Undetectable On{line Password Guessing Attacks Undetectable On-line Password Guessing Attacks

Limited distribution notes: This report has been issued as a Research Report for early dissemination of its contents. In view of the transfer of copyright to the outside publisher its distribution outside the University of Technology Chemnitz-Zwickau prior to publication should be limited to peer communications and speciic requests. After outside publication, requests should be lled only by reprints or legally obtained copies of the article. Abstract Several 3{party{based authentication protocols have been proposed, which are resistant to oo{line password guessing attacks. We show that they are not resistant to a new type of attack called \undetectable on{line password guessing attack". The authentication server is not able to notice this kind of attack from the clients' (attacker's) requests, because they don't include enough information about the clients (or attacker). Either freshness or authenticity of these requests is not guaranteed. Thus the authentication server responses and leaks veriiable information for an attacker to verify his guess.