KR20180003293A - Method for asymmetric password-based authenticated key exchange - Google Patents

Abstract

An asymmetric password-based authenticated key exchange method according to an embodiment of the present invention comprises: a step in which a client registers a password file including a public key, a first hash key generated by using a password, and a secret key encrypted by using the password, in a server; a step in which each of the client and the server generates a common key by using the first hash key; a step in which the server generates a second hash key by using the public key, and generates random number information; a step in which the server encrypts the random number information by using the public key; a step in which the server encrypts the encrypted secret key and the encrypted random number information by using the second hash key to generate encryption information, and transmits the encryption information to the client; a step in which the client generates the second hash key by using the common key; and a step in which the client decrypts the encryption information by using the second hash key, decrypts the encrypted secret key by using the password, and decrypts the encrypted random number information by using the secret key.

Description

[0001] METHOD FOR ASYMMETRIC PASSWORD-BASED AUTHENTICATED KEY EXCHANGE [0002]

The present invention relates to an asymmetric password-based authenticated key agreement method.

The Password-Based Authenticated Key Exchange (PAKE) protocol is one of the representative authenticated key agreement protocols in the client-server model. Currently, various PAKE protocols are published as international standards in ISO / IEC 11770-4 and IEEE P.1363.

Depending on how passwords are shared, PAKE is divided into symmetric and asymmetric forms. In the symmetric PAKE, the same password information is shared and used by the participants as authentication means. In the client-server model, the server stores a large number of clients' passwords. Therefore, it is very vulnerable to compromise of the server. In contrast, in an asymmetric PAKE, the server stores the one-way function value of the password that is referred to as the password file. Therefore, even if the server is compromised, the attacker must apply a separate offline dictionary attack to each user, which requires high attack complexity and has high robustness against password leakage.

In principle, asymmetric PAKE requires a complicated configuration including proof of password ownership, which makes it difficult to design an efficient and secure method. Asymmetric PAKEs that have been known to date to be as secure as they are, are only a matter of using digital signatures published by Crypto'06 by Gentry, MacKenzie and Ramzan (GMR). This technique involves relatively expensive computation costs for digital signatures and requires at least three rounds of communication overhead. The third round has been regarded as the minimum bound of a communication round that is hard to overcome to date.

It is an object of the present invention to provide an asymmetric password-based authenticated key agreement method with communication round-off efficiency.

The technical problems of the present invention are not limited to the above-mentioned technical problems, and other technical problems which are not mentioned can be understood by those skilled in the art from the following description.

The asymmetric password-based key agreement method according to an embodiment of the present invention is a method in which a client transmits a password file including a public key, a first hash key generated using a password, and a secret key encrypted using the password to a server Registering, generating a common key using the first hash key by the client and the server, generating a second hash key using the common key, and generating random number information, The server encrypts the random number information using the public key, the server encrypts the encrypted secret key and the encrypted random number information using a second hash key to generate encryption information, Transmitting the first hash key to the client, generating the second hash key using the common key, And the client decrypts the encrypted information using the second hash key, decrypts the encrypted secret key using the password, and decrypts the encrypted random number information using the secret key.

In one embodiment, the step of the client registering a password file including a public key, a first hash key generated using a password, and a secret key encrypted using the password on the server includes: To the server.

In one embodiment, the client registers with the server a password file including the public key, a first hash key generated using a password, and a secret key encrypted using the password, The step of generating a common key using the first hash key, respectively, may constitute at least a part of a symmetric password-based key agreement protocol.

In one embodiment, the client further includes generating the public key and the secret key, wherein the client generates the public key and the secret key by using the public key and the password A password file including the generated first hash key and the secret key encrypted using the password may be registered in the server.

