Abstract. Password-Authenticated Key Exchange (PAKE) studies how to establish secure com-munication between two remote parties solely based on their shared password, without requiring a Public Key Infrastructure (PKI). Despite extensive research in the past decade, this problem remains unsolved. Patent has been one of the biggest brakes in deploying PAKE solutions in prac-tice. Besides, even for the patented schemes like EKE and SPEKE, their security is only heuristic; researchers have reported some subtle but worrying security issues. In this paper, we propose to tackle this problem using an approach different from all past solutions. Our protocol, Password Authenticated Key Exchange by Juggling (J-PAKE), achieves mutual au-thentication in two steps: first, two parties send ephemeral public keys to each other; second, they encrypt the shared password by juggling the public keys in a verifiable way. The first use of such a juggling technique was seen in solving the Dining Cryptographers problem in 2006. Here, we apply it to solve the PAKE problem, and show that the protocol is zero-knowledge as it reveals nothing except one-bit information: whether the supplied passwords at two sides are the same. With clear advantages in security, our scheme has comparable efficiency to the EKE and SPEKE protocols. Keywords: Password-Authenticated Key Exchange, EKE, SPEKE, key agreement. 1

Abstract not found

Abstract—The main concern on the use of wireless technologies is security, due to the nature of the medium. User awareness in order to implement efficient security configurations is an important requirement raised by the technology, undermining its use. Wireless Protected Setup (WPS) was introduced as a viable solution to the problem, offering automatic network setup and device configuration. WPS itself suffers from a security flaw; the feature has to be disabled on the devices and user confidence is subverted. In this work we propose to enhance WPS security through the Visual Device Pairing Security (ViDPSec) method to address this problem. ViDPSec is a user-based, lightweight device pairing protocol that establishes secure communication channels between devices, encrypting data with a one time symmetric key that is securely exchanged per session. Enhanced WPS alleviates the WPS security issues and enables the user to have full control over the procedure, raising user confidence. Wi-Fi; WPS; ViDPSec; wireless security I.