SPECIAL SECTION ON TRUSTED COMPUTING

Received October 24, 2017, accepted November 17, 2017, date of publication November 21, 2017,
date of current version December 22, 2017.
Digital Object Identifier 10.1109/ACCESS.2017.2776160

Provably Leakage-Resilient Password-Based

Authenticated Key Exchange in
the Standard Model
OU RUAN 1, JING CHEN2 , AND MINGWU ZHANG1
1 School of Computer Science, Hubei University of Technology, Wuhan 430068, China
2 School of Computer Science, Wuhan University, Wuhan 430072, China

Corresponding author: Ou Ruan ([email protected])

This work was supported in part by the Educational Commission of Hubei Province of China under Grant D20151401, in part by the
Natural Science Foundation of Hubei Province of China under Grant 2017CFB596, and in part by the Green Industry Technology Leading
Project of Hubei University of Technology under Grant ZZTS2017006.

ABSTRACT The password-based authenticated key exchange (PAKE) protocol is one of most practical
cryptographic primitives for trusted computing, which is used to securely authenticate devices’ identities and
generate shared session keys among devices in insecure environments by using a short, human-memorable
password. With the fast development of the Internet of Things (IoT), new challenges regarding PAKE have
emerged. The traditional PAKE protocols are completely insecure in IoT environments, since there are many
kinds of side-channel attacks. Therefore, it is very important to model and design leakage-resilient (LR)
PAKE protocols. However, there has been no prior work on modeling and constructing LR PAKE protocols.
In this paper, we first formalize an LR eCK security model for PAKE based on the eCK-secure PAKE
model and the only computation leakage model. Then, we propose the first LR PAKE protocol by using
Diffie–Hellman key exchange, LR storage (LRS) and LR refreshing of LRS appropriately and formally
present a security proof in the standard model.

INDEX TERMS Leakage-resilience, password-based authenticated key exchange, side-channel attacks,

trusted computing, internet of things.

I. INTRODUCTION authentication and session key generation for IoT devices.

Trusted computing (TC) is a very important technology, For example, Hsu et al. [3] designed an AKE protocol
which aims to enhance the overall security, privacy and for wearable devices in IoT environments. Among AKEs,
trustworthiness of a variety of computing devices. Trustwor- the password-based AKE (PAKE) protocols are most widely
thy software assurance, trusted execution environment and used since no additional device is required, just a human-
trusted collaboration are hot research fields of TC. Estab- memorable password for authenticating the parties. The con-
lishing and protecting device identity by trustworthy soft- cept of PAKE was introduced by Bellovin and Merritt [4].
ware assurance make up one of the fundamental security The first provably secure PAKE protocols were proposed by
requirements of TC. Authenticated key exchange (AKE) pro- Bellare et al. [5] and MacKenzie et al. [6]; they formally
tocols [1] provide a good solution for identity authentica- proved the security in the random oracle (RO) model. Then,
tion, which can securely authenticate device identity and Byun et al. [7] and Mohammad and Mahmoud [8] improved
generate a shared session key among devices in an insecure and generalized the constructions of PAKE in the RO model.
environment. With the fast development of the Internet of In 2006, the first provably secure PAKE protocol in the
Things (IoT), new challenges regarding TC have emerged. standard model was shown by Goldreich and Lindell [9], and
There are many IoT devices that vary widely in their cost, then [10]–[13] showed efficient constructions for PAKE pro-
usage, and capabilities. For the trusted execution environ- tocols in the standard model. In 2012, Wen et al. [14] intro-
ment, IoT devices should have the ability to perform mutual duced a three-party password-authenticated multiple key
authentication with IoT services or with other IoT devices [2]. exchange protocol. Subsequently, Tsai et al. [15] made some
AKE is one of main technologies for performing mutual improvements to [14]. However, Luo et al. [16] demonstrated

2169-3536
2017 IEEE. Translations and content mining are permitted for academic research only.
26832 Personal use is also permitted, but republication/redistribution requires IEEE permission. VOLUME 5, 2017
See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
O. Ruan et al.: Provably LR PAKE in the Standard Model

off-line password guessing attacks against both protocols. formally showed the security proof under the Gap Diffie-
Recently, Ruan et al. [17] designed an explicit PAKE protocol Hellman (GDH) assumption in the RO model.
with mutual key confirmation and gave a formal security In this paper, we formalize the LR eCK security model
proof; Yi [18] et al. presented a two-server PAKE proto- for PAKE and propose an LR PAKE protocol that is based
col, in which two servers know only partial information on the key derivation function (KDF) [35], leakage-resilient
about the client’s password, but can cooperate to authenti- storage (LRS) [36] and leakage-resilient refreshing of LRS.
cate the client’s identity; Islam [19], Amin and Biswas [20] Then, we give the detailed formal security proof. The main
and Lu [21] designed three-party/multi-party PAKE pro- contributions are as follows:
tocols with formal security proofs; Nam et al. [22] and • First, we first formalize an LR eCK security model
Guo et al. [23] proposed provably secure group PAKE for PAKE by combining the eCK security PAKE
protocols. model and the only computation leakage (OCL) model
Computations or communications of IoT devices emit appropriately.
signals known as ‘‘side channels’’, such as electromagnetic • Second, we propose the first LR PAKE protocol by using
emissions and power consumption. Most IoT devices are Diffie-Hellman key exchange and the Dziembowski-
exposed to the public outside, and an attacker can overcome Faust (DF) LRS (DF-LRS) scheme [37] properly.
the security protections by measuring these signals, which Our protocol is more efficient than other LR AKE
are called side-channel attacks [24]. Traditional PAKEs are protocols.
completely insecure in leakage environments. Moreover, the • Third, based on game simulation techniques, we show
technologies of side channel attacks are developing, and a formal security proof in the standard model under
new attack methods may appear at any moment. Thus, it is a stronger security model, namely, the λ-CAFLR eCK
impossible to consider all types of side-channel attacks in security model, in which the leakages are continuous and
the hardware design of IoT devices. Furthermore, we know are allowed after the adversary selects the test session.
that current TC technologies focus on establishing trust, but In the model, the total leakage size may be infinitely
how to maintain trust in dynamically changing environments large, and for each protocol instance, the amount of
has not been deeply studied. Thus, to resist side-channel leakage is bounded by λ.
attacks and provide trustworthy software assurance, it is very The remainder of this paper is organized as follows.
important to model and design leakage-resilient (LR) AKE In Section 2, we review the primitives that are used.
protocols. In Section 3, we describe the CAFLR eCK security model
The first LR security model for AKEs was introduced by of PAKE. In Section 4, we present the proposed protocol
Moriyama and Okamoto [25] and is called the MO model. and analyse the provable security, performance comparison
The MO model was based on the eCK security model [26], and leakage tolerance. Finally, in Section 5, we conclude the
which is an extension of the CK security model [27]. The paper.
adversary of the eCK security model has more power than the Compared with the conference version [38], there are
CK model and can access both the long-term secret key and four significant improvements in this paper. First, we for-
the ephemeral secret randomness of the test session. The cen- mally give the detailed security proof in the standard model.
tral limitation of the MO model is that the leakages are only Second, we analyse the leakage tolerance of our pro-
allowed until the adversary learns the challenge. Leakage that posed protocol. Third, we complement the LR eCK secu-
occurs after the adversary learns the challenge is called after- rity model for PAKE with a graphical framework of the
the-fact (AF) leakage. The first AFLR CK security model security game. Finally, we present the primitives that are
and the first continuous AFLR (CAFLR) AKE protocol were used and analyse why they are needed and how they are
introduced by Alawatugoda et al. [28]. Then, the first AFLR used.
eCK security model and the first bounded AFLR (BAFLR)
AKE protocol were proposed by Alawatugoda et al. [29], and II. PRELIMINARIES
the first CAFLR eCK-secure AKE protocol was introduced In this section, we address the primitives that are used, such
by Alawatugoda et al. [30]. In 2016, Chen et al. [31] first as the DDH assumption, KDF, LRS and leakage-resilient
considered leakage attacks on both the long-term secret pri- refreshing of LRS.
$
vate key and the ephemeral secret randomness, and proposed Notation: Let s ←− S denote that s is a uniform value that
a one-round AFLR AKE protocol under this strong security is selected from a finite set Sat random and let κ and λ denote
model. In 2017, the first ID-based BAFLR AKE protocol was the system security parameter and the leakage parameter,
introduced by Ruan et al. [32]. Recently, Toorani [33] demon- respectively.
strated an ephemeral key compromise impersonation (KCI) Definition 1 (Negligible Function): A negligible function
attack on the construction of [28]; Yang and Li [34] also ε(κ) is a function N → R such that for each positive integer
showed that the construction of [29] was insecure against KCI c ≥ 0, there exists an integer kc such that ε(κ) < k −c for all
attacks and the proofs of Case 2 (the adversary is active) were k ≥ kc .
incorrectly reduced to the Decision Diffie-Hellman (DDH) Definition 2 (DDH Assumption): We define a distinguish-
assumption, and then they improved the construction and ing game as follows:

