pw and x ₂, then checks if w and n are relatively prime. If gcd (w, n) = 1, C decrypts x ₁ = (w ^-1 · z)^dmod n, computes $c_1=b_1^{e^{\prime }}$ mod n'. Finally, C computes μ = H ₁(x ₁,C, G, n, e, n', e', r ₁,r ₂, y ₂,z, c ₁) and sends (c ₁,μ) to G. Upon receiving (c ₁,μ), G selects a random number $b_2\in Z_n^{*}$, computes $c_2=b_2^e$ mod n, sends (c ₁,c ₂, μ) to S.

• 4. S checks whether μ is valid or not. If μ is valid, S computes her authenticator η = H ₂(x ₁, C, G, n, e, n', e', r ₁, r ₂,y ₂, z, c ₁, c ₂). Finally, S sends η to G.

• 5. Upon receiving η, G decrypts $b_1=c_1^{d^{\prime }}$ mod n', sets the session key sk = H ₃(b ₁, b ₂, ID), where ID is the concatenation of all the exchanged messages. G sends η and c ₂ to C.

• 6. C checks whether η is valid or not. If valid, C decrypts $b_2=c_2^d$ mod n and sets the session key to be sk = H ₃(b ₁, b ₂, ID), where ID is the concatenation of all the exchanged messages.

In RSA-based protocols, security against e-residue attacks [3] has to be considered. To void such an e-residue attack, we adopt the approach of [18] and require the public key of the client is an 80-bit prime. However, [18] is basically a two-factor protocol, and their main concern is security against replacement attacks. Hence, in this context, we still briefly prove the security against e-residue attacks of our protocol. Suppose the adversary $\mathcal{A}$ generates the RSA parameter (n,e), where e is an 80-bit prime and gcd (e, ϕ(n)) = e. Upon receiving (n, e), the authentication server S randomly chooses $x_1,x_2\in Z_n^{*}$, computes $y_1=x_1^e$ mod n and $y_2=x_2^e$ mod n, then S calculates w using the password pw and x₂. Finally, S sends (r₂, z, y₂) back to the adversary, where z = y₁ · w mod n. To mount an e-residue attack, first of all, the adversary should correctly find out the committed value x₂. Since $y_2=x_2^e$ mod n, which is equivalent to e·ind _g x₂ ≡ ind _g y₂ mod ϕ(n). The congruence has exactly e solutions because gcd (e, ϕ(n)) = e and e|ind _g y₂. The success probability that the adversary correctly find out the committed value is 1/e, which is negligible since e is an 80-bit prime.

Remark 1 To resist e-residue attacks, we require that the client use the public key e of an 80-bit prime, the server needs to test the primality for the 80-bit prime. However, there is no restriction on the gateway's public key e'. This is because the gateway's public key is only used to establish the session key and has nothing to do with the password.

Remark 2 In case of n > 2¹⁰²³, the computational load for generating an 80-bit prime is less than for a single RSA decryption, and the computational load for the primality test of an 80-bit prime is less than for a single RSA encryption with an 80-bit exponent. Hence, our protocol is quite efficient in computation cost. Furthermore, if we exclude perfect forward secrecy from consideration, we need not to generate them in each session, this further improves the efficiency of our protocol.

3.2. Security

In this section, we prove the security of our protocol within the formal model of security given in Section 2. In our analysis, we assume the intractability of the RSA problem.

RSA assumption [13]

Let l be the security parameter of RSA. Let key generator GE define a family of RSA functions, i.e., (e, d, n) ← GE (1^l), where n is the product of two primes of the same size, gcd (e, ϕ (n)) = 1, and ed = 1 mod ϕ (n). For any probabilistic polynomial-time algorithm $\mathcal{C}$ in running time t, the following probability

$$Ad{v}_c^{rsa}\left(t\right)=Pr\left(\begin{array}{c}\hfill x^e=cmodn:\left(e,d,n\right)\leftarrow GE\left(1^l\right),\hfill \\ \hfill c{\in }_R{\left\{0,1\right\}}^l,x\leftarrow \mathcal{C}\left(1^l,c,e,n\right)\hfill \end{array}\right)$$

is negligible. In the following, we use Adv^rsa(t) to denote $\mathsf{\text{ma}}{\mathsf{\text{x}}}_{\mathcal{C}}\left\{{Adv}_{\mathcal{C}}^{rsa}\left(t\right)\right\}$, where the maximum is taken over all the polynomial-time algorithms of running time t.

