Cryptanalysis and improvement of a biometrics-based remote user authentication scheme using smart cards

LiXiong,NiuJian-Wei,MaJian,WangWen-Dong,LiuCheng-Lian

IF: 7.574

2011-01-01

Journal of Network and Computer Applications

Abstract:Recently, Li and Hwang proposed a biometrics-based remote user authentication scheme using smart cards [Journal of Network and Computer Applications 33 (2010) 1-5]. The scheme is based on biometric...

What problem does this paper attempt to address?

Cryptanalysis and Improvement of a Biometrics-Based Remote User Authentication Scheme Using Smart Cards

Xiong Li,Jian-Wei Niu,Jian Ma,Wen-Dong Wang,Cheng-Lian Liu

DOI: https://doi.org/10.1016/j.jnca.2010.09.003

IF: 7.574

2011-01-01

Journal of Network and Computer Applications

Abstract:Recently, Li and Hwang proposed a biometrics-based remote user authentication scheme using smart cards [Journal of Network and Computer Applications 33 (2010) 1–5]. The scheme is based on biometrics verification, smart card and one-way hash function, and it uses the nonce rather than a synchronized clock, so it is very efficient in computational cost. Unfortunately, the scheme has some security weaknesses, that is to say Li and Hwang's scheme does not provide proper authentication and it cannot resist the man-in-the-middle attacks. If an attacker controls the insecure channel, she/he can easily fabricate messages to pass the user's or server's authentication. Besides, the malicious attacker can impersonate the user to cheat the server and can impersonate the server to cheat the user without knowing any secret information. This paper proposes an improved biometrics-based remote user authentication scheme that removes the aforementioned weaknesses and supports session key agreement.
A Novel User Authentication Scheme Using Smart Cards.

Qi Xie,Ji-Lin Wang,Deren Chen,Xiuyuan Yu

DOI: https://doi.org/10.1109/csse.2008.1043

2008-01-01

Abstract:Recently, Das et al. proposed a dynamic ID-based remote user authentication scheme using smart cards. Liao et al. pointed out some weaknesses of Das et al.psilas scheme, and presented an improved scheme. However, an impersonate attack on Liao et al.psilas scheme is proposed, it proves that their scheme is also insecure. To overcome the weakness, the new scheme is presented. The advantage of the proposed scheme is that there are no secret numbers in the smart card, and can withstand all sorts of attacks.
Cryptanalysis and Improvement of Park Et Al.'s Remote User Authentication Protocol

XIE Qi,CHEN De-ren,YU Xiu-yuan

IF: 2.034

2010-01-01

Systems Engineering

Abstract:In 2009, Park, et al. proposed an efficient remote user authentication protocol. They claimed that their protocol was the first password and smart card based remote user authentication scheme which can resist the off-line password guessing attack, and had many advantages over existing solutions such as no password tables and timestamp, low communication and computational costs. However, this paper shows that their protocol cannot resist the forgery attack and off-line password guessing attack. To overcome the security weaknesses, two improved schemes based on either nonce or timestamp without affecting the merits of the Park, et al. scheme are proposed. Technical discussions are provided to show that the improved protocol is secure, efficient and practical.
Cryptanalysis of a biometric-based remote user authentication scheme

Hongbin Tang,Xinsong Liu,Yao Li

DOI: https://doi.org/10.1049/cp.2012.2315

2012-01-01

Abstract:A three-factor (password, smart card and biometric) authentication scheme allows a user and a remote server to authenticate each other, and it provides strong authentication. Very recently, Das proposed a three-factor remote authentication scheme. He claimed that their scheme was more secure than Li-Hwang's scheme. However, we demonstrate that his scheme is vulnerable to various attacks. It is not feasible for real-life implementation. We then suggest an improvement. The proposed scheme is proved to be more secure than the previous related works and maintains low computation and communication cost.
Authentication Scheme of Remote Users by Using Multimodal Biometric and Smart Cards