The asymmetric password-based key agreement method according to an embodiment of the present invention is a method in which a client transmits a password file including a public key, a first hash key generated using a password, and a secret key encrypted using the password to a server The client generating a common key using the first hash key, the client encrypting the encrypted secret key and the encrypted random number information from the server using a second hash key, The client generating the second hash key using the common key, and the client decrypting the encryption information using the second hash key, Decrypts the encrypted secret key, and decrypts the encrypted random number information using the secret key There.

The asymmetric password-based key agreement method according to an embodiment of the present invention is a method in which a server obtains a password file including a public key, a first hash key generated using a password, and a secret key encrypted using the password The server generates a common key using the first hash key, the server generates a second hash key using the common key, and generates random number information, Encrypting the encrypted random number information and the encrypted random number information using a second hash key to generate encryption information, and transmitting the encryption information to the client As shown in FIG.

The asymmetric password-based key agreement method according to an embodiment of the present invention is a method in which a client transmits a password file including a public key, a first hash key generated using a password, and a secret key encrypted using the password to a server Wherein the client and the server generate a first common key using the first hash key, the server generates the second hash key using the first public key, Generating a second common key and a public key encapsulated cipher text using the second hash key, the server encrypting the encrypted private key and the public key encapsulated cipher text using a second hash key to generate cipher information, Communicating to the client, the client generating the second hash key using the first common key, To the client using the second hash key, decrypting the password information, and can decode the encrypted secret key using the password, and using the secret key to decrypt the public key encrypted text encapsulated.

In one embodiment, the step of the client registering a password file including a public key, a first hash key generated using a password, and a secret key encrypted using the password on the server includes: To the server.

In one embodiment, the client registers with the server a password file including a public key, a first hash key generated using a password, and a secret key encrypted using the password, The step of generating the first common key using the first hash key may constitute at least a part of a symmetric password-based key agreement protocol.

In one embodiment, the client further comprises generating the public key and the secret key, wherein the client generates the public key and the secret key by using the public key and the password to generate The password file including the first hash key and the secret key encrypted using the password may be registered in the server.

The asymmetric password-based authenticated key agreement method according to an embodiment of the present invention can secure communication round-up efficiency and improve network availability.

FIG. 1 is a block diagram illustrating a client and a server performing an asymmetric password-based authenticated key agreement method according to an embodiment of the present invention.
FIG. 2 illustrates an asymmetric password-based authenticated key agreement method according to a first embodiment of the present invention.
FIG. 3 is a diagram for explaining a concrete procedure of an asymmetric password-based authenticated key agreement method according to the first embodiment of the present invention.
FIG. 4 illustrates an asymmetric password-based authenticated key agreement method according to a second embodiment of the present invention.
FIG. 5 is a diagram for explaining a specific procedure of an asymmetric password-based authenticated key agreement method according to a second embodiment of the present invention.
FIG. 6 illustrates an asymmetric password-based authenticated key agreement method according to a third embodiment of the present invention.
7 is a block diagram illustrating a computing system that implements an asymmetric password-based authenticated key agreement method in accordance with an embodiment of the present invention.

Hereinafter, some embodiments of the present invention will be described in detail with reference to exemplary drawings. It should be noted that, in adding reference numerals to the constituent elements of the drawings, the same constituent elements are denoted by the same reference symbols as possible even if they are shown in different drawings. In the following description of the embodiments of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the difference that the embodiments of the present invention are not conclusive.

In describing the components of the embodiment of the present invention, terms such as first, second, A, B, (a), and (b) may be used. These terms are intended to distinguish the constituent elements from other constituent elements, and the terms do not limit the nature, order or order of the constituent elements. Also, unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the relevant art and are to be interpreted in an ideal or overly formal sense unless explicitly defined in the present application Do not.

FIG. 1 is a block diagram illustrating a client and a server performing an asymmetric password-based authenticated key agreement method according to an embodiment of the present invention.

Referring to FIG. 1, the client 100 and the server 200 may be user devices executing an asymmetric password-based authenticated key agreement method according to an embodiment of the present invention. The client 100 and the server 200 may be service providers or service consumers. The client 100 and the server 200 may include at least one module (not shown) executing an algorithm or protocol that outputs a particular value for a given input value.

