An improved remote password authentication scheme with smart card

Cryptanalysis of an Improved Smartcard-based Remote Password Authentication Scheme

“…This section demonstrated that Chao's authentication scheme [16] is vulnerable to insider attack, user masquerade attack, server masquerade attack and off-line password guessing attack, as well as it fails to achieve users' anonymity. Before introducing the proposed attacks, we describe the following widely used assumptions about the power of an adversary A [10,11,15,18,22,28,29].…”

“…The ability to provide security guarantees is of paramount importance and several initiatives have been proposed to address this concern. Due to the low computation cost and portability of smartcard and easy memorization of user chosen password, two-factor smartcard authentication [2][3][4][5][6][7][8][9][10][11][12][13][14][15][16][17][18][19][20][21] using password is commonly used in Internet-based applications such as remote user/server login, online banking, Pay-TV, electronic voting, secret online order placement.…”

“…In this paper, we examine the protocol of Chao [16] whose history is as follows. In 2010, Hao and Yu [17] pointed out that Wang et al's scheme [6] is not secure against off-line password guessing attack and server masquerade attack, and proposed an enhanced scheme.…”

“…In 2010, Hao and Yu [17] pointed out that Wang et al's scheme [6] is not secure against off-line password guessing attack and server masquerade attack, and proposed an enhanced scheme. Unfortunately, Chao [16] demonstrated that Hao and Yu's scheme [17] is still insecure against off-line password guessing attack and server masquerade attack, and prone to password backward security problem i.e., the scheme must be replaced if the scheme was attacked for one time, in violation of its security claims.…”

“…Section 2 briefly describes the Chao's smartcard-based user authentication scheme [16], and Section 3 outlines our attacks. The last section concludes the paper.…”