Abstract:In NSS'10, Shao and Chin pointed out that Hsiang and Shih's dynamic ID-based remote user authentication scheme for multi-server environment has several security flaws and further proposed an improved version which is claimed to be efficient and secure. In this study, however, we will demonstrate that Shao-Chin's scheme still cannot achieve the claimed security goals, and we report its following flaws: (1) It cannot withstand offline password guessing attack under their non-tamper resistance assumption of the smart card; (2) It fails to provide user anonymity; (3) It is prone to user impersonation attack. More recently, Li et al. found that Sood et al.'s dynamic ID-based authentication protocol for multi-server architecture is still vulnerable to several kinds of attacks and presented a new scheme that attempts to overcome the identified weaknesses. Notwithstanding their ambitions, Li et al.'s scheme is still found vulnerable to various known attacks by researchers. In this study, we perform a further cryptanalysis and uncover its two other vulnerabilities: (1) It cannot achieve user anonymity, which is the essential goal of a dynamic ID-based scheme; (2) It is susceptible to offline password guessing attack. The proposed cryptanalysis discourages any use of the two schemes under investigation in practice and reveals some subtleties and challenges in designing this type of schemes.

Improving the C-Scheme by Allocating Unique Secret Parameters for Different Users

An Efficient Delegation-Based Anonymous Authentication Protocol

A Novel User Authentication Scheme Using Smart Cards.

An Improved User-Participating Authentication Scheme

Design of a User Anonymous Password Authentication Scheme Without Smart Card.

An Improved User Authentication With Key Agreement Scheme For Multi-Server Architecture Using Scpks

Identity Authentication and Key Agreement Based on Circle Properties

An Improved Anonymous Remote User Authentication Scheme with Key Agreement Based on Dynamic Identity

Secure Remote User Mutual Authentication Scheme with Key Agreement for Cloud Environment

An Efficient Password Authentication Scheme Using Smart Card Based on Elliptic Curve Cryptography.

A Dynamic Hidden-Id Authentication Scheme Based On 2-Dimensional Construction

Security Analysis and Enhancement of a Dynamic Identity Based Authentication Scheme Using Smart Cards

Cryptanalysis and improvement of a user authentication scheme preserving uniqueness and anonymity for connected health care

A New Authenticated Key Agreement Scheme Based on Smart Cards Providing User Anonymity with Formal Proof.

User-Participating Authentication Scheme

Enhanced Smart Card Based Remote User Authentication Scheme

Two-factor Authentication Schemes Based Smart Card and Password with User Anonymity ⋆

CSH: A Post-quantum Secret Handshake Scheme from Coding Theory

Improvement on A Smart Card Based Password Authentication Scheme

Cryptanalysis of two dynamic ID-Based remote user authentication schemes for multi-server architecture

Improved Dynamic ID-based Authentication Scheme for Telecare Medical Information Systems.