The client 100 and the server 200 may perform a public key encryption method and a public key encapsulation method using an arbitrary Password-based Authenticated Key Exchange (PAKE) protocol To perform an asymmetric password-based authenticated key agreement method according to an embodiment of the present invention. For example, any PAKE protocol may be any of the standard PAKE protocols defined in ISO / IEC 11770-4 and IEEE P.1363.

Hereinafter, an asymmetric password-based authenticated key agreement method according to a first embodiment of the present invention in which a public key encryption method is applied to an arbitrary PAKE protocol will be described in detail with reference to FIG. 2 and FIG. 3, and a public key encapsulation method An asymmetric password-based authenticated key agreement method applied to an arbitrary PAKE protocol according to a second embodiment of the present invention will be described in detail with reference to FIGS. 4 and 5. FIG.

FIG. 2 illustrates an asymmetric password-based authenticated key agreement method according to a first embodiment of the present invention. FIG. 3 is a diagram for explaining a concrete procedure of an asymmetric password-based authenticated key agreement method according to the first embodiment of the present invention.

In this embodiment, a hash function H: {0,1} ^* → {0,1} ^l and / or H ': {0,1} ^* → {0,1} ^l having cryptographically strong robustness can be used But the present invention is not limited thereto. The hash function can be understood as a function for converting an arbitrary bit string into a fixed L-bit string.

Also, in this embodiment, an authenticated encryption algorithm, which provides the confidentiality and integrity of data such as the ISO / IEC 19772 standard algorithms for the encryption algorithm E ': {0,1} ^l → {0,1} ^l , algorithm may be used but is not limited thereto.

Referring to FIGS. 2 and 3, the client 100 may register a password file in the server 200 (S110). The password file includes a first hash key H (π) generated using the public key pk of the client 100, the password π of the client 100, a password π of the client 100 (E ' _? (Dk)).

To this end, it is assumed that the client 100 can select and input a password according to a predetermined policy from the user in advance, and that the password? Of the client 100 is registered in the server 200 in advance. Also, the client 100 can generate the public key pk and the secret key dk according to the public key encryption method, generate the first hash key H (?) Using the password, π) to generate an encrypted secret key E ' _π (dk) by encrypting the secret key dk.

The client 100 can maintain the security by transmitting the password file to the server 200 using a separate secure channel.

The client 100 may generate the common key K using the first hash key H (?) (S120).

The server 200 can generate the common key K using the first hash key H (?) Included in the password file (S130).

That is, the client 100 and the server 200 can generate the common key K through steps S120 and S130, and these processes can be understood to constitute at least a part of the symmetric PAKE protocol.

Next, the server 200 can generate the second hash key K ₁ using the common key K and generate the random number information RN (S 140). Specifically, the server 200 can generate a hash function value of the common key K (K ₁ = H (K∥1)), and the generated hash function value is defined as a second hash key K ₁ . In addition, server 200 may generate the random number information (RN ∈ {0, 1} ^l).

The server 200 can encrypt the random number information RN using the public key pk (S150). For example, the server 200 may encrypt the random number information using the PKE.Enc public key encryption algorithm.

The server 200 encrypts the encrypted secret key E ' _? (Dk) and the encrypted random number information PKE.Enc _pk (RN) using the second hash key K ₁ to generate the encrypted information c, (C _? E _K1 (E ' _? (Dk) _? PKE.Enc _pk (RN)), S160).

Here, encryption algorithm ^{E: {0,1} l → {} 0,1} l AES (ISO / IEC 18033-3 standard algorithm) and the SEED (ISO / IEC 18033-3 standard algorithm) to the, or the like of data confidentiality But not limited to, a symmetric encryption algorithm.

The server 200 may transmit the generated encryption information c to the client 100 (S170).