Semantic security

As the following theorem states, our protocol is a secure gateway-oriented password-based key exchange protocol as long as the RSA problem is intractable. The proof of security assumes $\mathcal{D}$ to be a uniformly distributed dictionary and of size smaller than 2^k. The proof of Theorem 3.1 can be found in Appendix A.

Theorem 3.1. Let$\mathcal{A}$be an adversary which runs in time t and makes Q _send , Q _send ≤ |D|, queries of type Send to different instances. Then, the adversary's advantage in attacking the semantic security of the proposed protocol is bounded by

$$\begin{array}{c}Ad{v}_{\mathcal{P},\mathcal{D}}^{ake-ror}\left(\mathcal{A}\right)\le \frac{2Q_{send}}{\left|\mathcal{D}\right|}+\left(3Q_{send}+2Q_{execute}\right)Ad{v}^{rsa}\left(O\left(t\right)\right)\\ +\frac{\left(2Q_{send}+Q_{execute}\right)Q_{oh}}{\varphi \left(n\right)}+\frac{Q_{send}}{2^{k-1}}+\frac{Q_{send}}{2^{79}},\end{array}$$

where Q _execute denotes the number of queries of type Execute, and Q _oh denotes the number of random oracle calls.

Key privacy

As the following theorem shows, our protocol achieves the goal of key privacy as long as the RSA problem is intractable.

Theorem 3.2. Let $\mathcal{A}$ be an adversary which runs in time t and makes Q _execute queries of type Execute to different instances. Then, the adversary's advantage in attacking the key privacy of the proposed protocol is bounded by

$$Ad{v}_{\mathcal{P},\mathcal{D}}^{ake-kp}\left(\mathcal{A}\right)\le Q_{execute}Ad{v}^{rsa}\left(O\left(t\right)\right).$$

The proof of Theorem 3.2 is similar to the proof of Lemma A.1 in Appendix A. The only difference is that in this case the adversary knows the passwords of all the clients. However, this only brings negligible advantage to the adversary since the authenticators and the session keys rely on different random numbers. In order to distinguish the session key from random numbers chosen from {0, 1}^k, the adversary still needs to break RSA. We omit the proof of Theorem 3.2 for simplicity.

Server password protection

As is shown by the following theorem, a malicious gateway cannot do much better than eliminating one password from the list of possible candidates with each interaction with the server. As a result, after q interactions with the server, the advantage of a malicious gateway would be only negligibly larger than $q∕\left|\mathcal{D}\right|$. Furthermore, a failed guess of the malicious gateway will be detected by the authentication server. A malicious gateway cannot iteratively guess a password and verify its guess without being detected. Hence, our protocol can resist undetectable on-line dictionary attacks. The proof of Theorem 3.3 can be found in Appendix B.

Theorem 3.3. Let$\mathcal{A}$be a malicious gateway which runs in time t and makes Q _send queries of type Send to server instances. Then, the advantage of the malicious gateway in violating the resistance to undetectable on-line dictionary attacks of the proposed protocol is bounded by

$$Ad{v}_{\mathcal{P},\mathcal{D}}^{ake-uoda}\left(\mathcal{A}\right)\le \frac{Q_{send}}{\left|\mathcal{D}\right|}+\frac{Q_{send}}{2^k}+\frac{Q_{send}}{2^{80}}.$$

4. Adding client anonymity

Anonymity is one of the most important security goals of protocols on public networks. Many of the privacy problems that arise out of Internet use can be solved using anonymous Internet connections such that a client's actions are unlinkable. Implementing anonymity of clients not only protects their personal information but also reduces the chances of attacks based on impersonation. In this section, we show how to add client anonymity to our protocol.

The basic idea is same as Abdalla et al.'s [6]. We assume that there are many gateways, but the authentication server is unique. In order to add client anonymity, we try to hide the client identity to the authentication server using SPIR [17] protocols. An SPIR protocol allows a client to retrieve an item from a server in possession of a database without revealing which item they are retrieving, and it also allows for the restricting of the number of items a given client may retrieve. When the gateway receives an authorization request from a client, the gateway can run an SPIR protocol with the authentication server, such that the server does not know the real identity of the client and the gateway only gets the answer to the actual client. More precisely, the authentication server can be seen as a dynamic database. For each authorization request, the authentication server computes the answers for all the possible clients, and the gateway retrieves the one it is interested in. At the end of the SPIR protocol, the authentication server does not know which answer the gateway gets and the gateway will not get more than the number of the values it is allowed to retrieve.

