IEEE 802.16e supports EAP (Extensible Authentication Protocol) for authentication, but do not specify the EAP method required for authentication. EAP-SPEKE and EAP-SRP are the strongest password based EAP methods. This paper examines these EAP methods and proposes an efficient password based authentication protocol for WiMAX. Proposed protocol is an improvement of EAP-SPEKE protocol and supports mutual authentication and key derivation. Protocol is verified using Automated Validation of Internet Security Protocols and Applications (AVISPA) which is a push button tool for the automated validation of security protocol and result shows that it does not have any security flaws. Proposed protocol uses only three message exchange for authentication and key derivation. Therefore, the number of exchanged message decreases by one and two compared with the EAP-SRP and EAP-SPEKE respectively.

1. ——, “IEEE std 802.16–2004: Air interface for fixed broadband wireless access system,” IEEE, 2004.
2. IEEE 802.16 and WiMax: Broadband Wireless Access for everyone, Intel White Paper, 2004.
3. ——, “IEEE std 802.16e–2005: Air interface for fixed broadband wireless access system – amendment: Physical and medium access control layers for combined fixed and mobile operation in licensed bands,” IEEE, 2006.
4. Adoba, B., Blunk, L., Vollbrecht, J., Carlson, J. and Levkowetz, E. 2004. Extensible authentication protocol (EAP). RFC 3748.
5. T. Wu: The SRP Authentication and Key Exchange System, RFC 2945 (2000).
6. Su Jung Yu and Joo Seok Song, “An Improved Password Authentication Key Exchange Protocol for 802.11 Environments”, V. Kumar et al. (Eds.): ICCSA 2003, LNCS2668, pp. 201–209, 2003
7. D. Jablon: The SPEKE Password-Based Key Agreement Methods, IETF draftjablon-speke-02.txt (2003).
8. Meadows C., The NRL Protocol Analyzer: an overview, Journal of Logic Programming, February 1996.
9. Mitchell J.C. and others, Automated Analysis of Cryptographic Protocols Using Murphi, Proceedings of the 1997 IEEE Symposium on Security and Privacy (1997) pages 141-151, IEEE Computer Society Press.
10. University Of Cambridge, http://www.cl.cam.ac.uk/ research/hvg/Isabelle/overview.html, updated 12-07-2006.
11. B. Blanchet. An efficient cryptographic protocol veri_er based on prolog rules. In Proc. CSFW'01, pages 82-96. IEEE Comp. Soc. Press, 2001.
12. B. Blanchet. Cryptographic Protocol Veri_er User Manual, 2004.
13. C.J.F. Cremers. The Scyther Tool: Verification, falsification, and analysis of security protocols. In Computer Aided Verification, 20th International Conference, CAV 2008, Princeton, USA, Proc., volume 5123/2008 of Lecture Notes in Computer Science, pages 414-418. Springer, 2008.
14. Formal Systems (Europe) Ltd, “FDR2 user manual: Failure–divergence efinement,” May 2000.
15. G. Lowe, “Casper: A compiler for the analysis of security protocols,” ournal of Computer Security, vol. 6, pp. 53–84, 1998.
16. Avispa – a tool for Automated Validation of Internet Security Protocols. http://www.avispa-project.org
17. D6.2: Specification of the Problems in the High-Level Specification Language. http://www.avispa-project.org.
18. SPAN – a Security Protocol Animator for AVISPA. http://www.irisa.fr/lande/genet/span
19. D. Harel and P. S. Thiagarajan. Message sequence charts. UML for Real: Design of Embedded Real-time Systems, 2003.
20. Stanley, D., Walker, J., and Aboba, B. 2005. Extensible authentication protocol (EAP) method requirements for wireless LANs. RFC 4017
21. Anjani K .Rai, Vimal Kumar, Shivendu Mishra, ” Strong Password Based EAP-TLS Authentication Protocol for WiMAX” , Anjani K. Rai et al./(IJCSE) International Journal on Computer Science and Engineering, Vol. 02, No. 02,2010, 2736-2741
22. Anjani K. Rai, Vimal Kumar, Shivendu Mishra,”An Efficient Password Authenticated Key Exchange Protocol for WLAN and WIMAX” International Conference and Workshop on Emerging Trends and Technology (ICWET), 2011 proceedings by ACM at Mumbai Maharashtra. (Accepted)
23. T. Wu: The Secure Remote Password Protocol, In Proceedings of the Internet Society Symposium on Network and Distributed Systems Security, San Diego,
24. D. Taylor: Using SRP for TLS Authentication, IETF draft- ietf-tls-srp-01.txt (work in progress) (2001)CA,(1998)97-111.
25. D.P. Jablon: Strong Password-only Authenticated Key Exchange, ACM SIGCOMM Computer Communications Review (1996)
26. David Q. Liu, Mark Coslow, “Extensible Authentication Protocols for IEEE Standards 802.11 and 802.16”.

Authentication AVISPA EAP-SPEKE EAP-SRP IEEE802.16e SPAN WiMAX