The client 100 may generate the second hash key K ₁ using the common key K (S180). Specifically, the server 200 may generate a hash function value of the common key K (K ₁ = H (K∥1)).

The client 100 decrypts the encryption information c using the second hash key K ₁ (d ₁ ∥d ₂ ← D _K1 (c), where d ₁ is E ' _π (dk), d ₂ represents a PKE.Enc _pk (RN)), the encrypted secret key (E 'to _π (dk)) password (decryption using the π) and _{(dk ← d' π (d} 1)), the encrypted random number (RN ← PKE.Dec _dk (d ₂ )) random number information RN by decrypting the information (PKE.Enc _pk (RN)) using the secret key (dk) (S190).

The client 100 and the server 200 may generate a session key ssk (S200 and S210). The client 100 can generate the session key ssk using the common key K, the random number information RN and the hash function value of the symmetric PAKE and the record information of the symmetric PAKE (csk = s (K∥RN∥Trans)). Here, the recording information of the symmetric PAKE may mean a set of messages publicly exchanged between the client 100 and the server 200 during the PAKE to share the session key (ssk). Trans can also mean concatenation of the symmetric PAKE's record information and cryptographic information (c).

The client 100 and the server 200 transmit the round 1 (i.e., the round 1 until the generation of the common key K and the subsequent cryptographic information c), and the second round The second round of the decryption process), and the asymmetric password-based key agreement method can be performed. In the GMR (Gentry, MacKenzie, Ramzan) technique that uses the existing electronic signature to prove ownership of the password, the client needs to generate three rounds since it is based on a mechanism for verifying the signature after the signature is generated. It is possible to perform the authentication of possession of the password in two rounds and the method of authenticating the key based on the asymmetric password, thereby increasing the availability of the entire network and reducing the cost.

FIG. 4 illustrates an asymmetric password-based authenticated key agreement method according to a second embodiment of the present invention. FIG. 5 is a diagram for explaining a specific procedure of an asymmetric password-based authenticated key agreement method according to a second embodiment of the present invention.

4 and 5, the client 100 may register a password file in the server 200 (S210). The password file includes a first hash key H (π) generated using the public key pk of the client 100, the password π of the client 100, a password π of the client 100 And may include an encrypted secret key E ' _pi (sk).

To this end, it is assumed that the client 100 can select and input a password according to a predetermined policy from the user in advance, and that the password? Of the client 100 is registered in the server 200 in advance. Also, the client 100 can generate the public key pk and the secret key sk according to the public key encryption method, generate the first hash key H (?) Using the password, π) to generate an encrypted secret key E ' _π (sk) by encrypting the secret key sk.

The client 100 can maintain the security by transmitting the password file to the server 200 using a separate secure channel.

The client 100 may generate the first common key K using the first hash key H (?) (S220).

The server 200 may generate the first common key K using the first hash key H (?) Included in the password file (S230).

That is, the client 100 and the server 200 can generate the first common key K through steps S220 and S230, and these processes can be understood to constitute at least a part of the symmetric PAKE protocol.

Next, the server 200 generates the second hash key K ₁ using the first common key K, and transmits the second public key K 'and the public key encapsulation A cipher text C 'can be generated (S240). Specifically, the server 200 may generate a hash function value of the first common key K (K ₁ = H (K∥1)), and the generated hash function value may be a second hash key K ₁ . ≪ / RTI > The server 200 performs the public key encapsulation cryptographic operation process using the public key pk to generate the second common key K 'and the second public key K' using the public key pk ((K ', C') ← KEM.Enc (1 ^k , pk) To generate a public key encapsulated cipher text (C '). The KEM.Enc (1 ^k , pk) is an algorithm for generating a second common key K 'and a public key encapsulated ciphertext C' by taking a security parameter (k) and a public key pk as inputs . ≪ / RTI >

The server 200 can generate the encrypted information c by encrypting the encrypted secret key E ' _π (sk) and the public key encapsulated cipher text C' using the second hash key K ₁ (c _? E _K1 (E ' _? (sk) _? C'), S250).