VOLUME 5, 2017 26833

 O. Ruan et al.: Provably LR PAKE in the Standard Model

(1) A challenger C generates a cyclic multiplicative group I. Correctness of the leakage-resilient refreshing.
G with a large prime order p, picks a generator g at $
For every s ←− M ,
random, and then sends (G, g) to an adversary A.
$ Decode(s0L × s0R ) = Decode(sL × sR ).
(2) C picks a bit b ←− (0, 1) and three elements
$
x, y, z ←− Zp∗ at random. If b = 0, C sends II. (λRefresh , λ)-security of the leakage-resilient refreshing.
(gx , gy , gxy ) to A; otherwise, A is given (gx , gy , gz ). We define a distinguishing game as follows:
0
(3) A outputs his guessed bit b0 . A wins if b = b. $
(1) A chooses two random messages (s0 , s1 ) ←− M and
DDH assumption is satisfied if sends (s0 , s1 ) to C.
$
AdvDDH (A) = | Pr[b0 = b] − 1/2| = ε(κ), (2) C picks a bit b ←− (0, 1) at random and calculates

where AdvDDH (A) denotes the advantage of A in the distin- Encode(sb ) = sLb × sRb .
guishing game and ε(κ) is a negligible function. (3) For i = 1, · · · , t, C runs the ith round refresh-
Definition 3 (λ-Leakage-Resilient Storage): An λ-LRS ing protocol, Refresh(si−1 i−1 i i
bL × sbR ) = sbL × sbR ,
consists of a pair of algorithms (Encode, Decode) and a th
A selects the i round leakage functions fRefresh-i =
bounded leakage parameter λ = (λ1 , λ2 ). L
(fRefresh-i , fRefresh-i
R ) and sends it to C, and C returns
Encode: Encode(s) = sL ×sR is a randomized and efficient
the leakages (fRefresh-i (sibL ), fRefresh-i
L R (sibR )) to A, where
probabilistic polynomial time (PPT) algorithm, where s is an
element that is chosen from the message space M and sL × sR fRefresh-i (sbL ) ≤ λRefresh1 ∧ fRefresh-i (sibR ) ≤ λRefresh2
L i R

is the encoded output element in the encoding space L × R. should hold.

0
Decode: Decode(sL × sR ) = s is a deterministic and (4) A outputs his guessed bit b0 . A wins if b = b.
efficient PPT algorithm. An (λRefresh , λ) leakage-resilient refreshing is secure if the
An λ-LRS should satisfy the following two properties: following holds:
$
I. Correctness of the LRS. For every s ←− M, AdvRefresh−LRS (A) = ε(κ),
Decode(Encode(s)) = s.
where AdvRefresh−LRS (A) denotes the advantage of A in dis-
II. Security of the LRS.
tinguishing the above security game and ε(κ) is a negligible
We define a distinguishing game as follows: function.
$
(1) A chooses two random messages (s0 , s1 ) ←− M and Definition 5 (DF-LRS Scheme): The DF-LRS Scheme [37]
sends (s0 , s1 ) to C. is an LRS that efficiently stores a secret value s ∈ (Zp∗ )m with
$
(2) C picks a bit b ←− (0, 1) at random and calculates any m ∈ N , where p is a large prime. We denote it as 8Zn,m ∗ .
p
$
Encode(sb ) = sLb × sRb . Encode: Pick sL ←− (Zp∗ )n \{(0n )} at random, compute
sR ∈ (Zp∗ )n×m such that sL × sR = s, where n ∈ N , and then
(3) For i = 1, · · · , t, A selects leakage functions f = output (sL , sR ).
(fiL , fiR ) and sends it to C and C returns the leak- Decode: Output s such that s = sL × sR .
ages (fiL (sLb ), fiR (sRb )) back to A. The total leakage size Lemma 6 [37]: The scheme that is defined in Defini-
t
should be bounded by (λ1 , λ2 ), i.e.,
P
fiL (sLb ) ≤ λ1 ∧ tion 5 is an λ-secure LRS scheme if 20m < n, where
i=1 λ = (0.3nlog p, 0.3nlog p).
t Lemma 7 [37]: If 8n,m Zp∗ is an λ-secure DF-LRS scheme
fiR (sRb ) ≤ λ2 .
P
i=1 and m/3 ≤ n ∧ n ≥ 16, there is an (λ/2, λ)-secure leakage-
resilient refreshing Refreshn,m n,m
0
(4) A outputs his guessed bit b0 . A wins if b = b. Zp∗ for 8Zp∗ .
The λ-LRS is secure if the following holds: Definition 8 (Key Derivation Function): A KDF is a
function key ← KDF(σ, `, r, c) that can generate a cryp-
AdvLRS (A) = ε(κ), tographically strong secret key efficiently, where σ is the
where AdvLRS (A) represents the advantage of A in the source material of the secret key and ` denotes some public
distinguishing security game and ε(κ) is a negligible knowledge about σ such as its length, r represents a salt value
function. and c denotes a context variable.
Definition 4 ((λRefresh , λ)-Leakage-Resilient Refreshing of Definition 9 (Security of KDF): We define a distinguishing
the LRS): A leakage-resilient refreshing is a PPT algorithm game as follows:
Refresh with an λ-LRS (Encode,Decode), a secret s and a (1) C picks (σ, `) and a salt value r at random, and then
bounded leakage amount λRefresh = (λRefresh1 , λRefresh2 ). gives (`, r) to A.
Refresh: Refresh(sL × sR ) = s0L × s0R where sL × sR is the (2) A chooses a value c at random, and then gives it to C.
$
encoding value of the secret s. (3) C selects a random bit b ←− (0, 1). If b = 0, C
A leakage-resilient refreshing of an λ-LRS should satisfy calculates key ← KDF(σ, `, r, c) and gives it to A;
the following two properties: otherwise, C picks a string s at random and gives it to

