Cryptanalysis of an efficient three-party password-based key exchange scheme

In order to secure communications between two clients with a trusted server's help in public network environments, a three-party password-based authenticated key exchange (3PAKE) scheme is used to provide the transaction confidentiality and efficiency. In 2010, Lou-Huang proposed a new simple three-party password-based authenticated key exchange (LH-3PAKE) scheme based on elliptic curve cryptography (ECC). By analysis, Lou-Huang claimed that the proposed LH-3PAKE scheme is not only secure against various attacks, but also more efficient than previously proposed 3PAKE schemes. However, this paper demonstrates LH-3PAKE scheme is vulnerable to off-line password guessing attacks by an attacker. c (C)2011 Published by Elsevier Ltd. Selection and/or peer-review under responsibility of Harbin University of Science and Technology