The server 200 may transmit the generated password information c to the client 100 (S260).

The client 100 may generate the second hash key K ₁ using the first common key K (S270). Specifically, the server 200 may generate a hash function value of the first common key K (K ₁ = H (K∥1)).

The client 100 decrypts the encryption information c using the second hash key K ₁ (d ₁ ∥d ₂ ← D _K1 (c), where d ₁ is E ' _π (sk), d ₂ 'represents a), the encrypted secret key (E' C to _π (sk)), the password (using the π) decoding and (sk ← D _'π (d _1)), a secret key (sk) and a public key The second common key K 'may be obtained using the encapsulated cipher text C' (S280). For example, the process of acquiring the second common key K 'using the secret key sk and the public key encapsulated cipher text C' may be performed by using the secret key sk to generate the public key encapsulated ciphertext C ' As shown in FIG.

The client 100 and the server 200 may generate the session key ssk (S290 and S300). The client 100 can generate the session key ssk using the first common key K, the second common key K ', and the hash function value of the symmetric PAKE record information and the cryptographic information c (Ssk = H (K∥RN∥Trans)). Here, the recording information of the symmetric PAKE may mean a set of messages publicly exchanged between the client 100 and the server 200 during the PAKE to share the session key (ssk). Trans can also mean concatenation of the symmetric PAKE's record information and cryptographic information (c).

The client 100 and the server 200 generate the round 1 (i.e., the round 1 and the subsequent cryptographic information c until the first common key K is generated) based on the steps S210 to S300, Transferring and decrypting process), and the asymmetric password-based key agreement method can be performed. In the GMR (Gentry, MacKenzie, Ramzan) technique that uses the existing electronic signature to prove ownership of the password, the client needs to generate three rounds since it is based on a mechanism for verifying the signature after the signature is generated. It is possible to perform the authentication of possession of the password in two rounds and the method of authenticating the key based on the asymmetric password, thereby increasing the availability of the entire network and reducing the cost.

FIG. 6 shows a method of an asymmetric password-based key agreement according to a third embodiment of the present invention.

FIG. 6 illustrates an asymmetric password-based key agreement method combining the known PAKE protocol PAK (ITU-T X.1035) and the ElGamal Encryption public key encapsulation encryption scheme (KEM). In Fig. 6, discrete logarithm parameters G, q, g, h are assumed to be defined in advance. Here, G represents an algebraic group whose prime number is a prime q, and g and h can be defined as arbitrary generating sources of the group G. Also, Z _q is the set {0, 1, ... , q-1}.

Referring to FIG. 6, the client 100 may register a password file in the server 200. The password file includes a first hash key H (π) generated using the public key g ^z of the client 100 and the password π of the client 100, a password π of the client 100, and it may include a secret key (E _'π (z)) by using the encryption.

To this end, it is assumed that the client 100 can select and input a password according to a predetermined policy from the user in advance, and that the password? Of the client 100 is registered in the server 200 in advance. The client 100 may also generate the public key g ^z and the secret key z and generate a first hash key H (π) using the password and use the password π It is possible to encrypt the secret key z to generate an encrypted secret key E ' _? (Z). The client 100 can maintain the security by transmitting the password file to the server 200 using a separate secure channel.

The client 100 may generate a first public key g ^x by selecting any value x in the set Z _q . The client 100 can generate the intermediate value h ^{H (?)} Using the generation source h and the first hash key H (?). The client 100 may generate the first cipher value c ₁ by computing the first public key g ^x and the intermediate value h ^{H (π)} (c ₁ ← g ^x · h ^{H (?)} ). The client 100 may transmit the generated first cipher value c ₁ to the server 200.

