Intrusion-Tolerant Password-Enabled PKI

Password-enabled PKI facilitates the private key management by integrating easy-to-use passwords into PKI. In the first PKI research workshop, Sandhu et al. categorized password-enabled PKI schemes as virtual soft tokens and virtual smartcards [26]. Compared to the conventional PKI, password-enabled PKI introduces a security-critical server where large number of password-related credentials are stored. The compromise of this server will render these password-based credentials susceptible to the dictionary attack and, thus, damage the security of numerous private keys. In this article, using multiple servers, we propose an intrusiontolerant virtual soft token scheme and an intrusiontolerant virtual smartcard scheme. In our schemes, compromising up to a threshold number of these servers will not help an attacker mount a dictionary attack and, compared to previous work, our schemes can still function in the presence of some server failures. The multiple servers introduced in our intrusion-tolerant password-enabled PKI can be easily managed and PKI users can roam with human memorable passwords.