Abstract:The design of secure and efficient user authentication protocols for multi-server environment is becoming a hot research topic in the cryptographic protocol community. Based on the widely accepted adversary model, this paper analyzes three representative, recently proposed user authentication schemes for multi-server environment. The paper reveals that: 1) Wan et al.’s scheme is subject to offline password guessing attack as opposed to the authors’ claim, and it also cannot provide user anonymity and forward secrecy; 2) Amin et al.’s scheme cannot withstand offline password guessing attack, cannot preserve user anonymity and is vulnerable to two kinds o f forward secrecy issues; 3) Reedy et al.’s scheme cannot resist against user impersonation attack and offline password guessing attack, and  基金项目: 国家自然科学基金(61472016); 国家重点研发计划(2016YFB0800603, 2017YFB1200700) Foundation item: National Natural Science Foundation of China (61472016); National Key Research and Development Plan (2016YFB0800603, 2017YFB1200700) 本文由“面向隐私保护的新型技术与密码算法”专题特约编辑黄欣沂教授推荐. 收稿时间: 2017-05-30; 修改时间: 2017-07-13; 采用时间: 2017-08-22; jos 在线出版时间: 2017-10-17 CNKI 网络优先出版: 2017-10-17 13:38:05, http://kns.cnki.net/kcms/detail/11.2560.TP.20171017.1338.008.html 1938 Journal of Software 软件学报 Vol.29, No.7, July 2018 also falls short of user un-traceability. The paper highlights three principles for designing more robust anonymous multi-factor authentication schemes: Public key principle, user anonymity principle and forward secrecy principle, explaining the essential reasons for the security flaws of the above protocols. It further proposes some amendments for the identified secur ity flaws.

Cryptanalysis of Sun and Cao's Remote Authentication Scheme with User Anonymity

Cryptanalysis and Improvement of Park Et Al.'s Remote User Authentication Protocol

Cryptanalysis of two dynamic ID-Based remote user authentication schemes for multi-server architecture

A Novel User Authentication Scheme Using Smart Cards.

An Efficient Delegation-Based Anonymous Authentication Protocol

Cryptanalysis of A Dynamic Id-Based Remote User Authentication?With Key Agreement Scheme

An Improved Anonymous Remote User Authentication Scheme with Key Agreement Based on Dynamic Identity

Cryptanalysis and Improvement of Jiang et al.'s Smart Card Based Remote User Authentication Scheme

An Untraceable Ecc-Based Remote User Authentication Scheme

A User Anonymous Mutual Authentication Protocol.

Cryptanalysis of a Sensor Smart Card Based Password Authentication Scheme with User Anonymity

Crytanalysis of Three Anonymous Authentication Schemes for Multi-Server Environment

Cryptanalysis of Wu and Xu's authentication scheme for Telecare Medicine Information Systems

Cryptanalysis of a dynamic identity-based remote user authentication scheme with verifiable password update

Password-based Authenticated Key Agreement Scheme with Mutual Anonymity for Trusted Computation

A New Dynamic ID-Based User Authentication Scheme Using Mobile Device: Cryptanalysis, the Principles and Design

Secure Remote User Mutual Authentication Scheme with Key Agreement for Cloud Environment

Security Flaw of an Improved User Authentication Scheme with User Anonymity for Wireless Communications.

An Improved Remote User Authentication Scheme with Key Agreement

Breaking Three Remote User Authentication Systems for Mobile Devices

Cryptanalysis and Improvement of an Anonymous Authentication Protocol for Wireless Access Networks