Abstract: Identity authentication is the first line of defense for the security of networks and information systems,and password is the most common method of identity authentication.Researches usually assume that user-constructed passwords obey uniform distribution.However,recent studies found that passwords obey Zipf's law,which means that most password-related security protocols underestimate the advantage of an attacker and thus fail to achieve the claimed security.In response to the above problem,first of all,Password-Based Signatures (PBS) protocol proposed by Gjøsteen,et al. and Password-Protected Secret Sharing (PPSS) protocol proposed by Jarecki,et al.are taken as typical representatives.Based on the basic assumption that passwords obey Zipf's law,the security proofs of these two protocols are demonstrated to be flawed,and the security is redefined.Furthermore,the improvements to the two protocols are given respectively.In improved PBS protocol,an attacker's advantage is recalculated.By limiting the guess number of an attacker and entrusting a trusted third party to keep the key,the protocol can prevent a malicious attacker from disguising a legitimate user,and can prevent a malicious server from guessing a user's password and for-ging the signature.In improved PPSS protocol,a Honey_List is set on the server side based on honeywords to detect and prevent online password guessing attack.

Key words: Honeywords, Password-related security protocols, Security proof, Trusted third party, Zipf's law