1、 International Telecommunication Union ITU-T X.1035TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (02/2007) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY Telecommunication security Password-authenticated key exchange (PAK) protocol ITU-T Recommendation X.1035 ITU-T X-SERIES RECOM
2、MENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS Services and facilities X.1X.19 Interfaces X.20X.49 Transmission, signalling and switching X.50X.89 Network aspects X.90X.149 Maintenance X.150X.179 Administrative arrangements X.180X.199 OPEN SYSTEMS INTERCONNECT
3、ION Model and notation X.200X.209 Service definitions X.210X.219 Connection-mode protocol specifications X.220X.229 Connectionless-mode protocol specifications X.230X.239 PICS proformas X.240X.259 Protocol Identification X.260X.269 Security Protocols X.270X.279 Layer Managed Objects X.280X.289 Confo
4、rmance testing X.290X.299 INTERWORKING BETWEEN NETWORKS General X.300X.349 Satellite data transmission systems X.350X.369 IP-based networks X.370X.379 MESSAGE HANDLING SYSTEMS X.400X.499DIRECTORY X.500X.599 OSI NETWORKING AND SYSTEM ASPECTS Networking X.600X.629 Efficiency X.630X.639 Quality of serv
5、ice X.640X.649 Naming, Addressing and Registration X.650X.679 Abstract Syntax Notation One (ASN.1) X.680X.699 OSI MANAGEMENT Systems Management framework and architecture X.700X.709 Management Communication Service and Protocol X.710X.719 Structure of Management Information X.720X.729 Management fun
6、ctions and ODMA functions X.730X.799 SECURITY X.800X.849 OSI APPLICATIONS Commitment, Concurrency and Recovery X.850X.859 Transaction processing X.860X.879 Remote operations X.880X.889 Generic applications of ASN.1 X.890X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 TELECOMMUNICATION SECURITY X.1000 F
7、or further details, please refer to the list of ITU-T Recommendations. ITU-T Rec. X.1035 (02/2007) i ITU-T Recommendation X.1035 Password-authenticated key exchange (PAK) protocol Summary ITU-T Recommendation X.1035 specifies a protocol, which ensures mutual authentication of both parties in the act
8、 of establishing a symmetric cryptographic key via Diffie-Hellman exchange. The use of Diffie-Hellman exchange ensures the perfect forward secrecy a property of a key establishment protocol that guarantees that compromise of a session key or long-term private key after a given session does not cause
9、 the compromise of any earlier session. With the proposed authentication method, the exchange is protected from the man-in-the-middle attack. The authentication relies on a pre-shared secret (e.g., password), which is protected (i.e., remains unrevealed) to an eavesdropper preventing an off-line dic
10、tionary attack. Thus, the protocol can be used in a wide variety of applications where pre-shared secrets based on the possibly weak password exist. Source ITU-T Recommendation X.1035 was approved on 13 February 2007 by ITU-T Study Group 17 (2005-2008) under the ITU-T Recommendation A.8 procedure. i
11、i ITU-T Rec. X.1035 (02/2007) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications. The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, opera
12、ting and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide basis. The World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, pr
13、oduce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution 1. In some areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In t
14、his Recommendation, the expression “Administration“ is used for conciseness to indicate both a telecommunication administration and a recognized operating agency. Compliance with this Recommendation is voluntary. However, the Recommendation may contain certain mandatory provisions (to ensure e.g. in
15、teroperability or applicability) and compliance with the Recommendation is achieved when all of these mandatory provisions are met. The words “shall“ or some other obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest
16、 that compliance with the Recommendation is required of any party. INTELLECTUAL PROPERTY RIGHTS ITU draws attention to the possibility that the practice or implementation of this Recommendation may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidenc
17、e, validity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the Recommendation development process. As of the date of approval of this Recommendation, ITU had not received notice of intellectual property, protected by patents, which may
18、be required to implement this Recommendation. However, implementers are cautioned that this may not represent the latest information and are therefore strongly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2007 All rights reserved. No part of this publication may be r
