PhD Project in Precomputation Attack Resilient Password based Authentication System Design

Resiliency and Survivability at the face of real world cyber attack are in high demand as customers are demanding system designs that assure continued safety and functionality during and after systems are compromised by cyber attacks. In the context of password based authentication systems, resiliency and survivability at the face of server compromise is a big challenge and no existing scheme can withstand the damage once the server is compromised. The project investigate password authenticated key exchange (PAKE) mechanism of authentication and provide commercially viable solution that can withstand the attack followed by server compromise so as to uphold resiliency and survivability.

In password authenticated key exchange (PAKE), two parties, user and server, can establish an authenticated high entropy cryptographic key between them starting from a shared low entropy password pw. This is known as symmetric PAKE or simply PAKE. On server compromise, the adversary gets the access of user’s password that is saved in the server in no time. As opposed to this, in asymmetric PAKE (aPAKE) user saves the password pw while the server saves a mapping of the password, say rw, with a security goal of not losing the password information pw to the adversarial hand immediately from the saved information rw even after the server compromise, i.e., at the face of server compromise, the aim is to push the adversary to the edge of undergoing at least a dictionary size computation to retrieve pw from rw irrespective of any precomputation. This is known as security against precomputation attack. Unfortunately, no commercially aPAKE scheme were available in the literature to withstand precomputation attack. The only theoretical solution till date for this problem was proposed at Eurocrypt 2018 which is known as OPAQUE.

Despite the theoretical success of OPAQUE, there are few reasons that hinder its commercial adaptability. OPAQUE uses hash-to-curve to map the password to an elliptic curve point. Since there is no known cryptographically strong hash-to-curve is available on more secure elliptic curves, a good design criterion would be to avoid hash-to-curve. This project investigates to understand the underlying issues and settle that by proposing commercially viable solution which is free from hash-to-curve at the same time precomputation attack safe and efficient.

Funding Information

To be eligible for consideration for a Home DfE or EPSRC Studentship (covering tuition fees and maintenance stipend of approx. £19,237 per annum), a candidate must satisfy all the eligibility criteria based on nationality, residency and academic qualifications.

To be classed as a Home student, candidates must meet the following criteria and the associated residency requirements:

• Be a UK National,
or • Have settled status,
or • Have pre-settled status,
or • Have indefinite leave to remain or enter the UK.

Candidates from ROI may also qualify for Home student funding.

Previous PhD study MAY make you ineligible to be considered for funding.

Please note that other terms and conditions also apply.

Please note that any available PhD studentships will be allocated on a competitive basis across a number of projects currently being advertised by the School.

A small number of international awards will be available for allocation across the School. An international award is not guaranteed to be available for this project, and competition across the School for these awards will be highly competitive.

Academic Requirements:

The minimum academic requirement for admission is normally an Upper Second Class Honours degree from a UK or ROI Higher Education provider in a relevant discipline, or an equivalent qualification acceptable to the University.