De-song Wang,Jian-ping Li,Yuan Tang,Fu-long Xu,Yue-hao Yan

DOI: https://doi.org/10.1142/9789812799524_0026

2008-01-01

Abstract:In the recent several years, Lee et al. and Lin-Lai proposed fingerprint-based remote user authentication schemes using smart cards. But their schemes are vulnerable and susceptible to the attack and have practical pitfalls. Their schemes perform only unilateral authentication (only client authentication). In order to overcome the flaw, Khan and Zhang present a strong remote user authentication scheme by using fingerprint-biometric and smart cards. The proposed scheme is an extended and generalized form of ElGamal's signature scheme whose security is based on discrete logarithm problem, which is not yet forged. In addition, computational costs and efficiency of the proposed scheme are better than other related schemes. But as the time lapses, fingerprint of some people will be changed, such as being burned or being wounded. Once such case happened, the user won't be authentication. So we propose the authentication scheme of remote users by using multimodal biometric (fingerprint and face features) and smart cards. Proposed scheme not only overcome drawbacks and problems of previous schemes, but also provide a stronger and more secure authentication of remote users over insecure network.
Cryptanalysis Of A Fingerprint-Based Remote User Authentication Scheme Using Smart Cards

bintsan hsieh,hertyan yeh,hungmin sun

DOI: https://doi.org/10.1109/ccst.2003.1297584

2003-01-01

Abstract:A remote user authentication scheme is a procedure for a server to authenticate a remote user in a network. Recently, Lee et al. proposed a fingerprint-based remote user authentication scheme to overcome the security flaw in Hwang and Li's scheme. In Lee et al.'s authentication scheme, they store two secret keys and some public elements in a smart card. In this paper, we will first review Lee et al.'s fingerprint-based user authentication scheme. Next, we will show that Lee et al.'s scheme still suffers from the impersonation attack.
A Secure Remote User Mutual Authentication Scheme Using Smart Cards

Xiong Li,Junguo Liao,Jiao Zhang,Jianwei Niu,Saru Kumari

DOI: https://doi.org/10.1109/comcomap.2014.7017176

2014-01-01

Abstract:Recently, Yang et al. Proposed a remote user authentication scheme using smart card. Through careful cryptanalysis, we find that Yang et al.'s scheme is not repairable, and cannot achieve mutual authentication and session key agreement. To overcome these security flaws, we propose a new remote user authentication scheme with smart card. In the proposed scheme, the user can choose his/her password freely and renew the password anytime. At the same time, the proposed scheme provides more functions and security features, such as mutual authentication, session key agreement, perfect forward secrecy and so on.
Improved fingerprint-based remote user authentication scheme using smart cards

Hongwei Sun,Kwokyan Lam,Ming Gu,Jiaguang Sun

DOI: https://doi.org/10.1109/ICCCAS.2007.6251608

2008-01-01

Abstract:Remote user authentication is important to protect web-based services offered over the Internet. The use of smart cards was proposed to avoid the storage of password table in the server. Further protection of user information in the smart cards can be done by imposing a fingerprint verification mechanism. The Lee, Ryu and Yoo (LRY) scheme which provides both smart card based authentication and fingerprint verification is found to be vulnerable to various attacks. This paper proposed an improvement to the LRY scheme which is able to withstand the attacks of the LRY scheme.
Cryptanalysis and Improvement of Jiang et al.'s Smart Card Based Remote User Authentication Scheme

Dheerendra Mishra,Ankita Chaturvedi,Sourav Mukhopadhyay

DOI: https://doi.org/10.48550/arXiv.1312.4793

2013-12-17

Abstract:The smart card based authentication protocols try to ensure secure and authorized communication between remote entities. In 2012, Wei et al. presented an improvement of Wu et al.'s two-factor authentication scheme for TMIS which is proven vulnerable to off-line password guessing attack by Zhu. Zhu also proposed a modified scheme to overcome with weakness of Wei et al.'s scheme, although Lee and Liu showed the failure of his scheme to resist parallel session attacks. Moreover, Lee and Liu introduced an improved scheme. We analyze Wei et al.'s, Zhu's and Lee and Liu's schemes and identify that none of the schemes resist on-line password guessing attack. Moreover, these schemes do not present efficient login and password chance phase. We also show that how inefficient password change phase causes denial of service attack. Further, we propose an improved password based remote user authentication scheme with the aim to eliminate all the drawbacks of previously presented schemes.

