Abstract:In NSS'10, Shao and Chin pointed out that Hsiang and Shih's dynamic ID-based remote user authentication scheme for multi-server environment has several security flaws and further proposed an improved version which is claimed to be efficient and secure. In this study, however, we will demonstrate that Shao-Chin's scheme still cannot achieve the claimed security goals, and we report its following flaws: (1) It cannot withstand offline password guessing attack under their non-tamper resistance assumption of the smart card; (2) It fails to provide user anonymity; (3) It is prone to user impersonation attack. More recently, Li et al. found that Sood et al.'s dynamic ID-based authentication protocol for multi-server architecture is still vulnerable to several kinds of attacks and presented a new scheme that attempts to overcome the identified weaknesses. Notwithstanding their ambitions, Li et al.'s scheme is still found vulnerable to various known attacks by researchers. In this study, we perform a further cryptanalysis and uncover its two other vulnerabilities: (1) It cannot achieve user anonymity, which is the essential goal of a dynamic ID-based scheme; (2) It is susceptible to offline password guessing attack. The proposed cryptanalysis discourages any use of the two schemes under investigation in practice and reveals some subtleties and challenges in designing this type of schemes.

Cryptanalysis of two ID-based deniable authentication protocol from pairings

An efficient ID-based deniable authentication protocol from pairings

Cryptanalysis and Improvement of Park Et Al.'s Remote User Authentication Protocol

Cryptoanalysis of ID-based Proxy Re-Signature Scheme with Pairing-Free

Cryptanalysis on Four Two-Party Authentication Protocols

Cryptanalysis of a Three-Party Password-Based Authenticated Key Exchange Protocol Using Weil Pairing.

Cryptanalysis of Some Client-to-Client Password-Authenticated Key Exchange Protocols.

Security Analysis of Shim's Authenticated Key Agreement Protocols from Pairings

Cryptanalysis and Improvement of Robust Deniable Authentication Protocol

An Efficient Certificateless Deniable Authentication Protocol Without Pairings

ID-Based One Round Authenticated Tripartite Key Agreement Protocol with Pairings

Identity-based deniable authentication for ad hoc networks

Cryptanalysis of Some RFID Authentication Protocols.

Password-based Authenticated Key Agreement Scheme with Mutual Anonymity for Trusted Computation

An Identity-Based Restricted Deniable Authentication Protocol

Practical Deniable Authentication for Pervasive Computing Environments.

Deniable Authentication Protocol Based on Public Key Algorithm

Cryptanalysis of two dynamic ID-Based remote user authentication schemes for multi-server architecture

On the Security of Two Identity-Based Signature Schemes Based on Pairings

Cryptanalysis of Two Pairing-Based Blind Signature Schemes

Cryptanalysis and improvement on an IC-card-based remote login mechanism