Breaking a Robust Remote User Authentication Scheme Using Smart Cards

Abstract : Understanding security failures of cryptographic protocols is the key to both patching existing protocols and designing future schemes. Recently, Yeh et al. showed that Hsiang and Shih’s password-based remote user authentication scheme is vulnerable to various attacks if the smart card is non-tamper resistant, and proposed an improved version which was claimed to be efficient and secure. In this study, however, we find that, although Yeh et al.’s scheme possesses many attractive features, it still cannot achieve the claimed security goals, and we report its following flaws: (1) It cannot withstand offline password guessing attack and key-compromise impersonation attack under their non-tamper resistance assumption of the smart card; (2) It fails to provide user anonymity and forward secrecy; (3) It has some other minor defects. The proposed cryptanalysis discourages any use of the scheme under investigation in practice. Remarkably, rationales for the security analysis of password-based authentication schemes using smart cards are discussed in detail.
Document type :
Conference papers
Complete list of metadatas

Cited literature [20 references]  Display  Hide  Download

https://hal.inria.fr/hal-01551357
Contributor : Hal Ifip <>
Submitted on : Friday, June 30, 2017 - 10:36:07 AM
Last modification on : Friday, December 1, 2017 - 1:09:57 AM
Long-term archiving on : Monday, January 22, 2018 - 9:03:28 PM

File

978-3-642-35606-3_13_Chapter.p...
Files produced by the author(s)

Licence


Distributed under a Creative Commons Attribution 4.0 International License

Identifiers

Citation

Ding Wang, Chun-Guang Ma, Sen-Dong Zhao, Chang-Li Zhou. Breaking a Robust Remote User Authentication Scheme Using Smart Cards. 9th International Conference on Network and Parallel Computing (NPC), Sep 2012, Gwangju, South Korea. pp.110-118, ⟨10.1007/978-3-642-35606-3_13⟩. ⟨hal-01551357⟩

Share

Metrics

Record views

69

Files downloads

62