Abstract:Understanding security failures of cryptographic protocols is the key to both patching existing protocols and designing future schemes. In this paper, we analyze two recent proposals in the area of password-based remote user authentication using smart cards. First, we point out that the scheme of Chen et al. cannot achieve all the claimed security goals and report its following flaws: (i) it is vulnerable to offline password guessing attack under their nontamper resistance assumption of the smart cards; and (ii) it fails to provide forward secrecy. Then, we analyze an efficient dynamic ID-based scheme without public-key operations introduced byWen and Li in 2012. This proposal attempts to overcome many of the well-known security and efficiency shortcomings of previous schemes and supports more functionalities than its counterparts. Nevertheless, Wen-Li's protocol is vulnerable to offline password guessing attack and denial of service attack, and fails to provide forward secrecy and to preserve user anonymity. Furthermore, with the security analysis of these two schemes and our previous protocol design experience, we put forward three general principles that are vital for designing secure smart-card-based password authentication schemes: (i) public-key techniques are indispensable to resist against offline password guessing attack and to preserve user anonymity under the nontamper resistance assumption of the smart card; (ii) there is an unavoidable trade-off when fulfilling the goals of local password update and resistance to smart card loss attack; and (iii) at least two exponentiation (respectively elliptic curve point multiplication) operations conducted on the server side are necessary for achieving forward secrecy. The cryptanalysis results discourage any practical use of the two investigated schemes and are important for security engineers to make their choices correctly, whereas the proposed three principles are valuable to protocol designers for advancing more robust schemes. Copyright (C) 2012 John Wiley & Sons, Ltd.

Security analysis of a server-aided RSA key generation protocol

Collusion Attack on a Server-Aided Unbalanced RSA Key Generation Protocol

Security Analysis of Server-Aided Public Key Generation Protocols on Low-Power Devices for Ad-Hoc Networks

Cryptanalysis and Improvement of Gateway-Oriented Password Authenticated Key Exchange Protocol Based on RSA

Security Analysis on an Improvement of RSA-Based Password Authenticated Key Exchange.

Provably secure RSA-based remote user authentication protocol passwords

Server-aided RSA key generation based on Smartphone

Dual RSA and Its Security Analysis

A Provably Secure Biometrics-Based Authenticated Key Agreement Scheme for Multi-Server Environments

Strong, Efficient and Reliable Personal Messaging Peer to Peer Architecture Based on Hybrid RSA.

Security Flaws In Two Improved Remote User Authentication Schemes Using Smart Cards

User Authentication and Key Agreement Protocol for Mobile Client-multi-server Environment

Cryptanalysis of Two Password Authenticated Key Exchange Protocols Based on RSA

Secure Remote User Mutual Authentication Scheme with Key Agreement for Cloud Environment

On the security of two server-aided verification signature schemes

Cryptanalysis of two dynamic ID-Based remote user authentication schemes for multi-server architecture

A Comprehensive Study of Backdoors for RSA Key Generation

A Unidirectional Split-Key Based Signature Protocol With Encrypted Function In Mobile Code Environment

Cryptanalysis and Improvement of a Biometrics-Based Authentication and Key Agreement Scheme for Multi-Server Environments

Weakness of Remote Authentication Scheme of Chen Et Al.

Cryptanalysis of Anonymous Three Factor-Based Authentication Schemes for Multi-server Environment