Skip to main content
Article thumbnail
Location of Repository

On the Security of PAS (Predicate-based Authentication Service)

By Shujun Li, Hassan Jameel Asghar, Josef Pieprzyk, Ahmad-reza Sadeghi and Huaxiong Wang

Abstract

Abstract—Recently a new human authentication scheme called PAS (predicate-based authentication service) was proposed, which does not require the assistance of any supplementary device. The main security claim of PAS is to resist passive adversaries who can observe the whole authentication session between the human user and the remote server. In this paper we show that PAS is insecure against both brute force attack and a probabilistic attack. In particular, we show that its security against brute force attack was strongly overestimated. Furthermore, we introduce a probabilistic attack, which can break part of the password even with a very small number of observed authentication sessions. Although the proposed attack cannot completely break the password, it can downgrade the PAS system to a much weaker system similar to common OTP (one-time password) systems. Keywords-PAS; authentication; Matsumoto-Imai threat model; attack; security; usability; OTP (one-time password)

Year: 2011
OAI identifier: oai:CiteSeerX.psu:10.1.1.192.7145
Provided by: CiteSeerX
Download PDF:
Sorry, we are unable to provide the full text but you may find it at the following location(s):
  • http://citeseerx.ist.psu.edu/v... (external link)
  • https://www.acsac.org/2009/ope... (external link)
  • https://www.acsac.org/2009/ope... (external link)
  • Suggested articles


    To submit an update or takedown request for this paper, please submit an Update/Correction/Removal Request.