Abstract:Password-based user authentication service is widely used in Internet. Most of the password-based authentication protocols are constructed under the single-server structure that a authencitation server stores cleartext passwords or verification data derived from password and responds to users' authentication request.The security of single-server authentication system is very fragile. In particular, when the server is comprimised, all of users' verification data is exposed to the attacker. Nowadays, development of mobile Internet leads the demand of authentication on roaming device. In this scenario, easily memorable short password and simple secret is accepted by most people despite of its security limitation. The utilization of short password worsens the situation of single-server authentication protocol. Attackers controlling the system can launch off-line dictionary attack from internal of server side to obtain users' original password.Multi-server authentication protocols can improve the security of verification data by distributed storing data on the cluster. This approach increases the difficulty of internal attack and guarantees security even if a portion of servers in the cluster are controlled by adversary. But in practice, There are some problems in existing multi-server protocols. For example, communicating with multiple servers brings extra network and computational burden to client device.To address these problems, in this paper we propose a novel password-based multi-server authenication protocol which not only require less computation on client device but remain functional and secure even if adversary controls some servers and forces them collude to attack our protocol.

Improved Against Off-Line Dictionary Attack Password Change Protocol

Cryptanalysis and Improvement of Park Et Al.'s Remote User Authentication Protocol

Novel password authentication protocol based on RTT

On the Security of Some Password Authentication Protocols.

An Enhanced Smart Card Based Remote User Password Authentication Scheme

Analysis and Improvement of a Password-Based Authenticated Key Exchange Protocol

Study and Amend Dynamic Password Authentication Scheme

Cryptanalysis of Two Password Authenticated Key Exchange Protocols Based on RSA

An Improved Timestamp-Based Password Authentication Scheme: Comments, Cryptanalysis, and Improvement

Two-factor Authentication Schemes Based Smart Card and Password with User Anonymity ⋆

Improvement on A Smart Card Based Password Authentication Scheme

An Improved User-Participating Authentication Scheme

Security Analysis on an Improvement of RSA-Based Password Authenticated Key Exchange.

Offline Dictionary Attack on Password Authentication Schemes Using Smart Cards

Cryptanalysis and Improvement of Jiang et al.'s Smart Card Based Remote User Authentication Scheme

Cryptanalysis of an improved EPA protocol

Design of a User Anonymous Password Authentication Scheme Without Smart Card.

Efficient Three-Party Password-Based Authenticated Key Exchange Protocol

Advances in Password Security

Password-based Authenticated Key Agreement Scheme with Mutual Anonymity for Trusted Computation

A Threshold Multi-server Protocol for Password-Based Authentication.