Cryptography and Security
Enhanced Smart Card Based Remote User Authentication Scheme

TANG Hongbin,LIU Xinsoug

DOI: https://doi.org/10.3778/j.issn.1002-8331.2012.19.016

2012-01-01

Computer Engineering and Applications Journal

Abstract:A smart card based remote user authentication scheme is more secure than a password-based authentication scheme.In 2011,Chen et al.proposed an improvement on Hsiang et al.'s remote user authentication scheme,and claimed their scheme was more secure than Hsiang et al.'s scheme.However,their scheme is still vulnerable to insider attack,lost smart card attack,replay attack,and impersonation attack.To overcome the dictionary attack against lost smart card,a user authentication scheme based on smart card and elliptic curve discrete logarithm problem is proposed.This scheme is proved to be secure agaisnt various attacks and needs only one elliptic curve scale multiplication in the login and authentication phases.
Robust Dynamic ID-based Remote User Authentication Scheme Using Smart Cards

Xiong Li,Jianwei Niu,Yazhi Liu,Junguo Liao,Wei Liang

DOI: https://doi.org/10.1504/ijahuc.2014.066423

2014-01-01

International Journal of Ad Hoc and Ubiquitous Computing

Abstract:Smart card-based password authentication scheme is one of the most simple and efficient method to identify the legitimacy of a user via an insecure channel. To protect the user from tracking by the attacker, many dynamic ID-based user authentication schemes have been proposed. Recently, Chen et al. proposed an efficient and secure dynamic ID-based authentication scheme using smart cards. However, we find that Chen et al.'s scheme cannot really protect user's anonymity and forward secrecy. Besides, their scheme is inefficient in the authentication phase and cannot resist stolen smart card attack. In this paper, we propose a robust dynamic ID-based user authentication scheme using smart cards to cover the above weaknesses, the proposed scheme can really protect the user's anonymity and is more secure comparing with other related schemes.
Breaking a Robust Remote User Authentication Scheme Using Smart Cards.

Ding Wang,Chunguang Ma,Sendong Zhao,ChangLi Zhou

DOI: https://doi.org/10.1007/978-3-642-35606-3_13

2012-01-01

Abstract:Understanding security failures of cryptographic protocols is the key to both patching existing protocols and designing future schemes. Recently, Yeh et al. showed that Hsiang and Shih's password-based remote user authentication scheme is vulnerable to various attacks if the smart card is nontamper resistant, and proposed an improved version which was claimed to be efficient and secure. In this study, however, we find that, although Yeh et al.'s scheme possesses many attractive features, it still cannot achieve the claimed security goals, and we report its following flaws: (1) It cannot withstand offline password guessing attack and key-compromise impersonation attack under their non-tamper resistance assumption of the smart card; (2) It fails to provide user anonymity and forward secrecy; (3) It has some other minor defects. The proposed cryptanalysis discourages any use of the scheme under investigation in practice. Remarkably, rationales for the security analysis of password-based authentication schemes using smart cards are discussed in detail. © IFIP International Federation for Information Processing 2012.
An Enhanced Remote Mutual Authentication Scheme Using Smart Cards

Jie Gu,Zhi Xue,Yan Zhu,Fangbiao Li

DOI: https://doi.org/10.1049/cp.2012.1864

2012-01-01

Abstract:Mutual authentication is a process or technology in which both entities in a communications link authenticate each other before conducting any business. It is gaining acceptance as a tool that can minimize the risk of online fraud in e-commerce and other network application. Recently, Wang et al. proposed an efficient remote authentication scheme using smart cards. They claimed that the scheme can withstand guessing attack, forgery attack, denial of service attack and is easily realized in the practical resource-limited environment. However, we point out that Wang et al.'s scheme suffers from parallel session attack and replay attack. Furthermore, we propose an enhanced remote mutual authentication scheme to eliminate all identified security flaws in the aforementioned scheme.
Cryptanalysis and Improvement on Yang-Shieh Authentication Schemes.