26834 VOLUME 5, 2017

O. Ruan et al.: Provably LR PAKE in the Standard Model

A, where the length of s is the same as the length of specifications and f . A can use this query to run a proto-
key ← KDF(σ, `, r, c). col or activate a new protocol instance as an initiator with
0
(4) A outputs his guessed bit b0 . A wins if b = b. blank m and f .
A KDF is secure if the following holds: RevealSessionKey(U, V, s) query: this query models A’s
capability to learn the sth session key. The adversary A sends
AdvKDF (A) = ε(κ), this query to the oracle 5sU ,V in the sth session. Then, A gets
where AdvKDF (A) denotes the advantage of A in the distin- back the sth session key from 5sU ,V .
guishing security game and ε(κ) is a negligible function. RevealEphemeralKey(U, V, s) query: this query models
A’s capability to learn ephemeral keys of the sth session. The
III. THE λ-CAFLR eCK SECURITY MODEL FOR PAKE adversary A sends this query to the oracle 5sU ,V in the sth
Based on the eCK security PAKE model and the OCL model, session. Then, A gets back the sth ephemeral keys of 5sU ,V .
we define the λ-CAFLR eCK security model for PAKE in RevealPassword() query: this query models A’s capability
this section, where leakage attacks are modelled as leakage to learn the principals’ shared password. The adversary A
functions that are defined in Send queries. A can learn the sends this query to any oracle in any session. Then, A gets
leakages of the long-term secret password by asking Send back the long-term shared secret password pw.
queries with leakage functions that are chosen by him. The Test(U , s) query: this query is different from all of the
new model has three main properties: First, we suppose that above queries, as it is only used to specify the security
only the calculations will lead to leakages of the long-term definition of our model. Upon receiving this query from the
$
shared secret password pw. Second, in each instance of the adversary A, the challenger C chooses a bit b ←− (0, 1) at
protocol, the total leakage size of the secret password is random. If b = 1, then C sends the actual session key to A,
limited to λ. A can perform leakage attacks by asking Send while a random string is given to A. A can issue this query
queries with the leakage functions f = (f1 , . . . , fn ), which only once across all sessions.
are chosen adaptively by him, and get back the leakages of
pw. However, we require that the total leakage amount is B. λ-CAFLR eCK SECURITY MODEL
n In our security model, the total leakage size of the secret pass-
limited to λ for each instance, i.e., |fi (pw)| ≤ λ. Third,
P
i=1
word for each instance is bounded by the leakage parameter
n
A can continuously carry out the leakage attacks instance λ, i.e.,
P
|fi (pw)| ≤ λ.
by instance and learn an infinitely large amount of leakage i=1
information about the secret password. Definition 10 (Partner in λ-CAFLR eCK Security Model):
0
Two oracles 5sU ,V and 5sU 0 ,V 0 are partners if they have the
A. ADVERSARIAL POWERS following properties:
In our model, two parties, who are denoted as U and V , run 0
(1) 5sU ,V and 5sU 0 ,V 0 have received the same session keys;
the PAKE protocol together to obtain a secure shared key. We (2) The messages that are sent from 5sU ,V are the same as
define the following notations. 0
the messages that are received by 5sU 0 ,V 0 ;
Session is used to represent a protocol instance. 0
Principal is used to denote a party of a session. A principal (3) The messages that are sent from 5sU 0 ,V 0 are the same as
may be involved in multiple different sessions that may be the messages that are received by 5sU ,V ;
executed concurrently. (4) U = V 0 and V = U 0 ;
Oracle(5sU ,V ) is used to represent the sth session with (5) There are an initiator and a responder of two principals
principals U and V , of which U is the owner principal and U and V .
V is the intended partner principal. Definition 11 (λ-C AFLR-eCK-Freshness): Assume f =
Initiator is used to represent the principal who activates a (f1 , . . . , fn ) denotes n PPT leakage functions for a certain
session. protocol instance that is chosen by the adversary A arbitrarily.
Responder is used to represent the principal who responds An oracle 5sU ,V is λ-CAFLR-eCK-fresh if the followings
to the initiator. hold:
In our model, the adversary A is active, adaptive and (1) RevealSessionKey queries have not been asked by the
0
malicious, interacts with any oracles and performs attacks. oracle 5sU ,V or its partner, 5sV ,U (if it exists).
We model the adversarial capabilities by the following 0

queries. (2) If the partner 5sV ,U exists, neither of the following

Send(U, V, s, m, f ) query: this query models A’s abilities combinations has been queried:
to execute the protocol and carry out the leakage attacks. The (a) RevealPassword() and RevealEphemeralKey(U,
adversary A sends a Send(U, V, s, m, f ) query to the oracle V, s);
5sU ,V in the sth session, where m is a protocol message and (b) RevealPassword() and RevealEphemeralKey(V,
0
f is a leakage function. Then, A gets back a normal protocol U,s ).
0
message and the leakage f (pw) of the long-term password, (3) If the partner 5sV ,U does not exist, A cannot ask the
which are produced by the oracle 5sU ,V based on the protocol RevealPassword() query.

