Methods and Systems for Improving the Security of Password-Based Authentication Protocols for IEEE 802.11 Networks

A method performed by a processor implemented by software, firmware, hardware, or a combination thereof, the method comprising:

• generating a password element for a station running a password authenticated key exchange protocol using an Elliptic Curve Cryptography (ECC) group, the ECC group selected to have an order that is a prime and a cofactor that is equal to one;
• generating a temporary secret value;
• generating a commit-element parameter using the temporary secret value and modified password element;
• generating a commit-scalar parameter;
• and
• creating a commit message comprising the commit-scalar parameter and the commit-element parameter.

A device running a password authenticated key exchange protocol using an Elliptic Curve Cryptography (ECC) group, comprising:

• a circuit for sending signals to and receiving signals from another device;
• a memory for storing commit-scalar and commit-element parameters and other data;
• and
• a processor adapted to perform operations on the signals sent to or received from the other device, the processor operating to:
• generate a password element using the ECC group with a cofactor that is greater than one;
• multiply the password element by a cofactor to generate a modified password element;
• verify that the modified password element is not equal to a point at infinity, O, for the ECC group;
• generate a temporary secret value;
• generate the commit-element parameter using the temporary secret value and the modified password element;
• and
• create a commit message comprising the commit-scalar parameter and the commit-element parameter.

A device running a password authenticated key exchange protocol using a Finite Field Cryptography (FFC) group, comprising:

• a circuit for sending signals to and receiving signals from another device;
• a memory for storing password element and other parameters;
• and
• a processor adapted to perform operations on the signals sent to or received from the other device, the processor operating to:
• generate a password value using the FFC group;
• and
• generate the password element by exponentiating the password value to a power t, where t=(p−1)/r and where p and r are primes and r has a bit length of at least 160 bits.

A device running a password authenticated key exchange protocol using an Elliptic Curve Cryptography (ECC), comprising:

• a circuit for sending signals to and receiving signals from another device;
• a memory for storing commit-scalar and commit-element parameters and other data;
• and
• a processor adapted to perform operations on the signals sent to or received from the other device, the processor operating to:
• generate a password element for a station using the ECC group, the ECC group selected to have an order that is a prime and a cofactor that is equal to one;
• generate a temporary secret value;
• generate a commit-element parameter using the temporary secret value and modified password element;
• generate a commit-scalar parameter;
• and
• create a commit message comprising the commit-scalar parameter and the commit-element parameter.