Cryptanalysis of Two Dynamic ID-Based Remote User Authentication Schemes for Preserving User Privacy

Jian-Wen Peng ； Wen-Bing Horng ； Ying-Ching Chiu ； Chao-Sheng Liu

《淡江理工學刊》 16卷3期 (2013/09) Pp. 277-286

https://doi.org/10.6180/jase.2013.16.3.07

並列摘要

Remote user authentication is an essential part in electronic commerce to identify legitimate users over the Internet. However, how to protect user privacy in the authentication has become an important issue recently. Therefore, many secure authentication schemes with smart cards have been proposed. In this paper, we will analyze the security weaknesses of two recently proposed authentication schemes for preserving user privacy. First, Chang et al. (2011) proposed a robust and efficient remote user authentication scheme to provide user anonymity. However, this scheme fails to protect user privacy in terms of anonymity and traceability. In addition, it is vulnerable to the server counterfeit attack and it does not provide perfect forward secrecy for session keys. Furthermore, if the smart card is lost, it will suffer from the offline password guessing attack as well as the user impersonation attack. Second, Wen and Li (2012) recently presented an improved dynamic ID-based authentication scheme with key agreement. However, this scheme is vulnerable to traceability. In addition, it does not support perfect forward secrecy for session keys. Furthermore, the insecure offline password change phase and online secret renewal phase will result in the denial of service attack.

並列關鍵字

Authentication ； Cryptanalysis ； Perfect Forward Secrecy ； Session Key ； Smart Card

參考文獻

Lamport, L., “Password Authentication with Insecure Communication,” Communications of the ACM, Vol. 24, No. 11, pp. 770 772 (1981). doi: 10.1145/358790. 358797

Hwang, M. S. and Li, L. H., “A New Remote User Authentication Scheme Using Smart Cards,” IEEE Transactions on Consumer Electronics, Vol. 46, No. 1, pp. 28 30 (2000). doi: 10.1109/30.826377

Hwang, M. S., Lee, C. C. and Tang, Y. L., “A Simple Remote User Authentication Scheme,” Mathematical and Computer Modelling, Vol. 36, No. 1 2, pp. 103 107 (2002). doi: 10.1016/S0895-7177(02)00106-1

Chien, H. Y., Jan, J. K. and Tseng, Y. M., “An Efficient and Practical Solution to Remote Authentication: Smart Card,” Computers & Security, Vol. 21, No. 4, pp. 372 375 (2002). doi: 10.1016/S0167-4048(02)00415-7

Fan, C. I., Chan, Y. C. and Zhang, Z. K., “Robust Remote Authentication Scheme with Smart Cards,” Computers & Security, Vol. 24, No. 8, pp. 619 628 (2005). doi: 10.1016/j.cose.2005.03.006