The Secure Remote Password Proto col
Thomas Wu
Computer Science Department
Stanford University
tjw@cs.Stanford.EDU
November 11, 1997
Abstract
This pap er presents a new password authentication and key-exchange protocol suitable for
authenticating users and exchanging keys over an untrusted network. The new proto col resists
dictionary attacks mounted by either passive or active network intruders, allowing, in principle,
even weak passphrases to be used safely. It also oers p erfect
forward secrecy
, which protects
past sessions and passwords against future compromises. Finally, user passwords are stored in
a form that is not
plaintext-equivalent
to the password itself, so an attacker who captures the
password database cannot use it directly to compromise security and gain immediate access to
the host. This new protocol combines techniques of zero-knowledge pro ofs with asymmetric
key exchange proto cols and oers signicantly improved performance over comparably strong
extended methods that resist stolen-verier attacks such as Augmented EKE or B-SPEKE.
1 Intro duction
Password authentication protocols come in manyavors, but they all solve the same problem: One party
must somehow prove to another party that it knows some password
P
, usually set in advance. Such protocols
range from the trivial to the incredibly complex, and many of them oer some form of protection from various
attacks mounted by malicious or excessively curious third parties.
All methods of human authentication fall into three broad categories:
Something the user
is
(voiceprint identication, retinal scanners)
Something the user
has
(ID cards, smartcards)
Something the user
knows
(passwords, PINs)
This pap er deals with a particularly imp ortant subset of the last category known as
direct
password
authentication. Mechanisms that fall into this rather exclusive category cannot rely on persistent stored
information on the client side. The user's password, which is a memorized quantity, is the only secret
available to client software. It is also assumed that the network between the client and server is vulnerable
to b oth eavesdropping and delib erate tamp ering by the enemy. In addition, no trusted third party suchasa
key server or arbitrator can be used; only the original two parties can engage in the authentication protocol.
Such proto cols have a surprisingly wide range of practical applications b ecause they do not require any-
thing more than a memorized password, making them much easier to use and less exp ensive to deploy than
either biometric or token-based metho ds. One obvious application is handling remote, password-protected
1998 Internet Society Symp osium on Network and Distributed System Security
1
剩余16页未读，继续阅读
资源评论
