Cryptanalysis and an improvement of new remote mutual authentication scheme using smart cards. (English) Zbl 1495.94082

Karuppiah, Marimuthu; Saravanan, R.

J. Discrete Math. Sci. Cryptography 18, No. 5, 623-649 (2015).

MSC:

94A62	Authentication, digital signatures and secret sharing
94A60	Cryptography
68P25	Data encryption (aspects in computer science)

Keywords:

password authentication; user anonymity; off-line password guessing attack; user impersonation attack

References:

[1]	Chuang, Y. H.; Tseng, Y. M., Towards generalized IDbased user authentication for mobile multiserver environment, International Journal of Communication Systems, 25, 4, 447-460 (2012)
[2]	Chen, C.; He, D.; Chan, S.; Bu, J.; Gao, Y.; Fan, R., Lightweight and provably secure user authentication with anonymity for the global mobility network, International Journal of Communication Systems, 24, 3, 347-362 (2011)
[3]	Wang, Ding; Wang, Ping, Computer Networks (2014), On the Anonymity of Two-Factor Authentication Schemes for Wireless Sensor Networks: Attacks, Principle and Solutions, On the Anonymity of Two-Factor Authentication Schemes for Wireless Sensor Networks · doi:10.1016/j.comnet.2014.07.010
[4]	Wang, Ding; Wang, Ping, Understanding security failures of twofactor authentication schemes for real-time applications in hierarchical wireless sensor networks, Ad Hoc Networks, 20, 1-15 (2014) · doi:10.1016/j.adhoc.2014.03.003
[5]	Yeh, K. H.; Lo, N. W.; Li, Y., Cryptanalysis of HsiangShih’s authentication scheme for multiserver architecture. I, 24, 7, 829-836 (2011)
[6]	Li, X.; Niu, J.; Liao, J.; Liang, W., Cryptanalysis of a dynamic identitybased remote user authentication scheme with verifiable password update, International Journal of Communication Systems (2013) · doi:10.1002/dac.2676
[7]	Tang, H. B.; Liu, X. S., Cryptanalysis of a dynamic IDbased remote user authentication with key agreement scheme, International Journal of Communication Systems, 25, 12, 1639-1644 (2012)
[8]	Jiang, Q.; Ma, J.; Li, G.; Li, X., Improvement of robust smartcardbased password authentication scheme, International Journal of Communication Systems (2013) · doi:10.1002/dac.2644
[9]	Tsai, J. L.; Wu, T. C.; Tsai, K. Y., New dynamic ID authentication scheme using smart cards, International Journal of Communication Systems, 23, 12, 1449-1462 (2010)
[10]	Wang, Ding; Ma, Chunguang, Cryptanalysis and security enhancement of a remote user authentication scheme. J, 19, 5, 104-114 (2012)
[11]	Lamport, L., Password authentication with insecure communication, Communications of the ACM, 24, 770-772 (1981)
[12]	Shimizu, A., A dynamic password authentication method by one-way function, IEICE Transactions J73-D-I, 7, 630-636 (1990)
[13]	Haller, N. H., The S/KEY (TM) one-time password system, Proc, Internet Society Symposium on Network and Distributed System Security, 151-158 (1994)
[14]	Sandirigama, M.; Shimizu, A.; Noda, M. T., Simple and secure pass-word authentication protocol (SAS, IEICE Transactions on Communications E83-B, 6, 1363-1365 (2000)
[15]	Chen, T. H.; Lee, W. B., A new method for using hash functions to solve remote user authentication, Computers and Electrical Engineering, 34, 53-62 (2008) · Zbl 1131.68046
[16]	Hwang, T.; Chen, Y.; Laih, C. S., Non-interactive password authentications without password tables, Proc. IEEE Region 10 Conference on Computer and Communication Systems, Hong Kong, Sept, 429-431 (1990)
[17]	Hwang, M. S.; Li, L. H., A new remote user authentication scheme using smart card, IEEE Transactions on Consumer Electronics, 46, 1, 28-30 (2000)
[18]	ElGamal, T., A public key cryptosystem and a signature scheme based on discrete logarithms, IEEE Transactions on Information Theory, 31, 4, 469-472 (1985) · Zbl 0571.94014
[19]	Chan, C. K.; Cheng, L. M., Cryptanalysis of a remote user authentication scheme using smart cards, IEEE Transactions on Consumer Electronics, 46, 4, 992-993 (2000)
