An identity authentication protocol in online social networks

Recent success of online social networks (OSNs) motivates the study of security issues in OSNs. A fundamental but challenging security issue in OSNs is to authenticate a friend's real identity. A solution to this issue will benefit a number of OSN security protocols. Existing solutions require users securely obtain some secret information from their friends before authentication takes place, which is not always possible in OSNs. In this paper, we propose a new authenticated key exchange protocol based on the exclusive secrets shared between friends. It provides identity authentication and key exchange in a plain setting, i.e., users do not need to securely exchange or distribute any information beforehand. The protocol is designed to work with low-entropy input information, because human beings are not good at dealing with a large amount of information. Another advantage of our protocol is its tolerance of input errors considering human error is always a possibility. We prove the security of the protocol in the universal composability (UC) framework and demonstrate its efficiency.