Abstract:Understanding security failures of cryptographic protocols is the key to both patching existing protocols and designing future schemes. In this paper, we analyze two recent proposals in the area of password-based remote user authentication using smart cards. First, we point out that the scheme of Chen et al. cannot achieve all the claimed security goals and report its following flaws: (i) it is vulnerable to offline password guessing attack under their nontamper resistance assumption of the smart cards; and (ii) it fails to provide forward secrecy. Then, we analyze an efficient dynamic ID-based scheme without public-key operations introduced byWen and Li in 2012. This proposal attempts to overcome many of the well-known security and efficiency shortcomings of previous schemes and supports more functionalities than its counterparts. Nevertheless, Wen-Li's protocol is vulnerable to offline password guessing attack and denial of service attack, and fails to provide forward secrecy and to preserve user anonymity. Furthermore, with the security analysis of these two schemes and our previous protocol design experience, we put forward three general principles that are vital for designing secure smart-card-based password authentication schemes: (i) public-key techniques are indispensable to resist against offline password guessing attack and to preserve user anonymity under the nontamper resistance assumption of the smart card; (ii) there is an unavoidable trade-off when fulfilling the goals of local password update and resistance to smart card loss attack; and (iii) at least two exponentiation (respectively elliptic curve point multiplication) operations conducted on the server side are necessary for achieving forward secrecy. The cryptanalysis results discourage any practical use of the two investigated schemes and are important for security engineers to make their choices correctly, whereas the proposed three principles are valuable to protocol designers for advancing more robust schemes. Copyright (C) 2012 John Wiley & Sons, Ltd.

An Efficient and Practicable Anonymous Authentication Scheme Using Smart Cards

A Novel User Authentication Scheme Using Smart Cards.

Robust Dynamic ID-based Remote User Authentication Scheme Using Smart Cards

A New Authenticated Key Agreement Scheme Based on Smart Cards Providing User Anonymity with Formal Proof.

An Efficient Delegation-Based Anonymous Authentication Protocol

Anonymity Enhancement on Robust and Efficient Password-Authenticated Key Agreement Using Smart Cards

An Improved Anonymous Remote User Authentication Scheme with Key Agreement Based on Dynamic Identity

Secure Password-based Remote User Authentication Scheme Against Smart Card Security Breach

Two-factor Authentication Schemes Based Smart Card and Password with User Anonymity ⋆

Design of a User Anonymous Password Authentication Scheme Without Smart Card.

Security Analysis and Enhancement of a Dynamic Identity Based Authentication Scheme Using Smart Cards

An Enhanced Remote Mutual Authentication Scheme Using Smart Cards

Breaking Three Remote User Authentication Systems for Mobile Devices

Cryptanalysis and Improvement of a Biometrics-Based Remote User Authentication Scheme Using Smart Cards

Security Flaws In Two Improved Remote User Authentication Schemes Using Smart Cards

A Secure Remote User Mutual Authentication Scheme Using Smart Cards

An Enhanced Smart Card Based Remote User Password Authentication Scheme

Mutual Authentication with Anonymity for Roaming Service with Smart Cards in Wireless Communications.

An Efficient Password Authentication Scheme Using Smart Card Based on Elliptic Curve Cryptography.

Cryptanalysis of a Sensor Smart Card Based Password Authentication Scheme with User Anonymity

Designing a New Mutual Authentication Scheme Based on Nonce and Smart Cards