Event Details

LIRA Invited Seminar - Prof. Feng Hao: An overview of password-authenticated key exchange protocols

Speaker: Prof. Feng Hao (University of Warwick, UK)

Title: An overview of password-authenticated key exchange protocols

Abstract: Password-authenticated key exchange (PAKE) is an interesting example that shows the magic of mathematics. It allows two remote users to establish a "high-entropy" key from a "low-entropy" shared secret without involving any trusted third party. Following Bellovin and Merrit's 1992 Encrypted Key Exchange (EKE), many PAKE protocols have been proposed in the next 30 years. Today, some have been adopted in large-scale applications, e.g., secure messenger, Wi-Fi, iCloud, browser sync and Thread. On the other hand, designing a robust PAKE protocol has proved extremely delicate and error-prone. In this talk, I will provide a review of the three decades research in this field, a summary of the state-of-the-art, and a taxonomy to categorize existing protocols. I will also provide a comparative analysis of protocol performance, using representative examples from taxonomy categories

Brief bio: Feng Hao is a Professor of Security Engineering at the Department of Computer Science, University of Warwick. He received his PhD in 2007 in Computer Science from the University of Cambridge. He worked in the security industry for a few years before joining academia. With colleagues, he designed a few cryptographic protocols: AV-net, OV-net, J-PAKE, YAK, DRE-i, DRE-ip and SEAL. Among them, J-PAKE (with Peter Ryan) has been adopted by the Thread Group as a de facto standard to perform the IoT commissioning process (used in Google Nest, ARM mbed, NXP, D-Link, Qualcomm, Samsung, and Texas Instruments etc) and standardized in ISO/IEC 11770-4. DRE-ip (with Siamak Shahandashti) was successfully trialled in Gateshead during the UK local elections on 2 May 2019. His 2006 paper (with Ross Anderson and John Daugman) on "combining crypto with biometrics effectively" (IEEE Trans. Computers) is ranked the top in Google Classic papers in the category of "cryptography & computer security". His work on "self-enforcing e-voting" has led to a €1.5m ERC starting grant and an ERC proof-of-concept grant. With Peter Ryan, he co-edited a book "Real-World Electronic Voting: Design, Analysis and Deployment" (CRC Press, 2017)

Join: Via MS Teams