Enhanced password-based simple three-party key exchange protocol

Hyun Seok Kim, Jin Young Choi

Research output: Contribution to journalArticlepeer-review

53 Citations (Scopus)


Recently, Lu and Cao proposed a simple three-party password-based key exchange (STPKE) protocol based on the CCDH assumption. They claimed that their protocol is secure, efficient, and practical. In this paper, unlike their claims, we find that the STPKE protocol is still vulnerable to undetectable on-line password guessing attacks by using formal description, BPR model. These weakness is due to the fact that the messages of the communicants are not appropriately encrypted into the exchanged cryptographic messages. To enhance the security of the STPKE protocol, we suggest a countermeasure to resist our described attacks while the merits of the original protocol are left unchanged.

Original languageEnglish
Pages (from-to)107-114
Number of pages8
JournalComputers and Electrical Engineering
Issue number1
Publication statusPublished - 2009 Jan


  • BPR model
  • Password-based key exchange protocol
  • Undetectable on-line guessing attack

ASJC Scopus subject areas

  • Control and Systems Engineering
  • General Computer Science
  • Electrical and Electronic Engineering

Cite this