对PAKE协议的反向在线猜测攻击
Reverse Online Guessing Attacks on PAKE Protocols
AI总结：
本文研究了PAKE协议对反向在线猜测攻击的脆弱性，指出在无PKI或无其他认证机制时，攻击者可通过伪装服务器验证密码猜测，建议采用更严格的服务器认证措施。
摘要：
尽管尚未广泛应用，密码认证密钥交换（PAKE）协议已成为最近标准化努力的主题，部分原因是其对各种猜测攻击具有抵抗力，也因为它们不需要公钥基础设施（PKI），使其自然对PKI故障具有抵抗力。本文的目标是重新评估PAKE模型，指出没有PKI——或更一般地说，除了密码之外没有其他机制用于验证服务器——使得此类协议容易受到反向在线猜测攻击的攻击，其中攻击者通过 impersonating 服务器来验证密码猜测。虽然其逻辑与传统猜测相似，其中攻击者 impersonates 客户端，但反向猜测带来了独特的风险，因为检测负担转移到了客户端，使现有防御传统猜测的措施变得无效。我们的结果表明，当攻击者无差别攻击客户端时，反向猜测特别有效，例如在钓鱼或密码喷射攻击中，或在具有自动登录过程或通用密码的应用中，如WPA3-SAE。我们的分析表明，相关方应默认使用比仅用户密码更严格的方法来验证服务器，并且在其他认证机制不可用时，仅使用密码模式应作为应对灾难性安全故障的最后手段。
英文摘要：
Though not yet widely deployed, password-authenticated key exchange (PAKE) protocols have been the subject of several recent standardization efforts, partly because of their resistance against various guessing attacks, but also because they do not require a public-key infrastructure (PKI), making them naturally resistant against PKI failures. The goal of this paper is to reevaluate the PAKE model by noting that the absence of a PKI -- or, more generally, of a mechanism aside from the password for authenticating the server -- makes such protocols vulnerable to reverse online guessing attacks, in which an adversary attempts to validate password guesses by impersonating a server. While their logic is similar to traditional guessing, where the attacker impersonates a client, reverse guessing poses a unique risk because the burden of detection is shifted to the clients, rendering existing defenses against traditional guessing moot. Our results demonstrate that reverse guessing is particularly effective when an adversary attacks clients indiscriminately, such as in phishing or password-spraying attacks, or for applications with automated login processes or a universal password, such as WPA3-SAE. Our analysis suggests that stakeholders should, by default, authenticate the server using more stringent measures than just the user's password, and that a password-only mode of operation should be a last resort against catastrophic security failures when other authentication mechanisms are not available.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
