翻訳と辞書 Words near each other ・ Pasta salad ・ Pasta Zara-Cogeas ・ Pasta ZZ ・ Pastafazoola ・ Pastafrola ・ Pastagate ・ Pastak ・ Pastaku ・ Pastal Kuh ・ Pastamania ・ Pastan ・ Pastanjauhantaa ・ Pastavy ・ Pastavy Raion ・ Password (video gaming) ・ Password Authenticated Key Exchange by Juggling ・ Password Authentication Protocol ・ Password bank ・ Password Change Notification Service ・ Password cracking ・ Password fatigue ・ Password Hashing Competition ・ Password length parameter ・ Password management ・ Password manager ・ Password notification email ・ Password Plus and Super Password ・ Password policy ・ Password psychology ・ Password Safe Dictionary Lists mini英和辞書 mini和英辞書 Webster 1913 Latin-English FOLDOC Wikipedia English ウィキペディア

翻訳と辞書　辞書検索 [ 開発暫定版 ] スポンサード リンク Password Authenticated Key Exchange by Juggling ： ウィキペディア英語版 Password Authenticated Key Exchange by Juggling The Password Authenticated Key Exchange by Juggling (or J-PAKE) is a password-authenticated key agreement protocol.〔F. Hao, P. Ryan. (Password Authenticated Key Exchange by Juggling ). ''Proceedings of the 16th International Workshop on Security Protocols, 2008.〕 This protocol allows two parties to establish private and authenticated communication solely based on their shared (low-entropy) password without requiring a Public Key Infrastructure. It provides mutual authentication to the key exchange, a feature that is lacking in the Diffie-Hellman key exchange protocol. ==Description== Two parties, Alice and Bob, agree on a group $G$ with generator $g$ of prime order $q$ in which the discrete log problem is hard. Typically a Schnorr group is used. In general, J-PAKE can use any prime order group that is suitable for public key cryptography, including Elliptic curve cryptography. Let $s$ be their shared (low-entropy) secret, which can be a password or a hash of a password ($s\; \backslash neq\; 0$). The protocol executes in two rounds. ;Round 1: Alice selects $x\_1\; \backslash in\_R\; (q-1)$, $x\_2\; \backslash in\_R\; (q-1)$ and sends out $g^$, $g^$ together with the Zero-knowledge proofs (using for example Schnorr signature) for the proof of the exponents $x\_1$ and $x\_2$. Similarly, Bob selects $x\_3\; \backslash in\_R\; (q-1)$, $x\_4\; \backslash in\_R\; (q-1)$ and sends out $g^$, $g^$ together with the Zero-knowledge proofs for the proof of the exponents $x\_3$ and $x\_4$. The above communication can be completed in one round as neither party depends on the other. When it finishes, Alice and Bob verify the received Zero-knowledge proofs and also check $g^,\; g^\; \backslash neq\; 1$. ;Round 2: Alice sends out $A\; =\; g^$ and a Zero-knowledge proof for the proof of the exponent $x\_2\; s$. (Note Alice actually derives a new public key using $g^$ as the generator). Similarly, Bob sends out $B\; =\; g^$ and a Zero-knowledge proof for the proof of the exponent $x\_4\; s$. After Round 2, Alice computes $K\; =\; (B/g^)^\; =\; g^$. Similarly, Bob computes $K\; =\; (A/g^)^\; =\; g^$. With the same keying material $K$, Alice and Bob can derive a session key using a Cryptographic hash function: $\backslash kappa\; =\; H(K)$. The two-round J-PAKE protocol is completely symmetric. This helps significantly simplify the security analysis. For example, the proof that one party does not leak any password information in the data exchange must hold true for the other party based on the symmetry. This reduces the number of the needed security proofs by half. In practice, it is more likely to implement J-PAKE in three flows since one party shall normally take the initiative. This can be done trivially without loss of security. Suppose Alice initiates the communication by sending to Bob: $g^,\; g^$ and Zero-knowledge proofs. Then Bob replies with: $g^,\; g^,\; B\; =\; g^$ and Zero-knowledge proofs. Finally, Alice sends to Bob: $A\; =\; g^$ and a Zero-knowledge proof. Both parties can now derive the same session key. Depending on the application requirement, Alice and Bob may perform an optional key confirmation step. There are several ways to do it. A simple method described in SPEKE works as follows: Alice sends to Bob $H(H(\backslash kappa))$, and then Bob replies with $H(\backslash kappa)$. Alternatively, Alice and Bob can realize explicit key confirmation by using the newly constructed session key to encrypt a known value (or a random challenge). EKE, Kerberos and Needham-Schroeder all attempt to provide explicit key confirmation by exactly this method. 抄文引用元・出典: フリー百科事典『 ウィキペディア（Wikipedia）』 ■ウィキペディアで「Password Authenticated Key Exchange by Juggling」の詳細全文を読む スポンサード リンク 翻訳と辞書 : 翻訳のためのインターネットリソース Copyright(C) kotoba.ne.jp 1997-2016. All Rights Reserved.