19、eproduced, by any means whatsoever, without the prior written permission of ITU. ITU-T Rec. X.1035 (02/2007) iii CONTENTS Page 1 Scope 1 2 References. 1 3 Definitions 1 4 Abbreviations and acronyms 1 5 Conventions 1 6 Protocol description 2 7 Security considerations. 3 Bibliography 4 iv ITU-T Rec. X
20、.1035 (02/2007) Introduction The Diffie-Hellman key exchange, although it provides the perfect forward secrecy, is vulnerable to the man-in-the-middle attack, as is well known. There are several methods of mitigating such attacks; some of them rely on public key cryptography, while others rely on sh
21、ared secrets (passwords). This Recommendation specifies a protocol of the latter kind. Specifically, with the proposed authentication method, the exchange is protected from the man-in-the-middle attack. The authentication relies on a potentially weak pre-shared secret, which is concealed (i.e., rema
22、ins unrevealed) from an eavesdropper preventing an off-line dictionary attack. Thus, the protocol can be used in a wide variety of applications where pre-shared secrets (such as password-based ones) are employed. PAK advantages are listed below: Provides strong key exchange with weak passwords; Foil
23、s the man-in-the-middle attack; Provides explicit mutual authentication; Ensures perfect forward secrecy. Additional information on PAK is provided in the documents that are listed in the Bibliography. ITU-T Rec. X.1035 (02/2007) 1 ITU-T Recommendation X.1035 Password-authenticated key exchange (PAK
24、) protocol 1 Scope This Recommendation provides description of the password-authenticated key exchange (PAK) protocol that meets the following requirements: Provides mutual authentication based on a pre-shared password; Provides protection against a man-in-the-middle and against offline dictionary a
25、ttacks. This Recommendation also provides guidance on the selection of the parameters for Diffie-Hellman key exchange. 2 References The following ITU-T Recommendations and other references contain provisions which, through reference in this text, constitute provisions of this Recommendation. At the
26、time of publication, the editions indicated were valid. All Recommendations and other references are subject to revision; users of this Recommendation are therefore encouraged to investigate the possibility of applying the most recent edition of the Recommendations and other references listed below.
27、 A list of the currently valid ITU-T Recommendations is regularly published. The reference to a document within this Recommendation does not give it, as a stand-alone document, the status of a Recommendation. TIA 683-D TIA Standard TIA-683-D (2006), Over-the-Air Service Provisioning of Mobile Statio
28、ns in Spread Spectrum Systems. 3 Definitions None. 4 Abbreviations and acronyms This Recommendation uses the following abbreviations and acronyms: PAK Password-Authenticated Key Exchange PW Password SHA Secure Hash Algorithm WLAN Wireless Local Area Network 5 Conventions The following conventions ar
29、e used in this Recommendation: a mod b denotes the least non-negative remainder when a is divided by b; Hi(u) denotes an agreed-on hash function (e.g., based on SHA-1) computed over a string u, where i = 1, 2, 3, . The various Hi() act as independent random functions. The use of different random fun
30、ctions in PAK protocol is recommended in order to strengthen the protocols security. s|t denotes concatenation of the strings s and t. 2 ITU-T Rec. X.1035 (02/2007) 6 Protocol description Diffie-Hellman key agreement requires that both the sender and recipient of a message create their own secret ra
31、ndom numbers and exchange the exponentiation of their respective numbers. By raising the exchanged value with its secret random number, both parties can compute the same shared secret Diffie-Hellman key. There are two communicating parties in PAK, A and B, which share a secret password PW. The globa
32、l Diffie-Hellman publicly known constants, a prime p and a generator g are carefully selected so that 1) a safe prime p is large enough to make the computation of discrete logarithm infeasible; and 2) powers of g modulo p cover the entire range of p-1 integers from 1 to p-1. Initially, A selects a s
33、ecret exponent RAand computes pgARmod ; B selects a secret exponent RB and computes pgBRmod . For efficiency purposes, short exponents could be used for RAand RBprovided they have a certain minimum size. In the following steps, all multiplication operations should be done mod p, so all values that a
34、re being exchanged between the communicating parties are not larger than p. Consequently, all division operations should also be done mod p. Then: 1) A initiates the exchange by picking a random RAand sending the quantity )mod()|(1pgPWBAHXAR= to B; 2) B, upon receiving that quantity, verifies that X
