Cryptanalysis and improvement of ‘a robust smart‐card‐based remote user password authentication scheme’

Abstract

SUMMARY With the use of smart card in user authentication mechanisms, the concept of two‐factor authentication came into existence. This was a forward move towards more secure and reliable user authentication systems. It elevated the security level by requiring a user to possess something in addition to know something. In 2010, Sood et al. and Song independently examined a smart‐card‐based authentication scheme proposed by Xu et al. They showed that in the scheme of Xu et al., an internal user of the system can turn hostile to impersonate other users of the system. Both of them also proposed schemes to improve the scheme of Xu et al. Recently, Chen et al. identified some security problems in the improved schemes proposed by Sood et al. and Song. To fix these problems, Chen et al. presented another scheme, which they claimed to provide mutual authentication and withstand lost smart card attack. Undoubtedly, in their scheme, a user can also verify the legitimacy of server, but we find that the scheme fails to resist impersonation attacks and privileged insider attack. We also show that the scheme does not provide important features such as user anonymity, confidentiality to air messages, and revocation of lost/stolen smart card. Besides, the scheme defies the very purpose of two‐factor security. Furthermore, an attacker can guess a user's password from his or her lost/stolen smart card. To meet these challenges, we propose a user authentication method with user anonymity. We show through analysis and comparison that the proposed scheme exhibits enhanced efficiency in contrast to related schemes, including the scheme of Chen et al. Copyright © 2013 John Wiley & Sons, Ltd.

Cryptanalysis of Three Password-Based Remote User Authentication Schemes with Non-Tamper-Resistant Smart Card

“…So Chen et al designed an enhanced remote user authentication scheme. While this scheme was also proved by Kumari and Khan [34] it suffered from insider attack and impersonation attack. Li et al [35], in 2013, reanalyzed Chen et al 's scheme and then indicated that it cannot promise forward secrecy.…”

“…In 2016, Kang et al [44] showed that Djellali et al 's scheme [45] suffers from offline dictionary attack, impersonation attack, and replay attack and then developed an enhanced scheme that achieves user anonymity with a Markov chain; and Kaul et al [46] also designed an improved authentication scheme based on Kumari et al 's scheme [34]. These schemes all claim to be resistant to various attacks, such as offline dictionary attack and impersonation attack.…”

Cryptanalysis of “a time-bound ticket-based mutual authentication scheme for cloud computing”

“…While cryptanalysis of Hao et al [12] scheme, we will follow the below mentioned well practiced techniques [29,30,31,32,33,34,35,36] in the literature:…”

Security Weaknesses of Li's Remote User Password Authentication Scheme Using Smart Card

“…Since then a considerable amount of research [1][2][3][4][5][6][7][8][9][10] has been carried out in this field. In 2009, Hsiang and Shih [1] showed that Liao-Wang [2] scheme cannot resist insider attack, masquerade attack, and server spoofing attack, meanwhile, the scheme cannot achieve mutual authentication.…”

“…Chen et al [5] proposed a robust smart-card based remote user password authentication scheme. Unfortunately, Saru et al [6] pointed out that Chen's scheme fails to resist impersonation attacks and insider attack and does not provide important features such as user anonymity, confidentiality to air messages. Later, Li et al [7] also showed that Chen et al's scheme cannot ensure forward secrecy and the password change phase of the scheme is unfriendly and inefficient when the users update their passwords, in order to eliminate these problems, they proposed a modified smart card based user authentication scheme and claim it is more secure.…”