Abstract:Understanding security failures of cryptographic protocols is the key to both patching existing protocols and designing future schemes. In this paper, we analyze two recent proposals in the area of password-based remote user authentication using smart cards. First, we point out that the scheme of Chen et al. cannot achieve all the claimed security goals and report its following flaws: (i) it is vulnerable to offline password guessing attack under their nontamper resistance assumption of the smart cards; and (ii) it fails to provide forward secrecy. Then, we analyze an efficient dynamic ID-based scheme without public-key operations introduced byWen and Li in 2012. This proposal attempts to overcome many of the well-known security and efficiency shortcomings of previous schemes and supports more functionalities than its counterparts. Nevertheless, Wen-Li's protocol is vulnerable to offline password guessing attack and denial of service attack, and fails to provide forward secrecy and to preserve user anonymity. Furthermore, with the security analysis of these two schemes and our previous protocol design experience, we put forward three general principles that are vital for designing secure smart-card-based password authentication schemes: (i) public-key techniques are indispensable to resist against offline password guessing attack and to preserve user anonymity under the nontamper resistance assumption of the smart card; (ii) there is an unavoidable trade-off when fulfilling the goals of local password update and resistance to smart card loss attack; and (iii) at least two exponentiation (respectively elliptic curve point multiplication) operations conducted on the server side are necessary for achieving forward secrecy. The cryptanalysis results discourage any practical use of the two investigated schemes and are important for security engineers to make their choices correctly, whereas the proposed three principles are valuable to protocol designers for advancing more robust schemes. Copyright (C) 2012 John Wiley & Sons, Ltd.

Cryptanalysis of Two Chaotic Maps-Based Authentication Schemes in Edge Computing

Secure Chaotic Maps-based Authentication Scheme for Real-Time Data Access in Internet of Things

Cryptanalysis Of A Chaotic Maps-Based User Authentication And Key Agreement Protocol For Multi-Server Environments

A Chaotic Map-Based Authentication and Key Agreement Scheme with User Anonymity for Cloud Computing

The Cryptanalysis of Lee's Chaotic Maps-Based Authentication and Key Agreement Scheme using Smart card for Telecare Medicine Information Systems

A User Friendly Mutual Authentication and Key Agreement Scheme for Wireless Sensor Networks Using Chaotic Maps

Cryptanalysis and Improvement of an Extended Chaotic Maps-Based Key Agreement Protocol

Exploiting One-Dimensional Exponential Chebyshev Chaotic Map and Matching Embedding for Visually Meaningful Image Encryption

Cryptanalysis and Improvement of Jiang et al.'s Smart Card Based Remote User Authentication Scheme

Security Flaws In Two Improved Remote User Authentication Schemes Using Smart Cards

Cryptanalysis of Multi-Server Authenticated Key Agreement Scheme Based on Trust Computing Using Smart Cards and Biometrics

Practical and Provably Secure Three-Factor Authentication Protocol Based on Extended Chaotic-Maps for Mobile Lightweight Devices

Revisiting Anonymous Two-Factor Authentication Schemes for IoT-Enabled Devices in Cloud Computing Environments.

Chaotic maps-based three-party authenticated key agreement protocol using smart cards

Design and Analysis of a Chaotic Maps-Based Three-Party Authenticated Key Agreement Protocol

Cryptanalysis of two dynamic ID-Based remote user authentication schemes for multi-server architecture

A Secure Chaotic Map-Based Remote Authentication Scheme for Telecare Medicine Information Systems

Cryptanalysis of Multi Factor Authentication Scheme Using Smart Card

Breaking Three Remote User Authentication Systems for Mobile Devices

Revisiting anonymous two-factor authentication schemes for cloud computing

A construction of a conformal Chebyshev chaotic map based authentication protocol for healthcare telemedicine services