Our RSA-based GPAKE can be efficiently implemented with any good SPIR protocol. Specifically, we assume that each client owns a password indexed by i, and the server manages a database of size N, which contains all the passwords for each client. In order to introduce anonymity to the protocol in Section 3, we do as follows: upon receiving of a Send-query with input (C _j , n, e, r₁), the gateway conceals the real identity of the client and sends (n, e, n', e', r₁) to the server. Upon receiving (n, e, n', e', r₁), the server dynamically generates a database by computing the answers for each message (C _i , n, e, n', e', r₁), and thus for all the possible clients C _i , since it does not know which one is interacting with the gateway. More precisely, the server chooses $r_2\in {\left\{0,1\right\}}^k,x_1\in Z_n^{*}$, and for each C _i , the server also chooses $x_{2i}\in Z_n^{*}$, computes $y_1=x_1^e$ mod n and $y_{2i}=x_{2i}^e$ mod n. The dynamic database consists of all the blocks Bi = (r₂, z _i , y_2i), where z _i = y₁ · wi mod n and w _i = H (pw _i , x_2i, C _i ,G, n, e, n', e', r₁, r₂, y_2i). Then, the gateway runs the SPIR protocol to get the correct B _j , while preserving the anonymity of the client. The remains are the same as the proposed GPAKE protocol except that the values μ and η are computed as H₁(x₁, G, n, e, n', e', r₁, r₂) and H₂(x₁,G, n, e, n', e', r₁, r₂, c₁, c₂), respectively.

It is worth pointing out that achieving client anonymity, our protocol still can resist the undetectable on-line dictionary attack in the sense that a failed guess of the malicious gateway will be detected by the server. To impersonate a client successfully, the malicious gateway needs recover y₁ using the guessed password of the victim client and then obtains x₁ by decrypting y₁. If the guessed password is not correct, then the value μ is not valid and the server will detect the attack, and then some measures should be taken to protect the passwords of the clients.

5. Conclusion

In this article, we investigate the design of RSA-based GPAKE protocols. First, we develop a new GPAKE protocol using RSA public-key cryptosystem. The proposed protocol is secure against e-residue attacks. Then, we provide a formal security analysis of our protocol under the RSA assumption and the random oracle model. We also show that our protocol is secure against undetectable on-line dictionary attacks. Finally, we investigate whether or not such a protocol can achieve both client anonymity and resistance to undetectable on-line dictionary attacks. We give an affirmative answer by adding client anonymity to our basic protocol.

Appendix A. Proof of Theorem 3.1

We prove Theorem 3.1 using similar techniques as described in [19]. We define a series of hybrid experiments. In each experiment, we modify the way session keys are chosen for instances involved in protocol execution. We start by choosing random session keys for instances for which the Execute oracle is called. Then, we continue to choose random session keys for instances for which the Send oracle is called. These instances are gradually changed over five hybrid experiments and in the last experiment, all the session keys are selected uniformly at random. Thus, the adversary $\mathcal{A}$ cannot distinguish them from random numbers. We denote these hybrid experiments by P₀, P₁, ..., P₄ and by $Adv\left(\mathcal{A},P_i\right)$ the advantage of $\mathcal{A}$ when participating in experiment P _i .

Experiment P₀

This describes the real adversary attack. During the attack, the adversary $\mathcal{A}$ makes a number of oracle calls (Send, Execute, and Test) as specified in Section 2. In addition, the adversary $\mathcal{A}$ has access to four independent random oracles

$$H:{\left\{0,1\right\}}^{*}\to Z_n,H_1,H_2,H_3:{\left\{0,1\right\}}^{*}\to {\left\{0,1\right\}}^k.$$

Each random oracle H _i (or H) maintains a list of input-output pairs (q₀, r₀), (q₁, r₁)···. On a new input q, H _i (or H) checks if q was queried before. If there exists q _i in the list such that q = q _i , then the random oracle returns the corresponding r _i as its reply. If q is not in the list, the random oracle chooses a random number r, returns r as its reply and adds the pair (q, r) to its list. It is clear that $Adv\left(\mathcal{A}\right)=Adv\left(\mathcal{A},P_0\right)$.

