Abstract:Password-based user authentication service is widely used in Internet. Most of the password-based authentication protocols are constructed under the single-server structure that a authencitation server stores cleartext passwords or verification data derived from password and responds to users' authentication request.The security of single-server authentication system is very fragile. In particular, when the server is comprimised, all of users' verification data is exposed to the attacker. Nowadays, development of mobile Internet leads the demand of authentication on roaming device. In this scenario, easily memorable short password and simple secret is accepted by most people despite of its security limitation. The utilization of short password worsens the situation of single-server authentication protocol. Attackers controlling the system can launch off-line dictionary attack from internal of server side to obtain users' original password.Multi-server authentication protocols can improve the security of verification data by distributed storing data on the cluster. This approach increases the difficulty of internal attack and guarantees security even if a portion of servers in the cluster are controlled by adversary. But in practice, There are some problems in existing multi-server protocols. For example, communicating with multiple servers brings extra network and computational burden to client device.To address these problems, in this paper we propose a novel password-based multi-server authenication protocol which not only require less computation on client device but remain functional and secure even if adversary controls some servers and forces them collude to attack our protocol.

Security Analysis of Yang et al.'s Practical Password-Based Two-Server Authentication and Key Exchange System

Weaknesses of a Password-Authenticated Key Exchange Protocol between Clients with Different Passwords

Cryptanalysis and Improvement of Park Et Al.'s Remote User Authentication Protocol

On the Security of Some Password Authentication Protocols.

Security Analysis on an Improvement of RSA-Based Password Authenticated Key Exchange.

Further Cryptanalysis of A Password Authentication Scheme with Smart Cards

A Threshold Multi-server Protocol for Password-Based Authentication.

A Robust Password-Based Multi-Server Authentication Scheme

Cryptanalysis on Four Two-Party Authentication Protocols

Public-key cryptography and password protocols

Attacks on the (enhanced) Yang-Shieh Authentication

Defending Secret-Key Based Authentication Protocols Against the Stolen-Secret Attack.

Cryptanalysis and Improvement of a Biometrics-Based Authentication and Key Agreement Scheme for Multi-Server Environments

Password-based User Authentication and Key Distribution Protocols for Client-Server Applications

A lightweight dynamic pseudonym identity based authentication and key agreement protocol without verification tables for multi-server architecture

Cryptanalysis of Anonymous Three Factor-Based Authentication Schemes for Multi-server Environment

Provably Secure Password-Authenticated Key Exchange Using Diffie-Hellman

Finding and Fixing Vulnerabilities in Several Three-Party Password Authenticated Key Exchange Protocols Without Server Public Keys.

Weaknesses of a dynamic identity based authentication protocol for multi-server architecture

Systematic Solutions to Login and Authentication Security Problems: A Dual-Password Login-Authentication Mechanism

Analysis of Kim-Jeon-Yoo Password Authentication Schemes