[20]	Chang, C. C.; Hwang, K. F., Some forgery attacks on a remote user authentication scheme using smart cards, Informatica, 14, 3, 289-294 (2003) · Zbl 1084.68534
[21]	Yeh, H. T.; Sun, H. M.; Hsieh, B. T., Security of a remote user authentication scheme using smart cards, IEICE Transactions on Communications E87-B, 1, 192-194 (2004)
[22]	Sun, H. M., An efficient remote user authentication scheme using smart cards, IEEE Transactions on Consumer Electronics, 46, 4, 958-961 (2000)
[23]	Chien, H. Y.; Jan, J. K.; Tseng, Y. M., An efficient and practical solution to remote authentication: smart card, Computer and Security, 21, 4, 372-375 (2002)
[24]	Hsu, C. L., Security of Chien et al.’s remote user authentication scheme using smart cards, Computer Standards and Interfaces, 26, 3, 167-169 (2004)
[25]	Ku, W. C.; Chen, S. M., Weaknesses and improvements of an efficient password based remote user authentication scheme using smart cards, IEEE Transactions on Consumer Electronics, 50, 1, 204-207 (2004)
[26]	Lee, S. W.; Kim, H. S.; Yoo, K. Y., Improvement of Chien et al.’s remote user authentication scheme using smart cards, Computer Standards and Interfaces, 27, 181-183 (2005)
[27]	Yoon, E. J.; Ryu, E. K.; Yoo, K. Y., Further improvement of an efficient password based remote user authentication scheme using smart cards, IEEE Transactions on Consumer Electronics, 50, 2, 612-614 (2004)
[28]	Liao, I-En; Lee, C. C.; Hwang, M. S., A password authentication scheme over insecure networks, Journal of Computer and System Sciences 72, 727-740 (2006) · Zbl 1094.68027
[29]	Yoon, E. J.; Yoo, K. Y., Drawbacks of Liao et al.’s password authentication scheme, International Conference on Next Generation Web Services Practices (2006), Seoul, Korea
[30]	Xiang, Tao; Wong, Kwok-wo; Liao, Xiaofeng, Cryptanalysis of a password authentication scheme over insecure networks, Journal of Computer and System Sciences, 74, 657-661 (2008) · Zbl 1169.68399
[31]	Kumar, Manoj; Gupta, Mridul Kumar; Kumari, Saru, An Improved Efficient Remote Password Authentication Scheme with Smart Card over Insecure Networks, International Journal of Network Security, 14, 4, 229-239 (2011)
[32]	Wang, X. M.; Zhang, W. F.; Zhang, J. S.; Khan, M. K., Cryptanalysis and improvement on two efficient remote user authentication scheme using smart cards, Computer Standards and Interfaces, 29, 5, 507-512 (2007)
[33]	Chung, Hao-Rung; Ku, Wei-Chi; Tsaur, Maw-Jinn, Weaknesses and improvement of Wang et al.’s remote user password authentication scheme for resource-limited environments, Computer Standards Interfaces, 31, 863-868 (2009)
[34]	Diffie, W.; van Oorschot, P. C.; Wiener, M. J., Authentication and authenticated key exchanges, Designs Codes and Cryptography, 2, 2, 107-125 (1992)
[35]	Yang, G.; Wong, D. S.; Wang, H.; Deng, X., Two-factor mutual authentication based on smart cards and passwords, Journal of Computer and System Sciences, 74, 7, 1160-1172 (2008) · Zbl 1152.68017
[36]	Wang, D.; Ma, C. G.; Wang, P.; Chen, Z., Robust smart card based password authentication scheme against smart card security breach, Cryptology ePrint Archive (2012)
[37]	Xu, J.; Zhu, WT; Feng, DG, An improved smart card based password authentication scheme with provable security, Computer Standards and Interfaces, 31, 4, 723-728 (2009)
[38]	Song, Ronggong, Advanced smart card based password authentication protocol, Computer Standards and Interfaces, 32, 5, 321-325 (2010)
[39]	Sood, SK; Sarje, AK; Singh, K., An improvement of Xu et al.’s authentication scheme using smart cards, In: Proceedings of the third annual ACM Bangalore conference. (2010)
[40]	Ramasamy, Rajaram; Muniyandi, Amutha Prabakar, “New Remote Mutual Authentication Scheme using Smart Cards.” Transactions on Data Privacy, 2, no. 2, 141-152 (2009)
[41]	Kocher, P.; Jaffe, J.; Jun, B., Differential power analysis, In Advances in Cryptology-CRYPTO 1999, Vol. 1666, 789-789 (1999), Springer: Berlin / Heidelberg, Springer
