Jiayu Xu
Oregon State University, OR·Computer Science
Billions of people log in to online accounts with a password every day, which makes passwords the most widely used authentication method on the Internet and also one of the weakest links in its security. The usual way a client proves a password to a server leans on public-key infrastructure, the system of certificates that is supposed to guarantee you are talking to the right website; attacks on that infrastructure, phishing among them, undermine the whole arrangement.
- Fields
Computer Science
Mathematics & Statistics
- Topics
cryptography
password authentication
aPAKE
- Grants
- 1 known grant, through Sep 2028
What they work on
- Re-analyze real-world asymmetric password-authenticated key exchange (aPAKE) protocols, which let a client prove a password without the server storing it, to test whether their contrived security definitions are necessary or whether standard notions suffice.
- Determine whether deployed strong aPAKE protocols, which resist offline password guessing after a server breach, achieve their security claims in stronger cryptographic models.
- Build new cryptographic tools for constructing (s)aPAKE protocols that reduce computational cost, communication cost, and round complexity, the number of message exchanges needed to authenticate.
- Propose formal security models and new constructions for two-factor authentication, a widely deployed client-server mechanism that has received little rigorous cryptographic analysis.
More about the research
Cryptographers have responded with protocols that avoid relying on it: asymmetric password-authenticated key exchange (aPAKE), which lets a client and server establish a shared secret key from a password without the server ever storing the password itself, and strong aPAKE (saPAKE), which additionally resists an attacker who steals the server's stored data and then tries to guess passwords offline. These protocols are being deployed, but a gap remains between the mathematical security proofs and what the deployed versions actually guarantee.
Why it matters
Password login is how most people guard their online accounts, and current practice is vulnerable to phishing and to server breaches that enable offline password guessing. Clearer security guarantees for the password-authenticated key exchange protocols already being deployed, more efficient versions of them, and the first rigorous treatment of two-factor authentication could make everyday logins and future versions of web transport security measurably harder to attack.
Known grants
From NIH and NSF research grants. Labs often have other funding we can't see.
Closest labs
Alexandra Boldyreva
Georgia Institute of Technology, GA·Computer Science
Design a biometric-based authentication and key reconstruction protocol that is highly resistant to brute-force (exhaustive search) attacks on fingerprint or facial data.
Alan Mislove
Northeastern University, MA·Computer Science
Design revocation schemes for TLS certificates in the Web Public Key Infrastructure based on cryptographic accumulators, compact summaries of large sets, to make certificate revocation more practical and far-reaching.
Nikolay Ivanov
Rowan University, NJ·Computer Science
Conduct a two-stage human-subjects study to identify usability problems across the lifecycle of self-sovereign digital identities (SSDIs), systems in which users control their own identity data.
The school
Oregon State University: 29 labs on PI Pages, $372M a year on research, 238 research doctorates a year.
Reach out
A start for your email. Fill in the brackets.