Zero-knowledge password proof

In cryptography, a zero-knowledge password proof (ZKPP) is an interactive method for one party (the prover) to prove to another party (the verifier) that it knows a value of a password, without revealing anything other than the fact that it knows that password to the verifier. The term is defined in IEEE P1363.2, in reference to one of the benefits of using a password-authenticated key exchange (PAKE) protocol that is secure against off-line dictionary attacks. A ZKPP prevents any party from verifying guesses for the password without interacting with a party that knows it and, in the optimal case, provides exactly one guess in each interaction.

Technically speaking, a ZKPP is different from a zero-knowledge proof. This is because a ZKPP is defined more narrowly than the more general zero-knowledge proof. ZKPP is defined in IEEE 1363.2 as "An interactive zero knowledge proof of knowledge of password-derived data shared between a prover and the corresponding verifier." Notice, that the definition is concerned further with password-derived data.

A common use of a zero-knowledge password proof is in authentication systems where one party wants to prove its identity to a second party using a password but doesn't want the second party or anybody else to learn anything about the password.

History

The first methods to demonstrate a ZKPP were the encrypted key exchange methods (EKE) described by Steven M. Bellovin and Michael Merritt in 1992.[1] A considerable number of refinements, alternatives, and variations in the growing class of password-authenticated key agreement methods were developed in subsequent years. Standards for these methods include IETF RFC 2945, IEEE P1363.2, and ISO-IEC 11770-4.[2]

gollark: The WHY-10000 is finally complete and fully running. It's a self-contained 3-reactor system generating more than 300kRF/t (max).
gollark: Active cooling... kind of working, maybe.
gollark: D-D#2 electromagnets online, time to activate it.
gollark: Wait, does it cost clay?
gollark: Look upon the balance.

See also

References
  1. Bellovin 1992
  2. IEEE P1363.2: Proposed Standard for Password-Based Public-Key Cryptography
  • Bellovin, S. M.; Merritt, M. (May 1992). "Encrypted Key Exchange: Password-Based Protocols Secure Against Dictionary Attacks" (PDF). Proceedings of the IEEE Symposium on Research in Security and Privacy. Oakland.
  • "IEEE P1363.2: Proposed Standard for Password-Based Public-Key Cryptography". IEEE.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.