Abstract:Cryptanalyzing the security weaknesses of authentication protocols is extremely important to propose countermeasures and develop a truly secure protocol. Over last few years, many three factor-based authentication schemes with key agreement have been proposed for multi-server environment. In 2017, Ali and Pal developed a three-factor authentication scheme in multi-server environment using elliptic curve cryptography (ECC) to remedy the security flaws in Li et al.'s scheme and claimed their improved version can withstand the passive and active attacks. In this paper, we prove that Ali-Pal's scheme is subject to offline password guessing attack, replay attack, and known session-specific temporary information (KSSTI) attack. In the same year, Feng et al. examined Kumari et al.'s biometrics-based authentication scheme for multi-server environment and found that their scheme was vulnerable to several attacks. To fix these weaknesses, Feng et al. proposed an enhanced three-factor authentication scheme with key distribution for mobile multi-server environment and claimed that their scheme can satisfy the security and functional requirements. However, we show that Feng et al.'s scheme fails to resist offline password guessing attack, and suffers from replay attack. In addition to point out the security defects, we put forward countermeasures to eliminate the security risks and secure the three factor-based authentication schemes for multi-server environment.

Efficient Three-Party Authentication and Key Agreement Protocols Resistant to Password Guessing Attacks

Three-party Encrypted Key Exchange

Secure Key Agreement Protocols for Three-Party Against Guessing Attacks

Enhanced Three-Party Encrypted Key Exchange Without Server Public Keys

Finding and Fixing Vulnerabilities in Several Three-Party Password Authenticated Key Exchange Protocols Without Server Public Keys.

Simple three-party password-based key exchange protocol with provable security

Simple authenticated key agreement protocol resistant to password guessing attacks.

Cryptanalysis and Improvement of Park Et Al.'s Remote User Authentication Protocol

Provably Secure Three-Party Password-Authenticated Key Exchange

Password-based User Authentication and Key Distribution Protocols for Client-Server Applications

Post-quantum Verifier-Based Three-Party Password Authenticated Key Exchange Protocol

New identity-based three-party authenticated key agreement protocol with provable security

Password-based Authenticated Key Agreement Scheme with Mutual Anonymity for Trusted Computation

A Secure Two-factor Authentication Key Exchange Scheme

Weaknesses of a Password-Authenticated Key Exchange Protocol between Clients with Different Passwords

A new framework for efficient password-based authenticated key exchange

Anonymity preserving and round effective three-party authentication key exchange protocol based on chaotic maps

Yet Another Certificateless Three-Party Authenticated Key Agreement Protocol

Provably Secure Three-Party Password-Based Authenticated Key Exchange From Rlwe

Provably secure and efficient certificateless authenticated tripartite key agreement protocol.

Cryptanalysis of Anonymous Three Factor-Based Authentication Schemes for Multi-server Environment