Security analysis and improvement of a user-friendly remote authentication protocol

Wang, Yingjie; Li, J. H.; Tie, Ling

doi:10.1016/j.amc.2004.06.144

Cited by 2 publications

(2 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This inconvenience was removed by Wu and Chieu's improved method few years later (Wu and Chieu, 2003), with an additional merit that the selection of password can be accomplished locally without the help of the server. Nevertheless, it is found that their method have some weakness (Yang and Wang, 2004;Wu and Chieu, 2004;Wang et al, 2005;Hsu, 2005;Hwang and Liao, 2005;Lee and Chiu, 2005). If the attacker can intercept and forge messages between the user and the remote server, he can login to the server without having the correct password.…”

Section: Introductionmentioning

confidence: 99%

“…If the attacker can intercept and forge messages between the user and the remote server, he can login to the server without having the correct password. To cope with this problem, a lot of enhanced schemes are proposed later, including Wu himself (Wu and Chieu, 2004;Wang et al, 2005;Hsu, 2005;Lee and Chiu, 2005). Unfortunately, it is found that Wu's own improved version is still risky under stolen smart card attack, forgery attack, privileged insider's attack and off-line password guessing attack (Yoon andYoo, 2007 andKu et al, 2005).…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

On the Improvement of Remote Authentication Scheme With Smart Cards

Wang¹,

Chen²

2007

Proceedings of the Second International Conference on Security and Cryptography

View full text Add to dashboard Cite

In 2005, Sun et al's proposed a user-friendly remote authentication scheme. In order to improve the efficiency of the authentication process, their method is based on one-way hash function. Unlike previous methods, Sun's method allows the user to choose and change the password locally without connecting to the server. It can resist replay attack, impersonation attack, guessing password attack, denial of service attack. However, in this paper we will point out that their scheme is vulnerable to privileged insider attack, and an enhanced scheme is proposed to eliminate the weakness.

show abstract