VOLUME 5, 2017 26835

 O. Ruan et al.: Provably LR PAKE in the Standard Model

n
|fi (pw)| ≤ λ. protocols, on-line dictionary attacks are unavoidable, and
P
(4) For all Send(., U , ., ., fi ) queries,
i=1 NS /N represents the success probability of on-line dictio-
n
(5) For all Send(., V , ., ., fi ) queries,
P
|fi (pw)| ≤ λ. nary attacks. However, this attacks can be limited by some
i=1 kind of strategy, for example, by disallowing further attempts
after a certain number of failed attempts to the correct
C. SECURITY DEFINITION
password.
This section formalizes the security definition of the
λ-CAFLR eCK model.
IV. A NEW λ-CAFLR ECK-SECURE PAKE PROTOCOL
In this section, we formally present our λ-CAFLR
eCK-secure PAKE protocol and its detailed security proof
in the standard model.

A. THE PROPOSED PROTOCOL

1) OVERVIEW OF THE PROPOSED PROTOCOL
There are three main stages:
• Initially, we map the password pw to a random element
s of a group G using a one-way collision-free hash
function H, and then encode s using an LRS scheme.
This approach can resist leakage attacks on the shared
secret password. However, determining how to use the
encodings of the shared password to achieve authenti-
cation and obtain a secure session key becomes a big
challenge.
• Then, we use the encodings of the shared password

FIGURE 1. The Security Game of λ-CAFLR eCK-Secure PAKE.

to achieve authentication and obtain a secure session
key by combining Diffie-Hellman key exchange and
Definition 12 (λ -CAFLR eCK Security Game): The λ - the DF-LRS scheme appropriately. This method gives
CAFLR eCK security game is shown in Fig. 1, which is run a good solution to the above challenge. The important
by the protocol challenger C with a PPT adversary A: observations are as follows: (1) Two primitives can share
(1) A asks any of the Send, RevealSessionKey, RevealE- a common group G with a big prime order p; (2) In the
phemeralKey and RevealPassword queries to any DF-LRS scheme, (gsL )sR = gsL ·sR = gs since s = sL ·sR ,
oracle. where g is a generator of G, s denotes the secret mapping
(2) A chooses an λ-CAFLR-eCK-fresh oracle and asks element, and (sL , sR ) represents two encodings of the
a Test query. Upon receiving a Test query, C selects DF-LRS scheme.
$
a random bit b ←− (0, 1). If b = 1, then sends • Finally, since there is an efficient leakage-resilient
the actual session key to A, while a random string is refreshing protocol for the DF-LRS scheme, we can
given to A. refresh two encodings of s after using them in the end
(3) A continues asking Send, RevealSessionKey, RevealE- of the protocol. Thus, our construction is secure against
phemeralKey and RevealPassword queries. All these continuous leakage attacks.
queries should satisfy the λ-CAFLR-eCK-freshness of
the chosen oracle. 2) DETAILS OF THE PROPOSED PROTOCOL
0
(4) At last, A outputs his guessed bit b0 . A wins if b = b. Fig. 2 illustrates the proposed protocol, which includes the
Definition 13 (λ-CAFLR eCK Security): Let following two stages.
Advλ−CAFLReCK
PAKE be the advantage of A in the λ-CAFLR eCK
security game that is defined in Definition 12. λ-CAFLR eCK a: THE INITIAL SETUP STAGE
security means that Users U and V first map the shared secret password to a
Advλ−CAFLReCK = | Pr[b0 = b] − 1/2| = NS /N + ε(κ), random element of the group G, sUV = H (pwUV ). We assume
PAKE that this computation is executed in secret and leakage attacks
where NS is the number of sessions, N denotes the size are not allowed. Then, U runs an λ-secure DF-LRS scheme
of the password dictionary, and ε(κ) represents a negligible 8n,1 0 $ ∗ n n
Z ∗ , picks aL ←− (Zp ) \{(0 )} at random and generates
p
function.
a0R ∈ (Zp∗ )n×1 such that a0L · a0R = sUV ; V also chooses
In other words, a PAKE protocol is λ-CAFLR eCK-secure $
if there is no PPT adversary who can win the above secu- b0L ←− (Zp∗ )n \{(0n )} at random and computes b0R ∈ (Zp∗ )n×1
rity game with an advantage of more than NS /N . In PAKE such that b0L · b0R = sUV .

26836 VOLUME 5, 2017

O. Ruan et al.: Provably LR PAKE in the Standard Model

b: THE PROTOCOL EXECUTION STAGE

j
Step 1. User U calculates YU = gxU and TU 1 = (YU )aL ,
$
where xU ←− Zp∗ is a random number, and then sends
(U , TU 1 ) to user V.
Step 2. Upon receiving (U, TU 1 ), V calculates YV =
j $
gxV , TU 2 = (TU 1 )xV and TV 1 = (YV )bL , where xV ←− Zp∗ is
a random number, and then sends (V, TU 2 , TV 1 ) to U.
Step 3. Upon receiving (V, TU 2 , TV 1 ), U calculates TV 2 =
j
(TV 1 )xU and sends it to V. Finally, U calculates TU = (TU 2 )aR
and kUV = KDF(U, V , TU ), and refreshes the stored pieces
with
j+1 j+1 j j
(aL , aR ) ← Refreshn,1 Z ∗ (aL , aR ).
p

Step 4. Upon receiving (U, TV2 ), V calculates TV =

j
(TV 2 )bR and kUV = KDF(U, V , TV ), and refreshes the stored
pieces with
j+1 j+1 j j
(bL , bR ) ← Refreshn,1
Zp∗ (bL , bR ).
Correctness of the proposed protocol.
From
j j xV j FIGURE 2. The λ-CAFLR eCK-Secure PAKE Protocol.
TU = (TU 2 )aR = (((gxU )aL ) )aR
j j
j j aL ·aR and AdvRefresh−LRS be advantages of A against the security of
= (((gxU )xV )aL )aR = ((gxU )xV ) the DDH assumption, KDF and leakage-resilient refreshing
j j
= ((gxU )xV )sUV = (((gxU )xV )bL )bR of LRS, respectively. Then
j j
= (((gxV )bL )xU )bR λ−CAFLReCK
AdvPAKE ≤ NS /N + NP2 NS2 (AdvDDH
j j
bL xU bR
= (((YV ) ) ) + AdvRefresh−LRS + AdvKDF ),
j
bR
= (TV 2 ) = TV where NP is the number of protocol principals, NS denotes
the number of sessions on a principal, and N represents the
size of the password dictionary.
it follows that Proof: The proof can be divided into the following two
⇒ KDF(U, V , TU ) = KDF(U, V , TV ). main cases.
Case 1 (A Partner Session to the Test Session Exists):
Therefore, the proposed protocol is correct. In this case, the adversary A may obtain the principals’
long-term shared secret password pwUV by the RevealPass-
B. MUTUAL AUTHENTICATION word query. Let Advλ−CAFLReCK
PAKE be the advantage of A in the
In our protocol, we can add mutual authentication con- λ-CAFLR eCK security game. We split this case into two sub-
veniently. To do this, we can introduce an authenticator cases as follows:
structure KDF(U, V , kUV ), where kUV = KDF(U , V , TV ). (1) A asks a RevealPassword query. In this case, A can
At the end of the protocol, users U and V each calculate learn the principals’ long-term shared secret password. To not
the authenticator Auth = KDF(U, V , kUV ) and send Auth violate the λ-CAFLR-eCK-freshness of the chosen session,
to the other user. Then, each user can identify the other’s A cannot ask RevealEphemeralKey query to learn random
identity by checking whether the received authenticator Auth ephemeral keys of the owner or partner principals to the
is equal to KDF(U, V , kUV ). When we give our security chosen session.
proof, we will not consider the security of mutual authentica- (2) A doesn’t ask a RevealPassword query. In this case, A
tion because this authenticator transformation preserves the cannot obtain the long-term shared secret password, but can
indistinguishability security of the original protocol. learn random ephemeral keys of the owner and his partner to
the chosen session.
C. SECURITY PROOF Case 1.1 (A Asks a RevealPassword Query):
Our CAFLR PAKE protocol is eCK-secure if the DDH prob- In this case, the adversary A can obtain the principals’ long-
lem is hard and the leakage-resilient refreshing of LRS and term shared secret password pwUV by the RevealPassword
KDF is secure. query and learn sUV = H (pwUV ). Thus, leakage attacks do
Theorem 14: Let Advλ−CAFLReCK
PAKE represent the advan- not need to be considered. To not violate the λ-CAFLR-eCK-
tage of a PPT adversary A against the λ -CAFLR eCK- freshness of the chosen session, A cannot obtain any of the
security of the proposed protocol, and let AdvDDH , AdvKDF principals’ ephemeral keys to the chosen session.