Experiment P₁

In this experiment, the Execute oracle is modified so that the session keys of instances for which Execute is called are selected uniformly at random, that is, if the oracle Execute (Cⁱ, G^j) is called, then the session key sk is set equal to a random number selected from {0, 1}^k, rather than the output of the random oracle H₃. The following lemma shows that modifying the Execute oracle in this way affects the advantage of $\mathcal{A}$ by a negligible value.

Lemma Appendix A.1

For every polynomial-time adversary$\mathcal{A}$making Q _execute oracle calls of type Execute,

$$|Adv\left(\mathcal{A},P_1\right)-Adv\left(\mathcal{A},P_0\right)|\le 2Q_{execute}Ad{v}^{rsa}\left(O\left(t\right)\right)+Q_{execute}{Q}_{oh}∕\varphi \left(n\right),$$

where Q _oh denotes the number of random oracle calls, and t is the running time of$\mathcal{A}$.

Proof. We prove this lemma by showing how any advantage that $\mathcal{A}$ has in distinguishing P₁ from P₀ can be used to break RSA. In experiment P₀, the session key is the output of the random oracle H₃ on the input (b₁, b₂, ID), where ID is the concatenation of all the exchanged messages. If the adversary does not know b₁ and b₂, she cannot distinguish the output of H₃ from a random number uniformly selected from {0, 1}^k. Hence, the adversary $\mathcal{A}$ can distinguish P₁ and P₀ if and only if $\mathcal{A}$ can recover the integers b₁ and b₂. Let $p_{b_1}\left(p_{b_2}\right)$ denote the probability that $\mathcal{A}$ recovers the integer b₁ (b₂).

For a easier analysis, we let the adversary win if the adversary recovers the integer b₂. To bound $p_{b_2}$, we consider the following two games G₁ and G₂.

Game G₁

The adversary $\mathcal{A}$ carries out an honest execution between the instances Cⁱand G^jas the protocol description. When the game ends, the adversary $\mathcal{A}$ outputs her guess of the integer b₂.

Game G₂

This game is similar to game G₁ except that we use private oracles when we compute w, μ, and η.

Let $p_{b_2}\left(G_1\right)$ denote the probability that $\mathcal{A}$ makes a correct guess of b₂ in game G₁. Likewise, $p_{b_2}\left(G_2\right)$ denote the probability that $p_{b_2}=p_{b_2}\left(G_1\right)$ makes a correct guess of b₂ in game G₂. It is clear that $\mathcal{A}$. Let AskH denote the event that $\mathcal{A}$ queries random oracle H on (pw, x₂, C, G, n, e, n', e', r₁, r₂, y₂). Let AskH_1,2 denote the event that $\mathcal{A}$ queries random oracle H₁ on (x₁, C, G, n, e, n', e', r₁, r₂, y₂,z, c₁) or H₂ on (x₁, C, G, n, e, n', e', r₁, r₂, y₂, z, c₁, c₂), while AskH does not happen.

Then, we have

$$\begin{array}{c}|p_{b_2}\left(G_1\right)-p_{b_2}\left(G_2\right)|\le Pr\left[AskH\right]+Pr\left[Ask{H}_{1,2}\right],\\ p_{b_2}\left(G_1\right)\le Pr\left[AskH\right]+Pr\left[Ask{H}_{1,2}\right]+p_{b_2}\left(G_2\right).\end{array}$$

Let Q _oh denote the number of random oracle calls to H₁ and H₂ by $\mathcal{A}$ In the following, we bound the probabilities of events AskH and AskH_1,2, and also show that $p_{b_1}\left(G_2\right)\le Ad{v}^{rsa}\left(O\left(t\right)\right)$.

Given RSA public key (n, e) and integer c ∈ _R Z _n , we construct an efficient algorithm $\mathcal{C}$ to decrypt c as follows: algorithm $\mathcal{C}$ runs the adversary $\mathcal{A}$ exactly as in game G₂ except that when simulate the authentication server, $\mathcal{C}$ first chooses two random numbers x, $x^{\prime }\in Z_n^{*}$, computes y₂ = x^e· c mod n, and set z to be z = x^'e· c · w mod n, where w is uniformly chosen from $Z_n^{*}$. Finally, when simulate the gateway, $\mathcal{C}$ set c₂ to be c. If event AskH happens, which means $\mathcal{A}$ queries random oracle H on (pw, x₂, C, G, n, e, n', e', r₁, r₂, y₂), where $x_2^e=x^e\cdot c$ mod n, then we can decrypt c by x₂/x mod n. If event AskH does not happen, then z is a random number from $\mathcal{A}$'s view. $\mathcal{A}$ can select a random number $x^{\prime }\in Z_n^{*}$ as her guess on x₁ and verifies the correctness of x' by comparing μ (or η). Then,

