Abstract:Cryptanalyzing the security weaknesses of authentication protocols is extremely important to propose countermeasures and develop a truly secure protocol. Over last few years, many three factor-based authentication schemes with key agreement have been proposed for multi-server environment. In 2017, Ali and Pal developed a three-factor authentication scheme in multi-server environment using elliptic curve cryptography (ECC) to remedy the security flaws in Li et al.'s scheme and claimed their improved version can withstand the passive and active attacks. In this paper, we prove that Ali-Pal's scheme is subject to offline password guessing attack, replay attack, and known session-specific temporary information (KSSTI) attack. In the same year, Feng et al. examined Kumari et al.'s biometrics-based authentication scheme for multi-server environment and found that their scheme was vulnerable to several attacks. To fix these weaknesses, Feng et al. proposed an enhanced three-factor authentication scheme with key distribution for mobile multi-server environment and claimed that their scheme can satisfy the security and functional requirements. However, we show that Feng et al.'s scheme fails to resist offline password guessing attack, and suffers from replay attack. In addition to point out the security defects, we put forward countermeasures to eliminate the security risks and secure the three factor-based authentication schemes for multi-server environment.

Three-factor authentication scheme for multi-server environments based on elliptic curve cryptography

Provably Secure Anonymous Three-Factor Authentication Scheme for Multi-Server Environments

Authentication scheme based on biometric encryption for pervasive computing environments

Cryptanalysis of Anonymous Three Factor-Based Authentication Schemes for Multi-server Environment

An Enhanced Biometric-Based Three Factors User Authentication Scheme for Multi-Server Environments

New robust biometrics-based mutual authentication scheme with key agreement using elliptic curve cryptography

Anonymous Biometrics-Based Authentication with Key Agreement Scheme for Multi-Server Environment Using ECC

A Secure and Efficient Remote User Authentication Scheme for Multi-server Environments Using ECC.

A Novel and Provably Secure Biometrics-Based Three-Factor Remote Authentication Scheme for Mobile Client-Server Networks

Design and Analysis of a Secure Three Factor User Authentication Scheme Using Biometric and Smart Card

Cryptanalysis and Improvement of a Biometrics-Based Authentication and Key Agreement Scheme for Multi-Server Environments

An Enhanced Biometrics-Based User Authentication Scheme for Multi-Server Environments in Critical Systems

Understanding Security Failures of Multi-Factor Authentication Schemes for Multi-Server Environments

Robust Biometrics Based Three-Factor Remote User Authentication Scheme with Key Agreement

Cryptanalysis of a biometric-based remote user authentication scheme

Robust three‐factor remote user authentication scheme with key agreement for multimedia systems

Revisiting Anonymous Two-Factor Authentication Schemes for Multi-server Environment

An Efficient Password Authentication Scheme Using Smart Card Based on Elliptic Curve Cryptography.

A Secure Three-Factor Multiserver Authentication Protocol Against the Honest-But-Curious Servers.

Cryptanalysis And Improvement Of A Biometric-Based Multi-Server Authentication And Key Agreement Scheme

An Enhancement of a Smart Card Authentication Scheme for Multi-server Architecture