Breaking a Robust Remote User Authentication Scheme Using Smart Cards

Abstract : Understanding security failures of cryptographic protocols is the key to both patching existing protocols and designing future schemes. Recently, Yeh et al. showed that Hsiang and Shih’s password-based remote user authentication scheme is vulnerable to various attacks if the smart card is non-tamper resistant, and proposed an improved version which was claimed to be efficient and secure. In this study, however, we find that, although Yeh et al.’s scheme possesses many attractive features, it still cannot achieve the claimed security goals, and we report its following flaws: (1) It cannot withstand offline password guessing attack and key-compromise impersonation attack under their non-tamper resistance assumption of the smart card; (2) It fails to provide user anonymity and forward secrecy; (3) It has some other minor defects. The proposed cryptanalysis discourages any use of the scheme under investigation in practice. Remarkably, rationales for the security analysis of password-based authentication schemes using smart cards are discussed in detail.
Document type :
Conference papers
Complete list of metadatas

Cited literature [20 references]  Display  Hide  Download
Contributor : Hal Ifip <>
Submitted on : Friday, June 30, 2017 - 10:36:07 AM
Last modification on : Friday, December 1, 2017 - 1:09:57 AM
Long-term archiving on : Monday, January 22, 2018 - 9:03:28 PM


Files produced by the author(s)


Distributed under a Creative Commons Attribution 4.0 International License



Ding Wang, Chun-Guang Ma, Sen-Dong Zhao, Chang-Li Zhou. Breaking a Robust Remote User Authentication Scheme Using Smart Cards. 9th International Conference on Network and Parallel Computing (NPC), Sep 2012, Gwangju, South Korea. pp.110-118, ⟨10.1007/978-3-642-35606-3_13⟩. ⟨hal-01551357⟩



Record views


Files downloads