VOLUME 5, 2017 26837

 O. Ruan et al.: Provably LR PAKE in the Standard Model

Game 1: This game is the original λ-CAFLR eCK security outputs a bit b to distinguish between Game 3 and Game 4:
game that is defined in Definition 12. b = 1 if Game 3 is running; otherwise, b = 0. We design
Game 2: Game 2 has the following differences from an algorithm B against the KDF distinguishing game, which
Game 1: First, the adversaryA picks two random distinct prin- uses A as a subroutine and runs as follows: (1) Upon
$
cipals U ∗ , V ∗ ←− {U1 , . . . , UNp } and two random numbers receiving a message kU ∗ V ∗ = KDF(UU ∗ , UV ∗ , (gsU ∗ V ∗ )z )
$
$
s∗ , t ∗ ←− {1, . . . , Ns }, where NP denotes the number of or kU ∗ V ∗ ←− {0, 1}k from the KDF challenger, B trans-
principals and NS represents the number of sessions on a fers it to A’s challenger, who uses it to generate the
principal. Second, A activates the security game and chooses answer message to A’s challenge. If the received message
∗ ∗
5sU ∗ ,V ∗ as the target oracle and 5tV ∗ ,U ∗ as the partner oracle. is KDF(UU ∗ , UV ∗ , (gsU ∗ V ∗ )z ), the simulation is the same as
∗ Game 3; otherwise, it’s the same as Game 4. (2) B outputs
If the test oracle is not 5sU ∗ ,V ∗ or the partner oracle is not
∗ the bit that A outputs.
5tV ∗ ,U ∗ , the Game 2 challenger stops and exits the game. If A can distinguish between Game 3 and Game 4, B wins
Game 3: Game 3 has the following differences from the KDF distinguishing game. Therefore,
$
Game 2: The Game 3 challenger C picks z ←− Zp∗
at random and calculates sU∗V ∗ = H (pwU ∗ V ∗ ) and |AdvGame 3 (A) − AdvGame 4 (A)| ≤ AdvKDF (IV)
kU ∗ V ∗ = KDF(UU ∗ , UV ∗ , (gsU ∗ V ∗ )z ). After receiving a Game 4: A has no advantage in Game 4 because the session
Test(U ∗ , V ∗ , s∗ ) query from A, C gives kU ∗ V ∗ to A. In addi- ∗
key kU ∗ V ∗ of 5sU ∗ ,V ∗ is picked at random and doesn’t depend
tion, after receiving a Test(V ∗ , U ∗ , t ∗ ) query, C sends the on any other values. Therefore,
∗
same kU ∗ V ∗ to A, since there is a partner session 5tV ∗ ,U ∗ .
Game 4: Game 4 has the following differences from AdvGame4 (A) = 0 (V)
Game 3: The Game 4 challenger C selects a random value Using equations (I)-(V), we obtain
$
kU ∗ V ∗ ←− {0, 1}k . Then, after receiving a Test(U ∗ , V ∗ , s∗ ) λ−CAFLReCK
query or Test(V ∗ , U ∗ , t ∗ ) query from A, C gives kU ∗ V ∗ to A. AdvPAKE ≤ NP2 NS2 (AdvDDH + AdvKDF ).
Differences Between Games: We analyse the indistin- Case 1.2 (A Does Not Ask a RevealPassword Query):
guishability of each game t from its previous game t-1. Let For simplicity, we assume that the test oracle is an initiator.
AdvGamet (A) be the advantage of A in Game t. Game 1: Same as Game 1 in Case 1.1.
Game 1: Game 2: Same as Game 2 in Case 1.1.
Game 3: Game 3 has the following differences from
AdvGame1 (A) = Advλ−CAFLReCK
PAKE (I) $
Game 2: Game 3 challenger C picks s ←− Zp∗ at random,
Game 1 and Game 2: Game 1 and Game 2 are the same if the encodes (sL , sR ) = Encode(s), continues refreshing the two
target oracle and the partner oracle are chosen byA correctly. encodings, and then uses the refreshed encodings of s to
The probability of A choosing a correct test oracle and its simulate the answers to A’s leakage query function fRefresh =
correct partner is 1/NP2 NS2 . Therefore, L
(fRefresh , fRefresh
R ) of the principal U ∗ .
Game 4: Game 4 has the following differences from Game
AdvGame2 (A) = 1/NP2 NS2 AdvGame1 (A) (II) $
3: Game 4 challenger C chooses a random element s0 ←−
Game 2 and Game 3: In Game 2, kU ∗ V ∗ = KDF(UU ∗ , UV ∗ , Zp∗ and calculateskU ∗ V ∗ = KDF(UU ∗ , UV ∗ , (gxU ∗ ·xV ∗ )s ).
0