$$\begin{array}{c}\mathsf{\text{Pr}}\left(AskH\right)={Adv}_{\mathcal{C}}^{rsa}\left(O\left(t\right)\right)\le {Adv}^{rsa}\left(O\left(t\right)\right),\\ \mathsf{\text{Pr}}\left(Ask{H}_{1,2}\right)=Q_{oh}∕\varphi \left(n\right).\end{array}$$

Similarly, if $\mathcal{A}$'s output (denoted by b₂) in game G₂ is correct, then b₂ is the decryption of c.

$$p_{b_2}\left(G_2\right)=Ad{v}_C^{rsa}\left(O\left(t\right)\right)\le Ad{v}^{rsa}\left(O\left(t\right)\right),p_{b_2}\le 2Ad{v}^{rsa}\left(O\left(t\right)\right)+Q_{oh}∕\varphi \left(n\right).$$

Assume that $\mathcal{A}$ makes Q _execute oracle calls of type Execute in the hybrid experiment P₁, then

$$|Adv\left(\mathcal{A},P_1\right)-Adv\left(\mathcal{A},P_0\right)|\le 2Q_{execute}Ad{v}^{rsa}\left(O\left(t\right)\right)+Q_{execute}{Q}_{oh}∕\varphi \left(n\right).$$

Before we present the experiments P₂, P₃, and P₄, we describe Send oracles which an active adversary $\mathcal{A}$ uses.

• Send₀(Cⁱ): the instance Cⁱselects a pair of RSA public/private keys e, d, n, and a random number r₁ ∈ {0, 1}^k. It returns C, n, e, and r₁ to the adversary $\mathcal{A}$.

• Send₁(G^j, C, n, e, r₁): the instance G^jselects a pair of RSA public/private keys (e', d', n'), sends (C, n, e, n', e', r₁) to the server. G^jobtains (r₂, z, y₂) as the reply of the server. It returns (n', e', r₂, z, y₂) to the adversary $\mathcal{A}$.

• Send₂(Cⁱ, n', e', r₂, z, y₂): the instance Cⁱverifies if n' is big enough, i.e., n' > 1023. Then, Cⁱselects a random number $b_1\in Z_{n^{\prime }}^{*}$, and decrypts $x_2=y_2^d$ mod n, then computes w using her password pw and x₂, checks if w and n are relatively prime. If gcd (w, n) = 1, Cⁱdecrypts x₁ = (w^-1·z)^dmod n, computes $c_1=b_1^{e^{\prime }}$ mod n'. Finally, Cⁱcomputes μ = H₁(x₁, C, G, n, e, n', e', r₁, r₂, y₂, z, c₁) and returns (c₁, μ) to the adversary $\mathcal{A}$.

• Send₃(G^j,c₁,μ): the instance G^jselects a random number $b_2\in Z_n^{*}$, computes $c_2=b_2^e$ mod n, sends (c₁,c₂,μ) to S. G^jobtains η as the reply of the server. It decrypts $b_1=c_1^{d^{\prime }}$ mod n', sets the session key sk = H₃(b₁, b₂, ID), where ID is the concatenation of all the exchanged messages. It returns η and c₂ to the adversary $\mathcal{A}$.

• Send₄(Cⁱ, η, c₂): the instance Cⁱchecks whether η is valid or not. If η is invalid, it rejects. Otherwise, it decrypts $b_2=c_2^d$ mod n, and computes sk = H₃(b₁, b₂, ID), where ID is the concatenation of all the exchanged messages.

A message is said to have been oracle-generated if it was output by an instance; otherwise, it is said to have been adversarially-generated. A message generated by instance Uⁱis said to have been Uⁱ-oracle-generated.

Experiment P₂

In this experiment, an instance G^jreceives a Cⁱ-oracle-generated message (C, n, e, r₁) in a Send₁ oracle call. If both Cⁱand G^jaccept, they are given the same random session keys sk ∈ {0, 1}^k, and if G^jaccepts but Cⁱdoes not accept, then only G^jreceives a random session key, and no session key is defined for Cⁱ.