Jie Liu,Lei Fan,Jianhua Li

DOI: https://doi.org/10.1145/1501434.1501509

2006-01-01

Abstract:Yang and Shieh proposed two password authentication schemes based on smart cards. The best merit of their schemes is that the remote server can verify a login user without any prior knowledge except a login request message. Unfortunately, some security weaknesses had been found and kinds of attacks were presented later. Although some improvements were proposed to fix those weaknesses, part of these improvements need the remote server to maintain verification tables and the other improvements were proved insecure either. In this paper, we will propose two improved schemes that can withstand all existed attacks while keeping the best merit of the original schemes. The remote server in our improved schemes is still able to verify a login user only by a request message.
Security Analysis and Enhancement of a Dynamic Identity Based Authentication Scheme Using Smart Cards

Xiong Li,Jianwei Niu,Muhammad Khurram Khan,Junguo Liao

DOI: https://doi.org/10.1109/ISBAST.2013.27

2013-01-01

Abstract:Remote user authentication is an important and efficient method to ensure security for many network-based application systems. So far, several dynamic identity based authentication schemes have been proposed to protect the user's anonymity. Recently, Sood pointed out the security weaknesses of a dynamic identity based authentication scheme, which was proposed by Wang et al. presented an improved scheme. However, in this paper, we demonstrate that Sood's scheme cannot resist leak of verifier attack, impersonation attack and server spoofing attack. Furthermore, Sood's scheme cannot achieve mutual authentication between the user and the server. Consequently, in this paper, we propose a new dynamic identity based user authentication scheme using elliptic curve cryptosystem to resolve all the aforementioned problems.
Cryptanalysis and improvement on an IC-card-based remote login mechanism

Baoyuan Kang,Jinguang Han,Qingju Wang

DOI: https://doi.org/10.1109/ICCET.2010.5486299

2010-01-01

Abstract:Wang et al. presented a remote password authentication scheme using IC (integrated Circuit)cards in 2004. Recently, Cheng et al. pointed that the Wang et al.'s scheme is unable to withstand the forgery attack. They consequently proposed a novel version to resist the forgery attack. Although Cheng et al. claimed that their scheme is secure against all known attacks and more practical in application than other IC-card-based authentication schemes, in this paper, we show that Cheng et al. scheme is vulnerable to the guessing attack, parallel session attack and key-compromise attack. To remedy these flaws, this paper proposes an improvement over Cheng et al. scheme with more security.
Security Analysis and Enhancements of a Multi-Factor Biometric Authentication Scheme

Min Wu,Jianhua Chen,Wenxia Zhu,Zhenyang Yuan

DOI: https://doi.org/10.1504/ijesdf.2016.079447

2016-01-01

International Journal of Electronic Security and Digital Forensics

Abstract:The security of authentication scheme, especially multi-factor biometric authentication scheme based on password, smart card, and biometric in wireless communication is an important and significant issue that researchers have been focusing on lately. Most recently, Liling Cao et al. improved a multi-factor biometric authentication scheme which demonstrated that their scheme can resist masquerading attack, user masquerading attack, replay attack, and provide mutual authentication, and so on. In this paper, it is indicated that their scheme is vulnerable to stolen smart card attack, user impersonation attack, server impersonation attack and man-in-the-middle-attack. Then, in order to avoid these attacks, a revised scheme with slight high computation costs but more security than other related schemes is presented.
Cryptanalysis of Multi Factor Authentication Scheme Using Smart Card

