Abstract:Cryptanalyzing the security weaknesses of authentication protocols is extremely important to propose countermeasures and develop a truly secure protocol. Over last few years, many three factor-based authentication schemes with key agreement have been proposed for multi-server environment. In 2017, Ali and Pal developed a three-factor authentication scheme in multi-server environment using elliptic curve cryptography (ECC) to remedy the security flaws in Li et al.'s scheme and claimed their improved version can withstand the passive and active attacks. In this paper, we prove that Ali-Pal's scheme is subject to offline password guessing attack, replay attack, and known session-specific temporary information (KSSTI) attack. In the same year, Feng et al. examined Kumari et al.'s biometrics-based authentication scheme for multi-server environment and found that their scheme was vulnerable to several attacks. To fix these weaknesses, Feng et al. proposed an enhanced three-factor authentication scheme with key distribution for mobile multi-server environment and claimed that their scheme can satisfy the security and functional requirements. However, we show that Feng et al.'s scheme fails to resist offline password guessing attack, and suffers from replay attack. In addition to point out the security defects, we put forward countermeasures to eliminate the security risks and secure the three factor-based authentication schemes for multi-server environment.

Cryptanalysis of Two Password Authenticated Key Exchange Protocols Based on RSA

Security Analysis on an Improvement of RSA-Based Password Authenticated Key Exchange.

Cryptanalysis and Improvement of Park Et Al.'s Remote User Authentication Protocol

Improvement of Password Authenticated Key Exchange Based on Rsa for Imbalanced Wireless Networks

How Perfect Offline Wallets Can Still Leak Bitcoin Private Keys

Cryptanalysis and Improvement of Gateway-Oriented Password Authenticated Key Exchange Protocol Based on RSA

Security Analysis of Yang et al.'s Practical Password-Based Two-Server Authentication and Key Exchange System

Weaknesses of a Password-Authenticated Key Exchange Protocol between Clients with Different Passwords

Provably secure RSA-based remote user authentication protocol passwords

On the Security of Some Password Authentication Protocols.

A Robust Password-Based Multi-Server Authentication Scheme

Offline Dictionary Attack on Password Authentication Schemes Using Smart Cards

Three-party Encrypted Key Exchange

Cryptanalysis on Four Two-Party Authentication Protocols

Public-key cryptography and password protocols

Finding and Fixing Vulnerabilities in Several Three-Party Password Authenticated Key Exchange Protocols Without Server Public Keys.

Provably Secure Password-Authenticated Key Exchange Using Diffie-Hellman

Cryptanalysis and Improvement of Jiang et al.'s Smart Card Based Remote User Authentication Scheme

Cryptanalysis of Anonymous Three Factor-Based Authentication Schemes for Multi-server Environment

Password-based Authenticated Key Agreement Scheme with Mutual Anonymity for Trusted Computation

An Attack Scheme of RSA Encryption System with Protocol Failure