Lemma Appendix A.2

For every polynomial-time adversary$\mathcal{A}$making Q _send oracle calls of type Send to different instances,

$$|Adv\left(\mathcal{A},P_2\right)-Adv\left(\mathcal{A},P_1\right)|\le 2Q_{send}Ad{v}^{rsa}\left(O\left(t\right)\right),$$

where t is the running time of$\mathcal{A}$.

Proof. Assume that G^jreturns (G, n', e', r₂, z, y₂) to the adversary according to the description of the protocol after receiving a Cⁱ-oracle-generated message (C, n, e, r₁) in a Send₁ oracle call. Since the RSA public key (e, n) was generated by Cⁱ, not by $\mathcal{A}$, the private key d is not known to $\mathcal{A}$. As shown in the proof of Lemma A.1, the probability for $\mathcal{A}$ to recover the random number x₁ is upper bounded by Adv^rsa(O (t)). Hence, except for a probability as small as Adv^rsa(O (t)), G^jhas received a Cⁱ-oracle-generated message in a Send₃ oracle when G^jaccepts. Similarly, if Cⁱaccepts, then it has received a G^j-oracle-generated message in a Send₄ oracle call. If both Cⁱand G^jaccept, then they share the same session key which is equal to the output of the random oracle H₃ on (b₁, b₂, ID), where ID is the concatenation of all the exchanged messages. Hence, the modification of the session keys of Cⁱand G^jaffects the adversary's advantage by a value as small as Adv^rsa(O (t)). Since $\mathcal{A}$ makes Q _send oracle calls of type Send to different instances, $\mathcal{A}$'s advantage in distinguishing between P₂ and P₁ is upper bounded by Q _send Adv^rsa(O(t)).

Experiment P₃

In this experiment, an instance Cⁱreceives a G^j-oracle-generated message (n', e', r₂, z, y₂) in a Send₂ oracle call, while the instance G^jhas received a Cⁱ-oracle-generated message (C, n, e, r₁) in a Send₁ oracle call. If both Cⁱand G^jaccept, then they are given the same random session keys sk ∈ {0, 1}^k. It is clear that the advantage of $\mathcal{A}$ in P₃ is the same as its advantage in P₂.

Lemma Appendix A.3

For every polynomial-time adversary$\mathcal{A}$making Q _send oracle calls of type Send to different instances,

$$Adv\left(\mathcal{A},P_3\right)=Adv\left(\mathcal{A},P_2\right).$$

Experiment P₄

In this experiment, we consider an instance Cⁱ(or G^j) that receives an adversarially-generated message in a Send₂ (or Send₁) oracle call. In this case, if Cⁱ(or G^j) accepts, then the experiment is halted, and the adversary is said to have succeeded. This certainly improves the probability of success of the adversary.

Lemma Appendix A.4

For every polynomial-time adversary$\mathcal{A}$making Q _send oracle calls of type Send to different instances,

$$Adv\left(\mathcal{A},P_3\right)=Adv\left(\mathcal{A},P_4\right).$$

At this point, we have given random session keys to all the accepted instances that receive Execute or Send oracle calls. We next proceed to bound the adversary's success probability in P₄. The following lemma shows that the adversary's success probability in the experiment P₄ is negligible.

Lemma Appendix A.5

For every polynomial-time adversary$\mathcal{A}$making Q _send oracle calls of type Send to different instances, Q _send ≤ |D|,

$$Adv\left(\mathcal{A},P_4\right)\le \frac{2Q_{send}}{\left|\mathcal{D}\right|}+2Q_{send}Ad{v}^{rsa}\left(O\left(t\right)\right)+\frac{2Q_{send}{Q}_{oh}}{\varphi \left(n\right)}+\frac{Q_{send}}{2^{k-1}}+\frac{Q_{send}}{2^{79}},$$

where Q _oh denotes the number of random oracle calls, and t is the running time of$\mathcal{A}$.

