Abstract:Investigating the security pitfalls of cryptographic protocols is crucial to understand how to improve security. At ICCCS'17, Wu and Xu proposed an efficient smart-card-based password authentication scheme for cloud computing environments to cope with the vulnerabilities in Jiang et al.'s scheme. However, we reveal that Wu-Xu's scheme actually is subject to various security flaws, such as offline password guessing attack and replay attack. Besides security, user friendly is also another great concern. In 2017, Roy et al. found that in most previous two-factor schemes a user has to manage different credentials for different services and further suggested a user-friendly scheme which is claimed to be suitable for multiserver architecture and robust against various attacks. In this work, we show that Roy et al.'s scheme fails to achieve truly two-factor security and shows poor scalability. At FGCS'18, Amin et al. pointed out that most of existing two-factor schemes are either insecure or inefficient for mobile devices due to the use of public-key techniques and thus suggested an improved protocol by using only light-weight symmetric key techniques. Almost at the same time, Wei et al. also observed this issue and proposed a new scheme based on symmetric key techniques with formal security proofs in the random oracle model. Nevertheless, we point out that both Amin et al.'s and Wei et al.'s schemes cannot achieve the claimed security goals (including the most crucial goal of truly two-factor security). Our results invalidate any use of the scrutinized schemes for cloud computing environments.

On the Security of a Key Agreement and Key Protection Scheme

Defending Against Key Exposure in Attribute-Based Encryption

Security Analysis of an Authentication and Key Agreement Protocol for Satellite Communications

Secure Remote User Mutual Authentication Scheme with Key Agreement for Cloud Environment

A New Authenticated Key Agreement Scheme Based on Smart Cards Providing User Anonymity with Formal Proof.

Weakness of Remote Authentication Scheme of Chen Et Al.

Design issues in "a secure and efficient key agreement framework for critical energy infrastructure using mobile device"

Key substitution attacks on some verifiably encrypted signature schemes

Defending Secret-Key Based Authentication Protocols Against the Stolen-Secret Attack.

A Robust and Anonymous Two Factor Authentication and Key Agreement Protocol for Telecare Medicine Information Systems

An enhanced ID-based remote mutual authentication with key agreement protocol for mobile devices on elliptic curve cryptosystem.

Revisiting Anonymous Two-Factor Authentication Schemes for Multi-server Environment

Impersontion Attack on Mutual Authentication and Key Establishment Protocol for Communication Networks

Revisiting Anonymous Two-Factor Authentication Schemes for IoT-Enabled Devices in Cloud Computing Environments.

Understanding Security Failures of Multi-Factor Authentication Schemes for Multi-Server Environments

Robust Biometrics Based Three-Factor Remote User Authentication Scheme with Key Agreement

An efficient two-factor authentication protocol based on elliptic curve cryptosystem with provable security

An Improved Remote User Authentication Scheme with Key Agreement

An Improved Anonymous Remote User Authentication Scheme with Key Agreement Based on Dynamic Identity

Notes on “a password-based remote user authentication scheme without smart card”

On the Security of a Group Key Agreement Protocol and Its Improvement with Pairings