Abstract:Cryptanalyzing the security weaknesses of authentication protocols is extremely important to propose countermeasures and develop a truly secure protocol. Over last few years, many three factor-based authentication schemes with key agreement have been proposed for multi-server environment. In 2017, Ali and Pal developed a three-factor authentication scheme in multi-server environment using elliptic curve cryptography (ECC) to remedy the security flaws in Li et al.'s scheme and claimed their improved version can withstand the passive and active attacks. In this paper, we prove that Ali-Pal's scheme is subject to offline password guessing attack, replay attack, and known session-specific temporary information (KSSTI) attack. In the same year, Feng et al. examined Kumari et al.'s biometrics-based authentication scheme for multi-server environment and found that their scheme was vulnerable to several attacks. To fix these weaknesses, Feng et al. proposed an enhanced three-factor authentication scheme with key distribution for mobile multi-server environment and claimed that their scheme can satisfy the security and functional requirements. However, we show that Feng et al.'s scheme fails to resist offline password guessing attack, and suffers from replay attack. In addition to point out the security defects, we put forward countermeasures to eliminate the security risks and secure the three factor-based authentication schemes for multi-server environment.

Cryptanalysis of a biometric-based remote user authentication scheme

Authentication Scheme Based on Biometric Encryption

Cryptanalysis and Improvement of Park Et Al.'s Remote User Authentication Protocol

Design and Analysis of a Secure Three Factor User Authentication Scheme Using Biometric and Smart Card

A Novel and Provably Secure Biometrics-Based Three-Factor Remote Authentication Scheme for Mobile Client-Server Networks

Applying Biometrics to Design Three-Factor Remote User Authentication Scheme with Key Agreement.

Robust Biometrics Based Three-Factor Remote User Authentication Scheme with Key Agreement

Cryptanalysis and Improvement of a Biometrics-Based Remote User Authentication Scheme Using Smart Cards

An Enhanced Biometric-Based Three Factors User Authentication Scheme for Multi-Server Environments

A Novel User Authentication Scheme Using Smart Cards.

Cryptanalysis of Multi Factor Authentication Scheme Using Smart Card

Analysis and Improvement of a Multi-Factor Biometric Authentication Scheme

Authentication Scheme of Remote Users by Using Multimodal Biometric and Smart Cards

Security Analysis and Enhancements of a Multi-Factor Biometric Authentication Scheme

Cryptanalysis of Anonymous Three Factor-Based Authentication Schemes for Multi-server Environment

Enhanced Smart Card Based Remote User Authentication Scheme

Cryptanalysis and Improvement of a Biometrics-Based Authentication and Key Agreement Scheme for Multi-Server Environments

Robust three‐factor remote user authentication scheme with key agreement for multimedia systems

Cryptanalysis Of A Fingerprint-Based Remote User Authentication Scheme Using Smart Cards

An Enhanced Biometrics-Based User Authentication Scheme for Multi-Server Environments in Critical Systems