Design of a user anonymous password authentication scheme without smart card

Abstract

Summary Recently, Jiang et al. and He et al. independently found security problems in Chen et al.'s remote user authentication scheme for non‐tamper‐proof storage devices like Universal Serial Bus stick and proposed improvements. Nonetheless, we detect that the schemes proposed by Jiang et al. and He et al. overlook a user's privacy. We also observe that Jiang et al.'s scheme is vulnerable to insider attack and denial of service attacks and lacks forward secrecy. We point out that the password changing facility in He et al.'s scheme is equivalent to undergoing registration, whereas in Jiang et al.'s scheme, it is unsuitable. Moreover, the login phase of both the schemes is incapable to prevent the use of wrong password leading to the computation of an unworkable login request. Therefore, we design a new scheme with user anonymity to surmount the identified weaknesses. Without adding much in communication/computational cost, our scheme provides more security characteristics and keeps the merits of the original schemes. As compared with its predecessor schemes, the proposed scheme stands out as a more apt user authentication method for common storage devices. We have also presented a formal proof of security of the proposed scheme based on the logic proposed by Burrows, Abadi and Needham (BAN logic). Copyright © 2014 John Wiley & Sons, Ltd.

Multifactor Authentication Methods: A Framework for Their Comparison and Selection

“…Authentication is, thus, the process of verifying the identity of a user as part of a system's access control to protect the information stored within them [1]. Various authentication techniques have been proposed in literature, such as text passwords [2,3], smart cards [4,5], and biometrics [6][7][8]. All of the mentioned techniques belong to distinct authentication factors.…”

A Secure and Anonymous Two-Factor Authentication Protocol in Multiserver Environment

“…While it has been found that the password-based singleserver authentication protocols always risk in stolen-verifier attack, because the server has to maintain a password related table. Thus, the smart card, as a second security factor, gets widely used [1][2][3][4][5].…”

Cryptanalysis of Three Password-Based Remote User Authentication Schemes with Non-Tamper-Resistant Smart Card

“…They have become an important criterion of an ideal remote authentication scheme. Most of remote user authentication schemes [4,[40][41][42] are designed and evaluated according to them, while none of the schemes could actually satisfy them simultaneously. Therefore, many researchers begin to pay more attention to e a l 2 Password dependent 3 No verification table 4 Freely chosen password by the users 5 F o r w a r d s e c r e c y 6…”