Abstract:The design of secure and efficient user authentication protocols for multi-server environment is becoming a hot research topic in the cryptographic protocol community. Based on the widely accepted adversary model, this paper analyzes three representative, recently proposed user authentication schemes for multi-server environment. The paper reveals that: 1) Wan et al.’s scheme is subject to offline password guessing attack as opposed to the authors’ claim, and it also cannot provide user anonymity and forward secrecy; 2) Amin et al.’s scheme cannot withstand offline password guessing attack, cannot preserve user anonymity and is vulnerable to two kinds o f forward secrecy issues; 3) Reedy et al.’s scheme cannot resist against user impersonation attack and offline password guessing attack, and  基金项目: 国家自然科学基金(61472016); 国家重点研发计划(2016YFB0800603, 2017YFB1200700) Foundation item: National Natural Science Foundation of China (61472016); National Key Research and Development Plan (2016YFB0800603, 2017YFB1200700) 本文由“面向隐私保护的新型技术与密码算法”专题特约编辑黄欣沂教授推荐. 收稿时间: 2017-05-30; 修改时间: 2017-07-13; 采用时间: 2017-08-22; jos 在线出版时间: 2017-10-17 CNKI 网络优先出版: 2017-10-17 13:38:05, http://kns.cnki.net/kcms/detail/11.2560.TP.20171017.1338.008.html 1938 Journal of Software 软件学报 Vol.29, No.7, July 2018 also falls short of user un-traceability. The paper highlights three principles for designing more robust anonymous multi-factor authentication schemes: Public key principle, user anonymity principle and forward secrecy principle, explaining the essential reasons for the security flaws of the above protocols. It further proposes some amendments for the identified secur ity flaws.

Password-based Authenticated Key Agreement Scheme with Mutual Anonymity for Trusted Computation

An Efficient Delegation-Based Anonymous Authentication Protocol

Anonymous authorization in trust management

Crytanalysis of Three Anonymous Authentication Schemes for Multi-Server Environment

An Identity-Based One-Time Password Scheme with Anonymous Authentication

Authenticated Key Agreement Scheme with Strong Anonymity for Multi-Server Environment in TMIS

Security Improvement on an Anonymous Key Agreement Protocol Based on Chaotic Maps

Improved anonymity preserving three-party mutual authentication key exchange protocol based on chaotic maps

Mutual Authentication with Anonymity for Roaming Service with Smart Cards in Wireless Communications.

Revisiting Anonymous Two-Factor Authentication Schemes for Multi-server Environment

A Password-Authenticated Key Agreement Scheme with Perfect Forward Secrecy

Threshold Attribute-Based Credentials With Redactable Signature

Cryptanalysis of Multi-Server Authenticated Key Agreement Scheme Based on Trust Computing Using Smart Cards and Biometrics

Weaknesses of a Password-Authenticated Key Exchange Protocol between Clients with Different Passwords

New efficient user identification and key distribution scheme providing enhanced security

Cryptanalysis of Sun and Cao's Remote Authentication Scheme with User Anonymity

Authentication Scheme Based on Trusted Computing of Preventing Phishing Attacks

A Note on "Design of a Password Authentication and Key Agreement Scheme to Access e-Healthcare Services"

Three-factor anonymous authentication and key agreement based on fuzzy biological extraction for Industrial Internet of Things

Provably secure and efficient certificateless authenticated tripartite key agreement protocol.

Post-quantum Verifier-Based Three-Party Password Authenticated Key Exchange Protocol