Weaknesses of a Verifier-Based Password-Authenticated Key Exchange Protocol in the Three-Party Setting

Quite recently, Li et al's suggested an efficient verifier-based password-authentication key exchange protocol via elliptic curves. In this paper, we shows that their protocol is still vulnerable to off-line dictionary attack and unknown key-share attack. Through our work, we hope the similar mistakes can be avoided in future designs.