Cryptanalysis of Yeh et al.'s Security-Enhanced Remote User Authentication Scheme with Smart Cards

Wen-Gong Shieh ； Wen-Bing Horng

《淡江理工學刊》 16卷3期 (2013/09) Pp. 319-328

https://doi.org/10.6180/jase.2013.16.3.11

並列摘要

Remote authentication is an essential part of the rapid-growing electronic commerce. Recently, Huang and Wei proposed a complete authentication scheme using smart cards with only lightweight operations, such as exclusive-or operations, secure one-way hash functions, and pseudo-random number generators. However, Yeh et al. indicated that Huang-Wei's scheme is vulnerable to the probing analysis attack and then presented a security-enhanced scheme. In this paper, we will show that Yeh et al.'s enhanced scheme suffers from two different kinds of attacks. First, Yeh et al.'s scheme is also vulnerable to two different types of probing analysis attacks. Second, their scheme is susceptible to the user impersonation attack. Moreover, we also develop the mathematical backgrounds for these two types of probing analysis attacks, which can be used by the authentication protocol designers to avoid such kind of attacks.

並列關鍵字

Authentication ； Cryptanalysis ； Probing Analysis Attack ； Security ； Smart Card

參考文獻

M'Raïhi, D. and Yung, M., “E-Commerce Applications of Smart Cards,” Computer Networks, Vol. 36, No. 4, pp. 453 472 (2001). doi: 10.1016/S1389-1286 (01)00166-9

Lamport, L., “Password Authentication with Insecure Communication,” Communications of the ACM, Vol. 24, No. 11, pp. 770 772 (1981). doi: 10.1145/358790. 358797

Hwang, M. S. and Li, L. H., “A New Remote User Authentication Scheme Using Smart Cards,” IEEE Transactions on Consumer Electronics,Vol. 46, No. 1, pp. 28 30 (2000). doi: 10.1109/30.826377

Juang, W. S., “Efficient Password Authenticated Key Agreement Using Smart Cards,” Computers & Security, Vol. 23, No. 2, pp. 167 173 (2004). doi: 10.1016/ j.cose.2003.11.005

Fan, C. I., Chan, Y. C. and Zhang, Z. K., “Robust Remote Authentication Scheme with Smart Cards,” Computers & Security, Vol. 24, No. 8, pp. 619 628 (2005). doi: 10.1016/j.cose.2005.03.006