The server 200 may obtain the first encrypted value (c ₁₎ and the intermediate value (h ^{H (π)),} the first public key (g ^x) using the (g ^x ← c ₁ · h ^{-H (π)} ). The server 200 may generate a second public key g ^y by selecting an arbitrary value y in the set Z _q . Server 200 includes a first public key (g ^x) and using a random value (y) may generate a first common key (K) (K ← g ^xy). The server 200 can generate a hash function value of the first common key K (K ₁ = H (K∥1)) and the generated hash function value is defined as a second hash key K ₁ . The server 200 may generate the second common key K '(K' ← g ^yz ) using the public key g ^z and the arbitrary value y. The server 200 may generate the second cipher value c ₂ by computing the second public key g ^y and the intermediate value h ^{H (π)} (c ₂ ← g ^{y ·} h ^{H (π )} ). The server 200 may generate the cryptographic information c by encrypting the encrypted secret key E ' _π (z) using the second hash key K ₁ (c ← E _K1 (E' _π (z)). The server 200 can transmit the generated encryption information (c) and the second encryption value (c ₂ ) to the client 100.

The client 100 may obtain a second encrypted value (c ₂₎ and median (h ^{H (π))} the second public key (g ^y) using (g ^y ← c ₂ · h ^{-H (π)} ). The client 100 may generate the first common key K (K ← g ^xy ) using the second public key g ^y and any value x. The client 100 may generate a hash function value of the first common key K (K ₁ = H (K∥1)) and the generated hash function value may be defined as a second hash key K ₁ . The client 100 decrypts the cipher information c using the second hash key K ₁ to obtain the encrypted secret key E ' _? (Z), and the encrypted secret key E' _? (Z ) Can be decrypted using the password? To obtain the secret key z. The client 100 may generate the second common key K '(K' ← g ^yz ) using the second public key g ^y and the secret key z.

The client 100 and the server 200 may generate the session key ssk. The client 100 can generate the session key ssk using the first common key K, the second common key K ', and the hash function value of the symmetric PAKE record information and the cryptographic information c (Ssk = H (K∥K'∥Trans)). Here, the recording information of the symmetric PAKE may mean the concatenation of the first cipher value c ₁ and the second cipher value c ₂ . Also, Trans may mean concatenation of the first cipher value c1, the second cipher value c2, and the cipher information c.

Through the above-described processes, the client 100 and the server 200 can transmit the cryptographic information c for the first round and the subsequent cryptographic information (c) until two rounds (i.e., the generation of the common key K) ), And can perform an asymmetric password-based authenticated key agreement method.

7 is a block diagram illustrating a computing system that implements an asymmetric password-based key agreement method in accordance with an embodiment of the present invention.

7, a computing system 1000 includes at least one processor 1100, a memory 1300, a user interface input device 1400, a user interface output device 1500, Storage 1600, and a network interface 1700. [

The processor 1100 may be a central processing unit (CPU) or a memory device 1300 and / or a semiconductor device that performs processing for instructions stored in the storage 1600. Memory 1300 and storage 1600 may include various types of volatile or non-volatile storage media. For example, the memory 1300 may include a ROM (Read Only Memory) and a RAM (Random Access Memory).

Thus, the steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by processor 1100, or in a combination of the two. The software module may reside in a storage medium (i.e., memory 1300 and / or storage 1600) such as a RAM memory, a flash memory, a ROM memory, an EPROM memory, an EEPROM memory, a register, a hard disk, a removable disk, You may. An exemplary storage medium is coupled to the processor 1100, which can read information from, and write information to, the storage medium. Alternatively, the storage medium may be integral to the processor 1100. [ The processor and the storage medium may reside within an application specific integrated circuit (ASIC). The ASIC may reside within the user terminal. Alternatively, the processor and the storage medium may reside as discrete components in a user terminal.

The foregoing description is merely illustrative of the technical idea of the present invention, and various changes and modifications may be made by those skilled in the art without departing from the essential characteristics of the present invention.

Therefore, the embodiments disclosed in the present invention are intended to illustrate rather than limit the scope of the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The scope of protection of the present invention should be construed according to the following claims, and all technical ideas within the scope of equivalents should be construed as falling within the scope of the present invention.

