Abstract:The design of secure and efficient user authentication protocols for multi-server environment is becoming a hot research topic in the cryptographic protocol community. Based on the widely accepted adversary model, this paper analyzes three representative, recently proposed user authentication schemes for multi-server environment. The paper reveals that: 1) Wan et al.’s scheme is subject to offline password guessing attack as opposed to the authors’ claim, and it also cannot provide user anonymity and forward secrecy; 2) Amin et al.’s scheme cannot withstand offline password guessing attack, cannot preserve user anonymity and is vulnerable to two kinds o f forward secrecy issues; 3) Reedy et al.’s scheme cannot resist against user impersonation attack and offline password guessing attack, and  基金项目: 国家自然科学基金(61472016); 国家重点研发计划(2016YFB0800603, 2017YFB1200700) Foundation item: National Natural Science Foundation of China (61472016); National Key Research and Development Plan (2016YFB0800603, 2017YFB1200700) 本文由“面向隐私保护的新型技术与密码算法”专题特约编辑黄欣沂教授推荐. 收稿时间: 2017-05-30; 修改时间: 2017-07-13; 采用时间: 2017-08-22; jos 在线出版时间: 2017-10-17 CNKI 网络优先出版: 2017-10-17 13:38:05, http://kns.cnki.net/kcms/detail/11.2560.TP.20171017.1338.008.html 1938 Journal of Software 软件学报 Vol.29, No.7, July 2018 also falls short of user un-traceability. The paper highlights three principles for designing more robust anonymous multi-factor authentication schemes: Public key principle, user anonymity principle and forward secrecy principle, explaining the essential reasons for the security flaws of the above protocols. It further proposes some amendments for the identified secur ity flaws.

Provably Secure Anonymous Three-Factor Authentication Scheme for Multi-Server Environments

Three-factor authentication scheme for multi-server environments based on elliptic curve cryptography

Cryptanalysis of Anonymous Three Factor-Based Authentication Schemes for Multi-server Environment

An Anonymous and Efficient Remote Biometrics User Authentication Scheme in a Multi Server Environment.

A Novel and Provably Secure Biometrics-Based Three-Factor Remote Authentication Scheme for Mobile Client-Server Networks

Anonymous Biometrics-Based Authentication with Key Agreement Scheme for Multi-Server Environment Using ECC

A Secure and Efficient Remote User Authentication Scheme for Multi-server Environments Using ECC.

An Enhanced Biometric-Based Three Factors User Authentication Scheme for Multi-Server Environments

Cryptanalysis and Improvement of a Biometrics-Based Authentication and Key Agreement Scheme for Multi-Server Environments

An Enhanced Biometrics-Based User Authentication Scheme for Multi-Server Environments in Critical Systems

Understanding Security Failures of Multi-Factor Authentication Schemes for Multi-Server Environments

A Robust Anonymous Biometric-Based Authenticated Key Agreement Scheme For Multi-Server Environments

SUAA: A Secure User Authentication Scheme with Anonymity for the Single & Multi-server Environments.

New robust biometrics-based mutual authentication scheme with key agreement using elliptic curve cryptography

Revisiting Anonymous Two-Factor Authentication Schemes for Multi-server Environment

Design and Analysis of a Secure Three Factor User Authentication Scheme Using Biometric and Smart Card

A Novel Authentication Scheme for Multi-Server Environment of Industrial Internet

A Novel Smart Card and Dynamic ID Based Remote User Authentication Scheme for Multi-Server Environments.

Crytanalysis of Three Anonymous Authentication Schemes for Multi-Server Environment

An Efficient Dynamic Id-Based Remote User Authentication Scheme Using Self-Certified Public Keys For Multi-Server Environments

A Provably Secure Biometrics-Based Authenticated Key Agreement Scheme for Multi-Server Environments