![](bg3.png)
Title Suppressed Due to Excessive Length 3
The lines starting Secret specify secrecy property.InCSP,asecrecy property
can be formalized as signal.Claim
Secret.a.b.s event. This may be understood
to mean; ‘The secret value s used in the run between a and b, which was initi-
ated by a should be secret for the entire protocol run’. If the secrecy property is
satisfied in the model, then the intruder should not be able to obtain access to
the secret value, s. Secret(a, na, [b]) may be paraphrased as: ‘a thinks na is a
secret that can be known to only a and b’. In like manner, Secret(b, challenge,
[a]) represents that ‘a thinks challenge is a secret that can be known only b
and a’. The lines starting with Agreement define that authentication property.
In CSP model, an authentication property can be observed from two viewpoints;
one is the authentication of the initiator by the responder,while the other is the
authentication of the responder by the initiator. The Agreement(a, b, [na, chal-
lenge, otp]) means that ‘a is authenticated to b based on the agreement with na,
challenge, otp values between two hosts. Also the Agreement(b, a, [na, challenge,
otp]) implies that ‘b is authenticated to a based on the agreement with na, chal-
lenge, otp values between two hosts. After running FDR tool, we confirm that
new S/Key system satisfies security properties of secrecy and authentication.
4 Conclusion
S/Key is a very famous authentication system that uses a one-time password
scheme to protect a malicious attacker from replay attack. But with the great
development of PC’s computation power, we unfortunately are confronted by
a various threat factors. Moreover, vulnerabilities of S/Key were reported by
many researchers. Among them, one of the most effective attacks is to sniff a
seed and sequence number from client, then guess passphrase using dictionary
attack tool. In this paper, we point out the weakness of an original EKE protocol
and modify it. We combine a corrected EKE with S/Key and propose a new
S/Key system against dictionary attack. And we specify and verify its secrecy
and authentication properties using Casper and CSP/FDR.
References
1. J. Clark and J. Jacob, A survey of authentication protocol literature: Version 1.0,
Available via http://www.win.tue.nl/˜ecss/downloads/clarkjacob.pdf, 1997.
2. L.Chen and C.J.Mitchell, Comments on the S/KEY user authentication scheme,
ACM SIGOPS Operating Systems Review, Volume 30, Issue 4.,1996.
3. Formal Systems(Europe) Ltd, Failure Divergence Refinement-FDR2 User Manual,
Aug. 1999.
4. C.A.R. Hoare, Communicating Sequential Processes. Prentice-Hall, 1985.
5. G. Lowe, Casper: A compiler for the analysis of security protocols, 10th IEEE
Computer Security Foundations Workshop, 1997.
6. N. Haller, “The S/Key one-time password system,” RFC 1760, 1995.
7. S. M. Bellovin, M. Merritt, Encrypted Key Exchange: Password-Based Protocols
Secure Against Dictionary Attacks, AT&T Bell Laboratories. Proceedings of the
1992 IEEE Computer Society Conference on Research in Security and Privacy,
May 1992.
77