(gsU ∗ V ∗ )xU ∗ ·xV ∗ ), while kU ∗ V ∗ = KDF(UU ∗ , UV ∗ , (gsU ∗ V ∗ )z ) After receiving a Test(U ∗ , V ∗ , s∗ ) query from the adver-
in Game 3. Assume A outputs a bit b to distinguish sary A, C gives kU ∗ V ∗ to A. In addition, after receiving a
between Game 2 and Game 3: b = 1 if Game 2 is Test(V ∗ , U ∗ , t ∗ ) query, C also sends the same kU ∗ V ∗ to A,
∗
running; otherwise, b = 0. We design an algorithm since there is a partner oracle 5tV ∗ ,U ∗ .
B against the DDH distinguishing game, which uses A Game 5: Same as Game 4 in Case 1.1.
as a subroutine and runs as follows: (1) Upon receiv- Differences Between Games:
ing a message ((gsU ∗ V ∗ )xU ∗ , (gsU ∗ V ∗ )xV ∗ , (gsU ∗ V ∗ )xU ∗ ·xV ∗ ) or Game 1:
((gsU ∗ V ∗ )xU ∗ , (gsU ∗ V ∗ )xV ∗ , (gsU ∗ V ∗ )z ) from the DDH chal-
lenger, B transfers it to A’schallenger, who uses it to generate AdvGame1 (A) = Advλ−CAFLReCK
PAKE (I)
the response message to A’s challenge. If the received mes- Game 1 and Game 2: From Game 1 and Game 2 in Case 1.1.,
sage is ((gsU ∗ V ∗ )xU ∗ , (gsU ∗ V ∗ )xV ∗ , (gsU ∗ V ∗ )xU ∗ ·xV ∗ ), the simula- we get
tion is the same as Game 2; otherwise, it’s the same as Game
3. (2) B outputs the bit that A outputs. AdvGame2 (A) = 1/NP2 NS2 AdvGame1 (A) (II)
If A can distinguish between Game 2 and Game 3, B wins Game 2 and Game 3: In Game 2, the leakage of the shared
the DDH distinguishing game. Therefore, password is the real leakage of sU∗V ∗ = H (pwU ∗ V ∗ ), while
|AdvGame2 (A) − AdvGame3 (A)| ≤ AdvDDH (III) the leakage in Game 3 is a leakage of a random value s.
Assume A outputs a bit b to distinguish between Game 2
Game 3 and Game 4: In Game 3, kU ∗ V ∗ = KDF(UU ∗ , UV ∗ , and Game 3: b = 1 if Game 2 is running; otherwise, b =
$
(gsU ∗ V ∗ )z ), while in Game 4, kU ∗ V ∗ ←− {0, 1}k . Assume A 0. We design an algorithm B against the leakage-resilient

26838 VOLUME 5, 2017

O. Ruan et al.: Provably LR PAKE in the Standard Model

refreshing security distinguishing game, which uses A as a Game 4: Same as Game 3 in Case 1.2.
subroutine and runs as follows: (1) Upon receiving sU∗V ∗ or Game 5: Same as Game 4 in Case 1.2.
$ Game 6: Same as Game 5 in Case 1.2.
s ←− Zp∗ from the leakage-resilient refreshing challenger, B
transfers it to A’s challenger C. C uses it as the mapping group Differences Between Games:
element of the shared secret password, encodes it, continues Game 1:
refreshing two encodings, and then uses these encodings to AdvGame1 (A) = Advλ−CAFLReCK
PAKE (I)
simulate the answers to A’s Send queries with fRefresh =
L
(fRefresh , fRefresh
R ) of the principal U ∗ . If the received message Game 1 and Game 2: If pw0UV selected by A is equal to
is sU∗V ∗ in the first step, the simulation is the same as Game pwUV , Game 2 is the same as Game 1; otherwise, Game 2
2; otherwise, it’s the same as Game 3. (2) B outputs the same is independent of Game 1. The probability that pw0UV =
bit that A outputs. pwUV is NS /N , where NS denotes the number of sessions
If A can distinguish between Game 2 and Game 3, B wins on a principal and N is the size of the password dictionary.
the leakage-resilient refreshing security distinguishing game. Therefore,
Therefore, |AdvGame2 (A) − AdvGame1 (A)| = NS /N (II)
|AdvGame2 (A) − AdvGame3 (A)| ≤ AdvRefresh−LRS (III) Game 2 and Game 3: The analysis is the same as that for
Game 3 and Game 4: In Game 3, kU ∗ V ∗ = KDF(UU ∗ , UV ∗ , Game 1 and Game 2 in Case 1.1.
0
(gxU∗ ·xV ∗ )sU ∗ V ∗ ), while kU ∗ V ∗ = KDF(UU ∗ , UV ∗ , (gxU ∗ ·xV ∗ )s ) AdvGame3 (A) = 1/NP2 NS AdvGame2 (A) (III)
in Game 4. Because s0 is chosen at random and is indepen-
0 Game 3 and Game 4: The analysis is the same as that for
dent of sU ∗ V ∗ , (gxU ∗ ·xV ∗ )sU ∗ V ∗ and (gxU∗ ·xV ∗ )s are perfectly
Game 2 and Game 3 in Case 1.2.
indistinguishable. Therefore,
|AdvGame3 (A) − AdvGame4 (A)| ≤ AdvRefresh−LRS (IV)
|AdvGame3 (A) − AdvGame4 (A)| = 0 (IV)
Game 4 and Game 5: The analysis is the same as that for
Game 4 and Game 5: From Game 3 and Game 4 in Case 1.1.,
Game 3 and Game 4 in Case 1.2.
we obtain
|AdvGame4 (A) − AdvGame5 (A)| = 0 (V)
|AdvGame4 (A) − AdvGame5 (A)| ≤ AdvKDF (V)
Game 5 and Game 6: The analysis is the same as that for
Game 5: In Game 5, the leakage is computed using a random Game 4 and Game 5 in Case 1.2.
∗
value s, and the session key kU ∗ V ∗ of 5sU ∗ ,V ∗ is picked at
random. Therefore, |AdvGame5 (A) − AdvGame6 (A)| ≤ AdvKDF (VI)