Proof. Let $Q_{sen{d}_1}$ and $Q_{sen{d}_2}$ denote the number of Send₁ and Send₂ oracle calls made by the adversary in experiment P₄, respectively. We consider the following two cases:

Case 1: Consider an instance Cⁱreceives an adversarially-generated message (n', e', r₂, z, y₂) in a Send₂ oracle. Assume that Cⁱreturns (n, e, r₁) in a Send₀ oracle. After receiving (n', e', r₂, z, y₂), Cⁱfirst decrypts y₂ to obtain x₂, then queries the random oracle H on (pw, x₂, C, G, n, e, n', e', r₁, r₂, y₂) and receives w from H. Without lose of generality, we assume that gcd (w, n) = 1. Then, Cⁱcomputes x₁ = (w^-1 · z)^dmod n and $c_1=b_1^{e^{\prime }}$ mod n', where $b_1\in Z_{n^{\prime }}^{*}$. Cⁱqueries H₁ on (x₁, C, G, n, e, n', e', r₁, r₂, y₂, z, c₁) and returns the reply (denoted by μ) to the adversary $\mathcal{A}$. To succeed in this case, $\mathcal{A}$ must generate a number η which is equal to the output of the random oracle H₂ on (x₁, C, G, n, e, n', e', r₁, r₂, y₂, z, c₁, c₂). Without the knowledge of x₁, the probability for $\mathcal{A}$ to generate η is just 2^-k. Let $p_{x_1}$ denote the probability that $\mathcal{A}$ can recover the integer x₁. The adversary's success probability in this case is bounded by

$$Pr\left[Succ\right]\le Q_{sen{d}_2}\left(p_{x_1}+2^{-k}\right).$$

If z was selected by $\mathcal{A}$ at random from $Z_n^{*}$, then similar to the proof of Lemma A.1, we can prove that $p_{x_1}$ is bounded by

$$p_{x_1}\le Ad{v}^{rsa}\left(O\left(t\right)\right)+\frac{Q_{oh}}{\varphi \left(n\right)}.$$

Next, assume that z was generated by $\mathcal{A}$ as follows: $\mathcal{A}$ selected two random numbers $x_1,x_2\in Z_n^{*}$, as well as a candidate password $p{w}^{\prime }\in \mathcal{D},\mathcal{A}$ queries the random oracle H on (pw', x₂, C, G, n, e, n', e', r₁, r₂, y₂) and receives the reply w, then $\mathcal{A}$ computed $z=x_1^e\cdot w$ mod n. In this scenario, if $\mathcal{A}$ guesses the correct password pw = pw', then $\mathcal{A}$ succeeds. If $\mathcal{A}$ guesses an invalid password pw ≠ pw', then z can be treated as a random number in $Z_n^{*}$. Hence, we have

$$p_{x_1}\le \frac{1}{\left|\mathcal{D}\right|}+Ad{v}^{rsa}\left(O\left(t\right)\right)+\frac{Q_{oh}}{\varphi \left(n\right)}.$$

The adversary's success probability in Case 1 is upper bounded by

$$Pr\left[Succ\right]\le \frac{Q_{sen{d}_2}}{\left|\mathcal{D}\right|}+Q_{sen{d}_2}Ad{v}^{rsa}\left(O\left(t\right)\right)+\frac{Q_{sen{d}_2}{Q}_{oh}}{\varphi \left(n\right)}+\frac{Q_{sen{d}_2}}{2^k}.$$

Case 2: Consider an instance G^jreceives an adversarially-generated message (C, n, e, r₁) in a Send₁ oracle, where n is an odd integer, and e is odd prime. The instance G^jsends (C, n, e, n, e, r₁) to the server. The server replies (r₂, z) according to the protocol description. To succeed in this case, $\mathcal{A}$ must send back a number μ which is equal to the output of the random oracle H₁ on (x₁, C, G, n, e, n', e', r₁, r₂, z, c₁). Without the knowledge of x₁, the probability for $\mathcal{A}$ to generate μ is just 2^-k. Let $p_{x_1}$ denote the probability that $\mathcal{A}$ can recover the integer x₁.

Note that (n, e) was generated by $\mathcal{A}$. If gcd (e, ϕ(n)) = 1, then $\mathcal{A}$ can compute w = H (pw', x₂, C, G, n, e, n', e', r₁, r₂, y₂) using a guessing password pw'. Then, congruence $z=x_1^e\cdot w$ mod n has a unique solution because gcd (e, ϕ(n)) = 1. If $\mathcal{A}$ guesses the correct password pw = pw', then $\mathcal{A}$ can obtain x₁ correctly. If $\mathcal{A}$ does not guess the correct password, then $\mathcal{A}$ will not succeed. On the other hand, if gcd (e, ϕ(n)) ≠ 1, since we require that e is an 80-bit prime, then the congruence $y_2=x_2^e$ mod n has e solutions. In order to recover the correct x₁, the adversary needs to find out the correct x₂. As is shown in Section 3, the probability to find out the correct x₂ is 1/2⁸⁰, which is negligible.

