Efficient three-party key exchange protocols with round efficiency

Recently, Guo et al. discovered some security flaws of the simple three-party key exchange protocol proposed by Lu and Cao, and proposed an improved protocol. Independently, Chung and Ku also showed some weaknesses of Lu and Cao's protocol, and provided an improved protocol. In this paper, we review some insecurity of Lu and Cao's protocol and analyze two improved protocols proposed by Guo et al. and Chung and Ku. Then we show that the protocols are still insecure. They are vulnerable to an adversary who performs an off-line password guessing attack. We provide a countermeasure by performing detailed analysis on the security flaws in two improved protocols. We also propose a secure three-party password-authenticated key exchange protocol which requires three rounds.