AdvGame5 (A) = 0 (VI) Game 6: The analysis is the same as that for Game 5 in
Case 1.2.
Using equations (I)-(VI), we obtain
AdvGame6 (A) = 0 (VII)
Advλ−CAFLReCK
PAKE ≤ NP2 NS2 (AdvRefresh−LRS + AdvKDF ).
Using equations (I)-(VII), we obtain
Case 2 (A Partner Session to the Test Session Does Not
Advλ−CAFLReCK
PAKE ≤ NS /N +NP2 NS (AdvRefresh−LRS +AdvKDF ).
Exist):
In this case, A is an active adversary who masquerades FromCase 1 and Case 2, we obtain
as the intended partner principal of the owner principal.
Advλ−CAFLReCK
PAKE ≤ NS /N + NP2 NS2 (AdvDDH
Therefore, A is not permitted to obtain the principals’ long-
term shared password by asking a RevealPassword query. + AdvRefresh−LRS + AdvKDF ).
However, A can learn the two parties’ ephemeral session keys
by asking RevealEphemeralKey queries.
Game 1: Same as Game 1 in Case 1.2. D. SECURITY AND PERFORMANCE COMPARISON
Game 2: Game 2 has the following differences from We summarize the security and performance comparison of
Game 1: A picks a random password pw0UV , computes s0UV = our protocol with other protocols in Table 1, where Exp
H (pw0UV ), encodes it, and then uses the encodings of s0UV to denotes modular exponentiation.
generate the protocol message based on the protocol specifi- From Table 1, our protocol enjoys three advantages: (1)
cations. it’s the first LR PAKE protocol; (2) it’s an AFLR eCK-
Game 3: Game 3 has the following differences from secure AKE protocol in the standard model, while leakage
Game 2: First, A chooses two random distinct principals attacks are not allowed after the adversary chooses the test
$ $
U ∗ , V ∗ ←− {U1 , . . . , UNp } and a random number s∗ ←− session in [25], and its AFLR eCK-security has just been
{1, . . . , Ns }. Second, A begins to run the game and chooses proven in the CK security model in [28] and in the RO model
∗ ∗
5sU ∗ ,V ∗ as the target oracle. If the test oracle is not 5sU ∗ ,V ∗ , in [29] and [30]; (3) our protocol is more efficient than other
the Game 3 challenger stops and exits the game. LR AKE protocols [25], [28]–[31].

VOLUME 5, 2017 26839

 O. Ruan et al.: Provably LR PAKE in the Standard Model

TABLE 1. Security and efficiency comparison of AKE protocols. [6] P. MacKenzie, S. Patel, and R. Swaminathan, ‘‘Password-authenticated
key exchange based on RSA,’’ in Proc. ASIACRYPT, Kyoto, Japan, 2000,
pp. 599–613.
[7] J. W. Byun, D. H. Lee, and J. I. Lim, ‘‘EC2C-PAKA: An efficient client-to-
client password-authenticated key agreement,’’ Inf. Sci., vol. 177, no. 19,
pp. 3995–4013, 2007.
[8] M. S. Farash and M. A. Attari, ‘‘An efficient client–client password-based
authentication scheme with provable security,’’ J. Supercomput., vol. 70,
no. 2, pp. 1002–1022, 2014.
[9] O. Goldreich and Y. Lindell, ‘‘Session-key generation using human pass-
words only,’’ J. Cryptol., vol. 19, no. 3, pp. 241–340, 2006.
[10] J. Katz, R. Ostrovsky, and M. Yung, ‘‘Efficient and secure authenticated
key exchange using weak passwords,’’ J. ACM, vol. 57, no. 1, 2009,
Art. no. 3.
[11] J. Katz, P. MacKenzie, G. Taban, and V. Gligor, ‘‘Two-server password-
only authenticated key exchange,’’ J. Comput. Syst. Sci., vol. 78, no. 2,
E. LEAKAGE TOLERANCE OF THE PROPOSED PROTOCOL pp. 651–669, 2012.
[12] R. Canetti, D. Dachman-Soled, V. Vaikuntanathan, and H. Wee, ‘‘Efficient
First, the overall leakage amount is arbitrarily large since password authenticated key exchange via oblivious transfer,’’ in Proc.
the encodings are refreshed in each instance of the proposed PKC, Darmstadt, Germany, 2012, pp. 449–466.
[13] V. Goyal, ‘‘Positive results for concurrently secure computation in the
protocol and continuous leakage is allowed. plain model,’’ in Proc. 53rd Annu. Symp. Found. Comput. Sci. (FOCS),
Second, for each instance of the proposed protocol, the New Brunswick, NJ, USA, 2012, pp. 41–50.
leakage size is bounded by λRefresh = (λRefresh1 , λRefresh2 ). [14] W. M. Li, Q. Y. Wen, Q. Su, H. Zhang, and Z. P. Jin,, ‘‘Password-
authenticated multiple key exchange protocol for mobile applications,’’
Based on Lemma 6, an LRS scheme 8n,1 Zp∗ is λ-secure with China Commun., vol. 9, no. 1, pp. 64–72, 2012.
λ = (0.3nlog p, 0.3nlog p) if 20 < n. Moreover, based [15] K.-L. Tsai, Y.-L. Huang, F.-Y. Leu, and I. You, ‘‘TTP based high-efficient
on Lemma 7, a leakage-resilient refreshing RefreshZn,1 ∗ for
multi-key exchange protocol,’’ IEEE Access, vol. 4, pp. 6261–6271, 2016.
p [16] M. Luo, X. Zhou, L. Li, K.-K. R. Choo, and D. He, ‘‘Security analysis of
8n,1
Zp∗ is (λ/2, λ)- secure if 1/3 ≤ n ∧ n ≥ 16. There-
two password-authenticated multi-key exchange protocols,’’ IEEE Access,
vol. 5, pp. 8017–8024, 2017.
fore, the leakage size for each occurrence is bounded by [17] O. Ruan, N. Kumar, D. He, and J.-H. Lee, ‘‘Efficient provably secure
(0.15nlog p, 0.15nlog p). In the protocol, the shared secret password-based explicit authenticated key agreement,’’ Pervasive Mobile
password is mapped to a group element sUV = H (pwUV ) Comput., vol. 24, no. 12, pp. 50–60, 2015.
[18] X. Yi et al., ‘‘ID2S password-authenticated key exchange protocols,’’ IEEE
and encoded into two parts, namely, aL ∈ (Zp∗ )n and aR ∈ Trans. Comput., vol. 65, no. 12, pp. 3687–3701, Dec. 2016.
(Zp∗ )n×1 , of size n · log p. Thus, the leakage tolerance for each [19] S. H. Islam, ‘‘Design and analysis of a three party password-based authen-
occurrence is ticated key exchange protocol using extended chaotic maps,’’ Inf. Sci.,
vol. 312, pp. 104–130, Aug. 2015.
[20] R. Amin and G. P. Biswas, ‘‘Cryptanalysis and design of a three-party
(0.15nlog p/nlog p, 0.15nlog p/nlog p) = 15%. authenticated key exchange protocol using smart card,’’ Arabian J. Sci.
Eng., vol. 40, no. 11, pp. 3135–3149, 2015.
[21] C. F. Lu, ‘‘Multi-party password-authenticated key exchange scheme with
V. CONCLUSION privacy preservation for mobile environment,’’ KSII Trans. Internet Inf.
By combining Diffie-Hellman key exchange and the Syst., vol. 9, no. 12, pp. 5135–5149, 2015.
DF-LRS scheme appropriately, we first design an λ-CAFLR [22] J. Nam, J. Paik, J. Kim, Y. Lee, and D. Won, ‘‘Server-aided password-
authenticated key exchange: From 3-party to group,’’ in Proc. Int. Conf.
eCK security PAKE protocol. Our protocol is one of most Human Interface Manage. Inf., Orlando, FL, USA, 2011, pp. 339–348.
practical cryptographic primitives for trusted computing, [23] C. Guo, Z. Zhang, L. Zhu, Y.-A. Tan, and Z. Yang, ‘‘Scalable protocol
which could be used to securely authenticate devices’ iden- for cross-domain group password-based authenticated key exchange,’’
Frontiers Comput. Sci., vol. 9, no. 1, pp. 157–169, 2014.
tities and generate shared session keys among devices in [24] A. Ometov, A. Levina, P. Borisenko, R. Mostovoy, A. Orsino, and
insecure leakage environments such as IoT. S. Andreev, ‘‘Mobile social networking under side-channel attacks: Prac-
tical security challenges,’’ IEEE Access, vol. 5, pp. 2591–2601, 2017.
[25] D. Moriyama and T. Okamoto, ‘‘Leakage resilient eCK-secure key
REFERENCES exchange protocol without random oracles,’’ in Proc. ASIACCS,
[1] A. G. Reddy, E.-J. Yoon, A. K. Das, V. Odelu, and K.-Y. Yoo, ‘‘Design Hong Kong, 2011, pp. 441–447.
of mutually authenticated key agreement protocol resistant to imper- [26] B. LaMacchia, K. Lauter, and A. Mityagin, ‘‘Stronger security of authen-
sonation attacks for multi-server environment,’’ IEEE Access, vol. 5, ticated key exchange,’’ in Proc. ProvSec, Wollongong, NSW, Australia,
pp. 3622–3639, 2017. 2007, pp. 1–16.
[2] Trusted Computing Group. (Sep. 2015). Guidance for Securing [27] R. Canetti and H. Krawczyk, ‘‘Analysis of key-exchange protocols and
IoT Using TCG Technology Reference Document. [Online]. Avail- their use for building secure channels,’’ in Proc. EUROCRYPT, Innsbruck,
able: https://www.trustedcomputinggroup.org/wp-tontent/uploads/TCG Austria, 2001, pp. 453–474.
_Guidance_for_Securing_IoT_1_0r21.pdf [28] J. Alawatugoda, C. Boyd, and D. Stebila, ‘‘Continuous after-the-fact
[3] C.-L. Hsu, T.-H. Chuang, and T.-W. Lin, ‘‘End-to-end authenticated leakage-resilient key exchange,’’ in Proc. ACISP, Wollongong, NSW, Aus-
key exchange agreement for wearable devices in IoT environments,’’ in tralia, 2014, pp. 258–273.
Proc. IEEE Great Lakes Biomed. Conf. (GLBC), Milwaukee, WI, USA, [29] J. Alawatugoda, D. Stebila, and C. Boyd, ‘‘Modelling after-the-fact leakage
Apr. 2017, p. 1, doi: 10.1109/GLBC.2017.7928891. for key exchange,’’ in Proc. ASIA CCS, Kyoto, Japan, 2014, pp. 207–216.
[4] S. M. Bellovin and M. Merritt, ‘‘Encrypted key exchange: Password-based [30] J. Alawatugoda, D. Stebila, and C. Boyd, ‘‘Continuous after-the-fact
protocols secure against dictionary attacks,’’ in Proc. IEEE Symp. Secur. leakage-resilient eCK-secure key exchange,’’ in Proc. IMA Int. Conf.
Privacy, Oakland, CA, USA, May 1992, pp. 72–84. Cryptogr. Coding, Oxford, U.K., 2015, pp. 277–294.
[5] M. Bellare, D. Pointcheval, and P. Rogaway, ‘‘Authenticated key exchange [31] R. Chen, Y. Mu, G. Yang, W. Susilo, and F. Guo, ‘‘Strongly leakage-
secure against dictionary attacks,’’ in Proc. EUROCRYPT, Bruges, resilient authenticated key exchange,’’ in Proc. CT-RSA, San Francisco,
Belgium, 2000, pp. 139–155. CA, USA, 2016, pp. 19–36.

