Publication

Abstract : A three party authenticated key agreement protocol (3PAKA) enables two entities to establish a session key with the assistance of a dedicated server via an insecure channel. Recently, Islam et al. (J Inf Secur Appl 6363:103026, 2021) proposed a post-quantum secure 3PAKA scheme based on Ring-LWE and proved their protocol could fend off several typical security threats. Later, Rewal et al. (J Inf Secur Appl 75:103505, 2023) pointed out that their scheme is susceptible to password guessing attacks. However, we have found that Islam et al. protocol is not only insecure against password guessing attacks but also lacks user privacy and is susceptible to impersonation attacks. We also find that Rewal et al. scheme does not provide anonymity to users and uses time stamps for key freshness, which might cause a clock synchronization problem. With that, there is a flaw in the password update phase of Rewal’s scheme. We have proposed a 3PAKA protocol to overcome the vulnerabilities in the protocols mentioned above. We demonstrate that the new scheme strengthens security and mitigates all the existing defects of Islam et al. and Rawel et al. protocols. With this, the security comparison and performance analysis show that the proposed scheme offers a more effective solution than the existing schemes.