An Enhanced Efficient Password-Authenticated Key Exchange Protocol for the Internet of Things

The symmetric Password-Authenticated Key Exchange (PAKE) protocol enables two parties sharing a low-entropy password to establish a high-entropy session key, offering advantages in simplicity and efficiency. This makes it particularly suitable for Internet of Things (IoT) devices with limited computational resources, positioning it as one of the most effective security methods for authentication and key exchange in IoT environments. In this paper, we analyze a recently proposed efficient symmetric PAKE protocol for IoT, identifying its vulnerability to offline dictionary attacks and its failure to meet the claimed security goals. Building upon the analysis of these design flaws, we present an enhanced protocol, demonstrating its security within the random oracle model. The enhanced protocol retains the protocol flow and computational operations of the original protocol to the greatest extent possible, maintains nearly the same computational efficiency, and simultaneously addresses the vulnerabilities that made the original protocol susceptible to offline dictionary attacks.