Cryptanalysis and Improvement of a Biometric-Based Multi-Server Authentication and Key Agreement Scheme

Wang, Chengqi; Zhang, Xiao; Zheng, Zemin

doi:10.1371/journal.pone.0149173

Cited by 62 publications

(63 citation statements)

References 60 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Besides, the protocol undergoes a faulty password modification procedure. Recently, Moon et al and Wang et al presented multiserver authenticated key agreement schemes that are found to be prone to many attacks according to our analysis. The Moon et al is prone to privileged insider attack, identity‐guessing attack, and session key disclosure, while Wang et al is found to be vulnerable to trace attack, session‐specific temporary information attack, key‐compromise information attack, and privileged insider attack.…”

Section: Introductionmentioning

confidence: 80%

“…For comparing the costs, in Table 3, we represent hash operation with T h while overlooking XOR function 24 Wang et al 26 Moon et al 25 Ours due to its insignificant cost. Hence, considering the given performance analysis, we can infer that our proposed technique is more secure than Wang et al, Moon et al, and Chen and Lee schemes.…”

Section: Performance Evaluationmentioning

confidence: 99%

See 1 more Smart Citation

An improved lightweight multiserver authentication scheme

Irshad

Chaudhry

Kumari

et al. 2017

Int J Communication

View full text Add to dashboard Cite

Summary Multiserver authentication complies with the up‐to‐date requirements of Internet services and latest applications. The multiserver architecture enables the expedient authentication of subscribers on an insecure channel for the delivery of services. The users rely on a single registration of a trusted third party for the procurement of services from various servers. Recently, Chen and Lee, Moon et al, and Wang et al presented multiserver key agreement schemes that are found to be vulnerable to many attacks according to our analysis. The Chen and Lee scheme was found susceptible to impersonation attack, trace attack, stolen smart card attack exposing session key, key‐compromise impersonation attack, and inefficient password modification. The Moon et al is susceptible to stolen card attack leading to further attacks, ie, identity guessing, key‐compromise impersonation attack, user impersonation attack, and session keys disclosure, while Wang et al is also found to be prone to trace attack, session‐specific temporary information attack, key‐compromise information attack, and privileged insider attack leading to session key disclosure and user impersonation attacks. We propose an improved protocol countering the indicated weaknesses of these schemes in an equivalent cost. Our scheme demonstrates automated and security analysis on the basis of Burrows‐Abadi‐Needham logic and also presents the performance evaluation for related schemes.

show abstract

Section: Introductionmentioning

confidence: 80%

Section: Performance Evaluationmentioning

confidence: 99%

An improved lightweight multiserver authentication scheme

Irshad

Chaudhry

Kumari

et al. 2017

Int J Communication

View full text Add to dashboard Cite

show abstract

“…The proposed protocol's security and performance comparison against related or analogous protocols [29][30][31][32][33]44,45 is presented in this section. The wrap-up of the comparison is outlined in Tables 3 and 4.…”

Section: Security and Performance Comparisonmentioning

confidence: 99%

“…reveals that proposed computation complexity is less than the complexity of the related schemes except Wang et al 44 But as it is evident from Table 3, the scheme of Wang et al is vulnerable to several severe attacks. Therefore, it can be concluded that proposed protocol is more robust and efficient in terms of computation complexity and security strength.…”

mentioning

confidence: 93%

An ameliorated two‐factor anonymous key exchange authentication protocol for mobile client‐server environment

Mahmood

Naqvi

Alzahrani

et al. 2018

Int J Communication

View full text Add to dashboard Cite

Mobile communication is now an essential part of our day-to-day life due to expeditious progress in the industry of information technology. Prior to session key exchange with the corresponding server, a mobile user needs to be authenticated by that server in order to avail its services. Assorted authentication protocols are introduced so far, for authenticating the legitimate mobile users. Very recently, Lu et al introduced a two-factor scheme for key exchange in the mobile client-server environment. Lu et al declared that their introduced scheme is anonymous and robust for preventing potential attacks. However, we determined that the scheme of Lu et al is susceptible against server key reveal and smart card stolen attack. Moreover, it is also identified that their scheme is prone to traceability and anonymity violation attacks. Therefore, we proposed an improvement in order to increase the security and effectiveness. The immunity of the proposed protocol and correctness is tested, analyzed, and verified through formal proof of automated tool ProVerif and Burrows-Abadi-Needham logic, respectively. Moreover, the security and performance comparison also proved that the improved scheme is robust, efficient, and lightweight. KEYWORDS anonymity, authentication protocol, cryptanalysis, impersonation attack, key exchange, smart card stolen attack, traceability Int J Commun Syst. 2018;31:e3814.wileyonlinelibrary.com/journal/dac

show abstract

“…Based on [21,22,23], the fuzzy extractor is given by two procedures (

G e n

R e p

). The mechanism of a fuzzy extractor consists of two procedures (

G e n

R e p

), which is demonstrated as:

$G e n (B I O) \to (〈〉 R, P),$

$R e p false(B I O^{*}, P false) = R$ if $B I O^{*}$ is reasonably close to $B I O .$

…”

Section: Preliminariesmentioning

confidence: 99%

Improving Biometric-Based Authentication Schemes with Smart Card Revocation/Reissue for Wireless Sensor Networks

Moon

Lee

et al. 2017

Sensors

View full text Add to dashboard Cite

User authentication in wireless sensor networks is more difficult than in traditional networks owing to sensor network characteristics such as unreliable communication, limited resources, and unattended operation. For these reasons, various authentication schemes have been proposed to provide secure and efficient communication. In 2016, Park et al. proposed a secure biometric-based authentication scheme with smart card revocation/reissue for wireless sensor networks. However, we found that their scheme was still insecure against impersonation attack, and had a problem in the smart card revocation/reissue phase. In this paper, we show how an adversary can impersonate a legitimate user or sensor node, illegal smart card revocation/reissue and prove that Park et al.’s scheme fails to provide revocation/reissue. In addition, we propose an enhanced scheme that provides efficiency, as well as anonymity and security. Finally, we provide security and performance analysis between previous schemes and the proposed scheme, and provide formal analysis based on the random oracle model. The results prove that the proposed scheme can solve the weaknesses of impersonation attack and other security flaws in the security analysis section. Furthermore, performance analysis shows that the computational cost is lower than the previous scheme.

show abstract

Cryptanalysis and Improvement of a Biometric-Based Multi-Server Authentication and Key Agreement Scheme

Cited by 62 publications

References 60 publications

An improved lightweight multiserver authentication scheme

An improved lightweight multiserver authentication scheme

An ameliorated two‐factor anonymous key exchange authentication protocol for mobile client‐server environment

Improving Biometric-Based Authentication Schemes with Smart Card Revocation/Reissue for Wireless Sensor Networks

Contact Info

Product

Resources

About