Hence, the adversary's success probability in Case 2 is bounded by

$$Pr\left[Succ\right]\le \frac{Q_{sen{d}_1}}{\left|\mathcal{D}\right|}+\frac{Q_{sen{d}_1}}{2^k}+\frac{Q_{sen{d}_1}}{2^{80}}.$$

From the above analysis, it can be concluded that the adversary's success probability in experiment P₄ is upper bounded by

$$\begin{array}{ll}\hfill Pr\left[Succ\right]& \le \frac{Q_{send}}{\left|\mathcal{D}\right|}+Q_{sen{d}_2}Ad{v}^{rsa}\left(O\left(t\right)\right)+\frac{Q_{sen{d}_2}{Q}_{oh}}{\varphi \left(n\right)}+\frac{Q_{send}}{2^k}+\frac{Q_{sen{d}_1}}{2^{80}}\\ \le \frac{Q_{send}}{\left|\mathcal{D}\right|}+Q_{send}Ad{v}^{rsa}\left(O\left(t\right)\right)+\frac{Q_{sen{d}_2}{Q}_{oh}}{\varphi \left(n\right)}+\frac{Q_{send}}{2^k}+\frac{Q_{send}}{2^{80}}.\end{array}$$

Since Q _send ≤ |D|, we have $\frac{Q_{send}}{\left|\mathcal{D}\right|}\le 1$. Therefore,

$$\begin{array}{ll}\hfill Adv\left(\mathcal{A},P_4\right)& =2Pr\left[Succ\right]-1\\ \le \frac{2Q_{send}}{\left|\mathcal{D}\right|}+2Q_{send}Ad{v}^{rsa}\left(O\left(t\right)\right)+\frac{2Q_{send}{Q}_{oh}}{\varphi \left(n\right)}+\frac{Q_{send}}{2^{k-1}}+\frac{Q_{send}}{2^{79}}.\end{array}$$

This completes the proof of Lemma A.5.

By combining Lemma A.1 to Lemma A.5, we get the announced result.

Appendix B. Proof of Theorem 3.3

Consider a malicious gateway $\mathcal{A}$ generates a message (C, n, e, n', e', r₁). The malicious gateway sends the message to the server. The server replies (r₂, z) according to the protocol description. To succeed in this case, the malicious gateway must send back a number μ which is equal to the output of the random oracle H₁ on (x₁, C, G, n, e, n', e', r₁, r₂, y₂, z, c₁). Otherwise, the on-line impersonation attack will be detected by the authentication server. Without the knowledge of x₁, the probability for $\mathcal{A}$ to generate μ is just 2^-k.

Let $p_{x_1}$ denote the probability that the malicious gateway can recover the integer x₁.

Note that (n, e) was generated by $\mathcal{A}$. If gcd (e, ϕ(n)) = 1, then $\mathcal{A}$ can compute w = H (pw', x₂, C, G, n, e, n', e', r₁, r₂, y₂) using a guessing password pw'. Then, congruence $z=x_1^e\cdot w$ mod n has a unique solution because gcd (e, ϕ(n)) = 1. If $\mathcal{A}$ guesses the correct password pw = pw', then $\mathcal{A}$ can obtain x₁ correctly. If $\mathcal{A}$ does not guess the correct password, then $\mathcal{A}$ will not succeed. On the other hand, if gcd (e, ϕ(n)) ≠ 1, since we require that e is an 80-bit prime, then the congruence $y_2=x_2^e$ mod n has e solutions. In order to recover the correct x₁, the adversary needs to find out the correct x₂. As is shown in Section 3, the probability to find out the correct x₂ is 1/2⁸⁰, which is negligible.

Hence, the adversary's success probability in violating the resistance to undetectable on-line dictionary attacks is bounded by

$$Ad{v}_{\mathcal{P},\mathcal{D}}^{ake-uoda}\left(\mathcal{A}\right)\le \frac{Q_{send}}{\left|\mathcal{D}\right|}+\frac{Q_{send}}{2^k}+\frac{Q_{send}}{2^{80}}.$$