[42]	Messerges, TS; Dabbish, EA; Sloan, RH, Examining smart-card security under the threat of power analysis attacks, IEEE Transactions on Computers, 51, 5, 541-552 (2002) · Zbl 1391.94781
[43]	Sood, SK, Secure dynamic identity-based authentication scheme using smart cards, Information Security Journal: A Global Perspective, 20, 2, 67-77 (2011)
[44]	Tapiador, JE; Hernandez-Castro, JC; Peris-Lopez, P.; Clark, JA, Cryptanalysis of song’s advanced smart card based password authentication protocol
[45]	Shim, K., Security flaws in three password-based remote user authentication schemes with smart cards, Cryptologia, 36, 1, 62-69 (2012)
[46]	He, D.; Wu, S., Security flaws in a smart card based authentication scheme for multi-server environment, Wireless Personal Communications (2012) · doi:10.1007/s11277-012-0696-
[47]	Wang, D.; Ma, CG; Zhao, S.; Zhou, C.; Xu, L.; Bertino, E.; Mu, Y., Cryptanalysis of two dynamic idbased remote user authentication schemes for multi-server architecture, In Proceedingg of 6th International Conference on Network and System Security (NSS 2012, Vol. 7645, 462-475 (2012), Springer: Berlin / Heidelberg, Springer
[48]	Ma, C. G.; Wang, D.; Zhao, S. D., Security flaws in two improved remote user authentication schemes using smart cards, International Journal of Communication Systems. (2012) · doi:10.1002/dac.2468
[49]	Wang, D.; Ma, CG; Zhao, S.; Zhou, C.; Park, JJ, Secure password-based remote user authentication scheme with non-tamper resistant smart cards, In 9th IFIP International Conference on Network and Parallel Computing (NPC 2012, Vol. 7513, 110-118 (2012), Springer: Berlin / Heidelberg, Springer
[50]	Chen, B. L.; Kuo, W. C.; Wuu, L. C., Robust smartcardbased remote user password authentication scheme, International Journal of Communication Systems, 27, 2, 377-389 (2014)
[51]	Islam, S. K., Design and analysis of an improved smartcardbased remote user password authentication scheme, International Journal of Communication Systems. (2014)
[52]	Wang, D.; Wang, P., Offline Dictionary Attack on Password Authentication Schemes using Smart Cards, IACR Cryptology ePrint Archive, 2014, 208 (2013)
[53]	Klein, DV, Foiling the cracker: a survey of, and improvements to, password security, Proceedings of the 2nd USENIX Security Workshop, Anaheim, CA, USA, 5-14 (1990), Berkeley, CA, USA: USENIX Association, Berkeley, CA, USA
[54]	Dell’ Amico, M.; Michiardi, P.; Roudier, Y., Password strength: an empirical analysis, Proceedings of INFOCOM 2010, 1-9 (2010), IEEE: IEEE, San Diego, CA, USA
[55]	Sivrikaya, F.; Yener, B., Time synchronization in sensor networks: a survey, Network, IEEE, 18, 4, 45-50 (2004)
[56]	Karuppiah, M.; Saravanan, R., A secure remote user mutual authentication scheme using smart cards, Journal of Information Security and Applications, 19, 4-5, 282-294 (2014)
[57]	Moradi, A.; Barenghi, A.; Kasper, T.; Paar, C., In Proceedings of the 18th ACM conference on Computer and communications security, 111-124 (2011), ACM
[58]	Nohl, K.; Evans, D.; Starbug, S.; Plötz, H., Reverse-Engineering a Cryptographic RFID Tag, In USENIX Security Symposium, Vol. 28 (2008)
[59]	Kim, T. H.; Kim, C.; Park, I., Side channel analysis attacks using AM demodulation on commercial smart cards with SEED, Journal of Systems and Software, 85, 12, 2899-2908 (2012)
[60]	Barenghi, A.; Breveglieri, L.; Koren, I.; Naccache, D., Fault injection attacks on cryptographic devices: Theory, practice, and countermeasures, Proceedings of the IEEE, 100, 11, 3056-3076 (2012)
[61]	Lenzen, C.; Locher, T.; Sommer, P.; Wattenhofer, R., Clock synchronization: Open problems in theory and practice, In SOFSEM 2010: Theory and Practice of Computer Science, 61-70 (2010), Springer Berlin Heidelberg
[62]	Miracl library, Shamus Software Ltd., May 2013, http://www.shamus.ie/index.php?page=home.
[63]	Madhusudhann, R.; Mittal, R. C., Dynamic ID-based remote user password authentication schemes using smart cards:Areview, Journal of Network and Computer Applications, 35, 1235-1248 (2012)