Abstract:The design of secure and efficient user authentication protocols for multi-server environment is becoming a hot research topic in the cryptographic protocol community. Based on the widely accepted adversary model, this paper analyzes three representative, recently proposed user authentication schemes for multi-server environment. The paper reveals that: 1) Wan et al.’s scheme is subject to offline password guessing attack as opposed to the authors’ claim, and it also cannot provide user anonymity and forward secrecy; 2) Amin et al.’s scheme cannot withstand offline password guessing attack, cannot preserve user anonymity and is vulnerable to two kinds o f forward secrecy issues; 3) Reedy et al.’s scheme cannot resist against user impersonation attack and offline password guessing attack, and  基金项目: 国家自然科学基金(61472016); 国家重点研发计划(2016YFB0800603, 2017YFB1200700) Foundation item: National Natural Science Foundation of China (61472016); National Key Research and Development Plan (2016YFB0800603, 2017YFB1200700) 本文由“面向隐私保护的新型技术与密码算法”专题特约编辑黄欣沂教授推荐. 收稿时间: 2017-05-30; 修改时间: 2017-07-13; 采用时间: 2017-08-22; jos 在线出版时间: 2017-10-17 CNKI 网络优先出版: 2017-10-17 13:38:05, http://kns.cnki.net/kcms/detail/11.2560.TP.20171017.1338.008.html 1938 Journal of Software 软件学报 Vol.29, No.7, July 2018 also falls short of user un-traceability. The paper highlights three principles for designing more robust anonymous multi-factor authentication schemes: Public key principle, user anonymity principle and forward secrecy principle, explaining the essential reasons for the security flaws of the above protocols. It further proposes some amendments for the identified secur ity flaws.

An Improved User Authentication With Key Agreement Scheme For Multi-Server Architecture Using Scpks

An Inter-Domain Authentication Scheme For Pervasive Computing Environment

Inter-domain authentication scheme for Pervasive Computing Environments

Authentication scheme based on biometric encryption for pervasive computing environments

A PRIVACY-PRESERVING AUTHENTICATION SCHEME USING BIOMETRICS FOR PERVASIVE COMPUTING ENVIRONMENTS

Cryptanalysis and Improvement of a Biometrics-Based Authentication and Key Agreement Scheme for Multi-Server Environments

An efficient dynamic ID based remote user authentication scheme using self-certified public keys for multi-server environment

Cryptanalysis and Improvement of Park Et Al.'s Remote User Authentication Protocol

Hash Function and Smart Card Based Multi-Server Authentication Protocol

A Novel User Authentication Scheme Using Smart Cards.

A lightweight dynamic pseudonym identity based authentication and key agreement protocol without verification tables for multi-server architecture

Cryptanalysis And Improvement Of A Biometric-Based Multi-Server Authentication And Key Agreement Scheme

SUAA: A Secure User Authentication Scheme with Anonymity for the Single & Multi-server Environments.

Cryptanalysis of Multi-Server Authenticated Key Agreement Scheme Based on Trust Computing Using Smart Cards and Biometrics

Cryptanalysis of Anonymous Three Factor-Based Authentication Schemes for Multi-server Environment

Crytanalysis of Three Anonymous Authentication Schemes for Multi-Server Environment

Revisiting Anonymous Two-Factor Authentication Schemes for Multi-server Environment

A Threshold Multi-server Protocol for Password-Based Authentication.

Breaking Three Remote User Authentication Systems for Mobile Devices

Understanding Security Failures of Multi-Factor Authentication Schemes for Multi-Server Environments

A Novel Multiserver Authentication Scheme Using Proxy Resignature With Scalability and Strong User Anonymity