Cryptanalysis of an efficient three-party password-based key exchange scheme

Three-party password-authenticated key exchange (3PAKE) protocols allow entities to negotiate a secret session key with the aid of a trusted server with whom they share a human-memorable password. Recently, Lou and Huang proposed a simple 3PAKE protocol based on elliptic curve cryptography, which is claimed to be secure and to provide superior efficiency when compared with similar-purpose solutions. In this paper, however, we show that the solution is vulnerable to key-compromise impersonation and offline password guessing attacks from system insiders or outsiders, which indicates that the empirical approach used to evaluate the scheme's security is flawed. These results highlight the need of employing provable security approaches when designing and analyzing PAKE schemes. Copyright (c) 2011 John Wiley & Sons, Ltd.

QCD sum rules for the 'Z POT + IND C' (3900) state.

We use the QCD sum rules to study the recently observed charmonium-like structure Z+ c (3900) as a tetraquark state. We evaluate the three-point function and extract the coupling constants of the Z+ c J/ψ π+, Z+ c ηc ρ+ and Z+ c D+ ¯D∗0 vertices and the corresponding decay widths in these channels. The results obtained are in good agreement with the experimental data and supports to the tetraquark picture of this state.