Yasir Giani,Li Jianhua,Chen Gongliang,Zahid Mehmood

DOI: https://doi.org/10.1109/compcomm.2016.7925201

2016-01-01

Abstract:In the recent decades, in order to achieve high-degree security many researchers are introducing multifactor authentication schemes replacing by conventional password-based remote authentication schemes. In 2010, Li and Hwang proposed biometric-based authentication scheme using the smart card. Later on, Das pointed out that the scheme is susceptible to denial of services attack and also having low efficiency. Then proposed a new scheme to overcome the weaknesses of prior scheme. In 2012, Younghwa An. substantiate that Das's scheme doesn't provide mutual authentication. In 2014, Cao and Ge pointed that Younghwa's scheme is still vulnerable to replay attack and unable to provide user anonymity, while an adversary can perform the re-registration by intercepting user identity IDx in the login phase. In this paper, we first analyze Cao and Ge's scheme and show that their scheme is still vulnerable to password guessing and traceability attacks.
An Enhanced Remote Login Authentication with Smart Card

JQ Liu,J Sun,TH Li

DOI: https://doi.org/10.1109/sips.2005.1579870

2005-01-01

Abstract:Based on one-way hash function, Sun proposed an efficient remote login authentication protocol with smart card in 2000. However, in 2002, Chien at al. pointed out a deficiency of Sun's scheme which only realized unilateral authentication and put forward an efficient and practical solution for remote mutual authentication scheme. But recently, Hsu discussed that this scheme was not secure enough since it was vulnerable to the parallel session attack again. In this paper, we give an enhanced remote login authentication with smart card, which inherits all the merits of the previous schemes as well as realizes secure mutual authentication without significantly increasing the computational cost.
An Enhanced Smart Card Based Remote User Password Authentication Scheme

Xiong Li,Jianwei Niu,Muhammad Khurram Khan,Junguo Liao

DOI: https://doi.org/10.1016/j.jnca.2013.02.034

IF: 7.574

2013-01-01

Journal of Network and Computer Applications

Abstract:Smart card based password authentication is one of the simplest and efficient authentication mechanisms to ensure secure communication in insecure network environments. Recently, Chen et al. have pointed out the weaknesses of some password authentication schemes and proposed a robust smart card based remote user password authentication scheme to improve the security. As per their claims, their scheme is efficient and can ensure forward secrecy of the session key. However, we find that Chen et al.'s scheme cannot really ensure forward secrecy, and it cannot detect the wrong password in login phase. Besides, the password change phase of Chen et al.'s scheme is unfriendly and inefficient since the user has to communicate with the server to update his/her password. In this paper, we propose a modified smart card based remote user password authentication scheme to overcome the aforementioned weaknesses. The analysis shows that our proposed scheme is user friendly and more secure than other related schemes.

Cryptanalysis and improvement of a biometrics-based remote user authentication scheme using smart cards

Cryptanalysis and Improvement of a Biometrics-Based Remote User Authentication Scheme Using Smart Cards

A Novel User Authentication Scheme Using Smart Cards.

Cryptanalysis and Improvement of Park Et Al.'s Remote User Authentication Protocol

Cryptanalysis of a biometric-based remote user authentication scheme

Authentication Scheme of Remote Users by Using Multimodal Biometric and Smart Cards

Cryptanalysis Of A Fingerprint-Based Remote User Authentication Scheme Using Smart Cards

A Secure Remote User Mutual Authentication Scheme Using Smart Cards

Improved fingerprint-based remote user authentication scheme using smart cards

Cryptanalysis and Improvement of Jiang et al.'s Smart Card Based Remote User Authentication Scheme

Enhanced Smart Card Based Remote User Authentication Scheme

Robust Dynamic ID-based Remote User Authentication Scheme Using Smart Cards

Breaking a Robust Remote User Authentication Scheme Using Smart Cards.

An Enhanced Remote Mutual Authentication Scheme Using Smart Cards

Cryptanalysis and Improvement on Yang-Shieh Authentication Schemes.

Security Analysis and Enhancement of a Dynamic Identity Based Authentication Scheme Using Smart Cards

Cryptanalysis and improvement on an IC-card-based remote login mechanism

Security Analysis and Enhancements of a Multi-Factor Biometric Authentication Scheme

Cryptanalysis of Multi Factor Authentication Scheme Using Smart Card

An Enhanced Remote Login Authentication with Smart Card

An Enhanced Smart Card Based Remote User Password Authentication Scheme