26840 VOLUME 5, 2017

O. Ruan et al.: Provably LR PAKE in the Standard Model

[32] O. Ruan, Y. Zhang, M. Zhang, J. Zhou, and L. Harn, ‘‘After-the- JING CHEN received the M.S. and Ph.D. degrees
fact leakage-resilient identity-based authenticated key exchange,’’ IEEE from the Huazhong University of Science and
Syst. J., to be published, doi: 10.1109/JSYST.2017.2685524. Technology, China. He is currently a Professor
[33] M. Toorani, ‘‘On continuous after-the-fact leakage-resilient key with the School of Computer Science, Wuhan Uni-
exchange,’’ in Proc. 2nd Workshop Cryptogr. Secur. Comput. Syst., versity. His work focuses on wireless networks,
Amsterdam, The Netherlands, 2015, pp. 31–35. network security, routing, and distributed resource
[34] Z. Yang and S. Li, ‘‘On security analysis of an after-the-fact leakage management.
resilient key exchange protocol,’’ Inf. Process. Lett., vol. 116, no. 1,
pp. 33–40, 2016.
[35] H. Krawczyk. (Apr. 2008). On Extract-Then-Expand Key Deriva-
tion Functions and an HMAC Based KDF. [Online]. Available:
http://webee.technion.ac.il/~hugo/kdf/kdf.pdf
[36] F. Davì, S. Dziembowski, and D. Venturi, ‘‘Leakage-resilient storage,’’ in
Proc. SCN, Amalfi, Italy, 2010, pp. 121–137.
[37] S. Dziembowski and S. Faust, ‘‘Leakage-resilient cryptography from the
inner-product extractor,’’ in Proc. ASIACRYPT, Seoul, South Korea, 2011,
pp. 702–721.
[38] O. Ruan, M. Zhang, and J. Chen, ‘‘Leakage-resilient password-based
authenticated key exchange,’’ in Proc. Algorithms Archit. Parallel Process.,
Helsinki, Finland, 2017, pp. 285–296.

MINGWU ZHANG was a JSPS Post-Doctoral

OU RUAN received the Ph.D. degree from the Fellow of the Japan Society of Promotion Sci-
College of Information Security, School of Com- ences, Institute of Mathematics for Industry,
puter Science and Technology, Huazhong Univer- Kyushu University, from 2010 to 2012. He is cur-
sity of Science and Technology of China, in 2013. rently a Professor at with the School of Computer
He is currently an Associate Professor with the Sciences, Hubei University of Technology, where
School of Computer Sciences, Hubei Univer- he is also the Director of Institute of Data Security
sity of Technology. His research interests include and Privacy Preservation. His research interests
leakage-resilient cryptography, secure computa- include cryptography technology for networks,
tions, and network security. secure computations, and privacy preservations.

VOLUME 5, 2017 26841