35、 is not a zero and then divides it by )|(1PWBAH to recover pgARmod . Then B picks a random RBand computes )mod)|(|mod|)|(|(1131= pPWBAHXpgPWBAHXPWBAHSBBRRand )mod()|(2pgPWBAHYBR= . B sends to A a message that contains both quantities S1 and Y. 3) Upon receiving that message and verifying that Y is n
36、ot zero, A can authenticate B by recovering what should be pgBRmod and computing S1 itself. If the result is equal to the received value, A computes the key)mod)|(|)|(|mod|(225= pPWBAHYPWBAHYpgPWBAHKAARR. To authenticate itself and complete the exchange, A also computes the quantity )mod)|(|)|(|mod|
37、(2242= pPWBAHYPWBAHYpgPWBAHSAARRand sends it to B. 4) B authenticates A by computing 2S itself and checking it against the value received from A. If both values are the same, B also computes the key )mod)|(|mod|)|(|(115= pPWBAHXpgPWBAHXPWBAHKBBRR. If any of the above verifications fails, the protoco
38、l halts; otherwise, both parties have authenticated each other and established the key. ITU-T Rec. X.1035 (02/2007) 3 The summary of the above steps is illustrated by Figure 1, where P denotes A|B|PW (P = A|B|PW) and some formulas have been simplified. Party A Party B )mod()(1pgPHXAR= XVerify that r
39、eceived value is not 0 pgPHpgPHARARmod)()mod()(11=)mod|mod|mod|(31pgpgpgPHSBRARBRAR=Calculate 1S and verify that it is equal to the received value for 1S from B YS ,1)mod()()mod|mod|mod|(231pgPHYpgpgpgPHSBRBRARBRAR=)mod|mod|mod|(42pgpgpgPHSBRARBRAR=2S)mod|mod|mod|(42pgpgpgPHSBRARBRAR=Calculate 2S an
40、d verify that it is equal to the received value for 2S from A )mod|mod|mod|(5pgpgpgPHKBRARBRAR=)mod|mod|mod|(5pgpgpgPHKBRARBRAR=Figure 1 Description of the PAK protocol 7 Security considerations This clause considers security aspects of PAK. Specifically, it provides guidance on the selection of the
41、 Diffie-Hellman parameters. Only previously agreed-upon values for parameters p and g should be used in the PAK protocol. This is necessary to protect against an attacker sending bogus p and g values and thus tricking the other communicating party in improper Diffie-Hellman exponentiation. The use o
42、f the parameters p and g that do not meet the requirements described in this Recommendation may result in a compromise of the password. A proper 1024-bit value for p and an appropriate value for g are published in TIA 683-D. In addition, if short exponents are used for Diffie-Hellman parameters RAan
43、d RB, then they should have a minimum size of 384 bits (assuming 128-bit session keys are used) as also required in TIA 683-D. The independent random functions H1and H2should have output 1152 bits each, assuming prime p is 1024 bits long and session keys K are 128 bits long. The random functions H3,
44、 H4, and H5should have output 128 bits. EXAMPLE: The use of the b-FIPS 180-2 SHA-1 hashing function could be recommended for instantiation of the random functions Hi() as described in b-TIA 1050. However, it should be noted that NIST is encouraging the use of SHA-256 as a more secure alternative to
45、SHA-1. 4 ITU-T Rec. X.1035 (02/2007) Bibliography b-TIA 1050 TIA 1050-100, Project Number 3-0174-000, Wireless Local Area Network (WLAN) Interworking. b-FIPS 180-2 NIST Federal Information Processing Standards, Publication FIPS 180-2 (2002), Secure Hash Standard. b-EUROCRYPT BOYKO (V.), MACKENZIE (P
46、.), PATEL (S.): Provably Secure Password-Authenticated Key Exchange Using Diffie-Hellman, EUROCRYPT 2000. b-IEEE P1363.2 IEEE P1363.2 (Sept. 2006), Standard Specifications for Password-Based Public-Key Cryptographic Techniques. Printed in Switzerland Geneva, 2007 SERIES OF ITU-T RECOMMENDATIONS Seri
47、es A Organization of the work of ITU-T Series D General tariff principles Series E Overall network operation, telephone service, service operation and human factors Series F Non-telephone telecommunication services Series G Transmission systems and media, digital systems and networks Series H Audiov
48、isual and multimedia systems Series I Integrated services digital network Series J Cable networks and transmission of television, sound programme and other multimedia signals Series K Protection against interference Series L Construction, installation and protection of cables and other elements of o
49、utside plant Series M Telecommunication management, including TMN and network maintenance Series N Maintenance: international sound programme and television transmission circuits Series O Specifications of measuring equipment Series P Telephone transmission quality, telephone installations, local line networks Series Q Switching and signalling Series R Telegraph transmission Series S Telegraph services termin
