Improved Client-to-Client Password-Authenticated Key Exchange Protocol

Password-authenticated key exchange protocols allow two entities who only share a human-memorable password to authenticate each other and agree on a large session key. Most password authenticated key exchange protocols provide an authenticated key exchange between a client and a server based on a pre-shared password. With the development of modern communication environments, it is necessary to design a secure authenticated key exchange between clients. In ICICS'02, Byun et al. presented a client to client password-authenticated key exchange protocol in a cross-realm setting. But the protocol is vulnerable to some attacks by an insider adversary or outsider adversary. In this paper, we present an improved protocol to solve the problem, and prove the improved protocol is secure against all types of attacks considered in the paper