A Password Attack on S-3 PAKE

Abstract

The key exchange protocols using passwords achieved great attention due to their simplicity and e ciency. On the other hand these protocols should resist all types of password guessing attacks, as the password is of low entropy. Recently Lu and Cao proposed a three party simple key ex-change protocol (S-3PAKE). It is an extension of Abdella and Pointchval SPAKE protocol. Later Guo et al. proposed a man in the middle attack and undetectable online password guessing attack on the above protocol. They also presented an improved S3PAKE. In the present paper we have shown that the improved S-3PAKE still su ers from undetectable pass-word guessing attack and discuss the countermeasures to preclude such an attack