100: Client
200: Server
1000: Computing System
1100: Processor
1200: System bus
1300: Memory
1310: ROM
1320: RAM
1400: User interface input device
1500: User interface output device
1600: Storage
1700: Network interface

Claims (10)

Registering, in a server, a password file including a public key, a first hash key generated using a password, and a secret key encrypted using the password;
The client and the server each generating the common key using the first hash key;
Generating, by the server, a second hash key using the common key, and generating random number information;
Encrypting the random number information using the public key by the server;
The server encrypting the encrypted secret key and the encrypted random number information using a second hash key to generate encryption information, and transmitting the encryption information to the client;
The client generating the second hash key using the common key; And
The client decrypts the encrypted information using the second hash key, decrypts the encrypted secret key using the password, and decrypts the encrypted random number information using the secret key. Key agreement method. The method according to claim 1,
The step of the client registering the password file including the public key, the first hash key generated using the password, and the secret key encrypted using the password to the server includes transmitting the password file to the server through the secure channel Wherein the asymmetric password-based key agreement method is as follows. The method according to claim 1,
Registering in the server a password file including the public key, a first hash key generated using a password, and a secret key encrypted using the password; And
Wherein the step of the client and the server generating the common key using the first hash key each comprise at least a part of a symmetric password based key agreement protocol. The method according to claim 1,
Further comprising the client generating the public key and the private key,
The client generates the public key and the secret key by using a password file including the public key, the first hash key generated using the password, and the secret key encrypted using the password, Wherein the authentication is performed prior to the registering step. Registering, in a server, a password file including a public key, a first hash key generated using a password, and a secret key encrypted using the password;
The client generating a common key using the first hash key;
Receiving, by the client, encrypted information obtained by encrypting the encrypted secret key and the encrypted random number information from the server using a second hash key;
The client generating the second hash key using the common key; And
The client decrypts the encrypted information using the second hash key, decrypts the encrypted secret key using the password, and decrypts the encrypted random number information using the secret key. Key agreement method. The server receiving a password file including a public key from a client, a first hash key generated using a password, and a secret key encrypted using the password;
The server generating a common key using the first hash key;
Generating, by the server, a second hash key using the common key, and generating random number information;
Encrypting the random number information using the public key by the server; And
The server encrypting the encrypted secret key and the encrypted random number information using a second hash key to generate encryption information and communicating the encryption information to the client, wherein the asymmetric password based authenticated key agreement Way. Registering, in a server, a password file including a public key, a first hash key generated using a password, and a secret key encrypted using the password;
The client and the server each generating the first common key using the first hash key;
The server generating the second hash key using the first public key and generating the second public key and the public key encapsulated ciphertext using the public key;
The server encrypts the encrypted private key and the public key encapsulated ciphertext using a second hash key to generate cryptographic information, and transmitting the cryptographic information to the client;
The client generating the second hash key using the first common key; And
The client decrypts the cryptographic information using the second hash key, decrypts the encrypted secret key using the password, and decrypts the public key encapsulated ciphertext using the secret key using an asymmetric password-based authentication Key agreement method. 8. The method of claim 7,
The step of the client registering the password file including the public key, the first hash key generated using the password, and the secret key encrypted using the password to the server includes transmitting the password file to the server through the secure channel Wherein the asymmetric password-based key agreement method is as follows. 8. The method of claim 7,
Registering in the server a password file including the public key, the first hash key generated using the password, and the secret key encrypted using the password; And
Wherein the step of the client and the server generating the first common key using the first hash key each comprise at least a part of a symmetric password based key agreement protocol. 8. The method of claim 7,
Further comprising the client generating the public key and the private key,
The client generates the public key and the secret key by registering the password file including the public key, the first hash key generated using the password, and the secret key encrypted using the password in the server Wherein the authentication is performed prior to the step of authenticating the key.

Images