Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

網際網路技術學刊

Robust Remote Mutual Authentication Scheme with Key Agreement

Chih-Ho Chou, Kuo‐Yu Tsai, Tzong‐Chen Wu

Published Dec 1, 2015• 2 citations
Publisher

Abstract

In 2006, Shieh and Wang proposed a remote mutual authentication and key agreement scheme, in which a user can login to a remote server with his password and smartcard. In Shieh and Wang’s scheme, it requires only hash functions operations during the login and key agreement phase. However, Holbl et al. demonstrated some attacks on Shieh and Wang’s scheme and proposed an improved scheme to overcome the shown attacks in 2010. In this paper, we point out that Holbl et al.’s proposed scheme is still vulnerable to an offline password guessing and forgery attack. In addition, Holbl et al.’s scheme fails to achieve explicit key authentication. We propose a robust remote mutual authentication scheme with key agreement to resist against above mentioned attacks and provide more security requirements.

DOI
10.6138/jit.2015.16.7.20120619

Related papers

Cryptanalysis Of Dynamic ID Based Remote User Authentication Scheme With Key Agreement.

Sonam Devgan Kaul, Amit K. Awasthi

Summary. In 2012, Wen and Li proposed a secure and robust dynamic identity based remote user au-thentication scheme with key agreement using smart cards. They claimed that their scheme is efficient and secure. But in this paper, we demonstrate that their scheme is completely insecure and vulnerable to various known attacks like offline and online password guessing attack, impersonation attack, server mas-querading attack, denial of service attack and an insider attack. Also we point out that there are loopholes in password change phase and online secret renew phase which leads to the desynchronization between user and the server and even the legitimate user is rejected by the server. In addition, an adversary can easily generate the common session key of further transmission between user and the server. Thus the entire system collapses and authors claims are proven to be wrong and their scheme will not be secure and efficient for practical purpose.

•Jan 1, 2015•0 citations

Cryptanalysis of Two Dynamic ID-Based Remote User Authentication Schemes for Preserving User Privacy

Jian-Wen Peng, Wen-Bing Horng, Ying-Ching Chiu +1 more

Remote user authentication is an essential part in electronic commerce to identify legitimate users over the Internet. However, how to protect user privacy in the authentication has become an important issue recently. Therefore, many secure authentication schemes with smart cards have been proposed. In this paper, we will analyze the security weaknesses of two recently proposed authentication schemes for preserving user privacy. First, Chang et al. (2011) proposed a robust and efficient remote user authentication scheme to provide user anonymity. However, this scheme fails to protect user privacy in terms of anonymity and traceability. In addition, it is vulnerable to the server counterfeit attack and it does not provide perfect forward secrecy for session keys. Furthermore, if the smart card is lost, it will suffer from the offline password guessing attack as well as the user impersonation attack. Second, Wen and Li (2012) recently presented an improved dynamic ID-based authentication scheme with key agreement. However, this scheme is vulnerable to traceability. In addition, it does not support perfect forward secrecy for session keys. Furthermore, the insecure offline password change phase and online secret renewal phase will result in the denial of service attack.

Journal of Applied Science and Engineering•Jan 1, 2013•0 citations

Cryptanalysis of a dynamic ID‐based remote user authentication with key agreement scheme

Hong‐bin Tang, Liu Xin-song

SUMMARY A dynamic user authentication scheme allows a user and a remote server to authenticate each other without leaking the user's identity. In 2011, Wen and Li proposed an improved dynamic ID‐based remote user authentication with key agreement scheme for mobile and home networks. They claimed that their scheme was more secure than the scheme of Wang et al. However, we demonstrate that their scheme is vulnerable to the privileged insider, off‐line password guessing, impersonation, and server spoofing attacks. At the same time, it does not provide any user anonymity and forward secrecy property. Thus, it is not feasible for real‐life implementation.Copyright © 2012 John Wiley & Sons, Ltd.

International Journal of Communication Systems•Sep 3, 2012•40 citations

Improved Secure Remote User Authentication Protocol

Ji‐Seon Lee, Ji Hye Park, Jik Hyun Chang

Recently, Holbl et al. proposed an improvement to Peyravian-Jeffries's password-based authentication protocol to overcome some security flaws. However, Munilla et al. showed that Holbl et al.'s improvement is still vulnerable to off-line password guessing attack. In this paper, we provide a secure password-based authentication protocol which gets rid of the security flaws of Holbl et al.'s protocol.

한국통신학회논문지•Sep 1, 2009•0 citations

Analysis and improvements of dynamic identity-based remote user authentication scheme

QU Jua

In this paper, Duan et al.'s scheme is analyzed. It is showed that this scheme is insecure against offline-guessing attack, replay attack, forgery attack and a session key doesn't be provided after mutual authentication. An improved scheme is proposed that overcomes the above-mentioned security flaws with not affecting the merits of the original scheme. The proposed scheme not only allows the users to choose and change their passwords freely, but also generates a session key agreed by the user and the server.

Computer Engineering and Applications Journal•Jan 1, 2014•0 citations

Attacks on Young-Hwa An’s Improved Dynamic ID-Based Remote User Authentication Scheme

Cheng Qiang Xu, Zhen Li Zhang

In 2011, Khan et al. analyzed and improved an enhanced secure dynamic ID-based remote user authentication scheme to overcome the weakness of Wang et al.’s scheme. In 2013, Young-Hwa An showed that Khan et al.’s scheme is not secure because Khan et al.’s scheme can not resist password guessing attack, forgery attack and does not provide user anonymity. After that he proposed a security improvement of dynamic ID-based remote user authentication scheme with session key agreement to remedy the weakness in Khan et al.’s scheme. Recently, through our study, we have found that Young-Hwa An’s mechanism is not secure enough. There still exists insider user’s attack, anonymity attack and forgery attack.

Applied Mechanics and Materials•May 1, 2014•0 citations
In 2006, Shieh and Wang proposed a remote mutual authentication and key agreement scheme, in which a user can login to a remote server with his password and smartcard. In Shieh and Wang’s scheme, it requires only hash functions operations during the login and key agreement phase. However, Holbl et al. demonstrated some attacks on Shieh and Wang’s scheme and proposed an improved scheme to overcome the shown attacks in 2010. In this paper, we point out that Holbl et al.’s proposed scheme is still vulnerable to an offline password guessing and forgery attack. In addition, Holbl et al.’s scheme fails to achieve explicit key authentication. We propose a robust remote mutual authentication scheme with key agreement to resist against above mentioned attacks and provide more security requirements.
Summary. In 2012, Wen and Li proposed a secure and robust dynamic identity based remote user au-thentication scheme with key agreement using smart cards. They claimed that their scheme is efficient and secure. But in this paper, we demonstrate that their scheme is completely insecure and vulnerable to various known attacks like offline and online password guessing attack, impersonation attack, server mas-querading attack, denial of service attack and an insider attack. Also we point out that there are loopholes in password change phase and online secret renew phase which leads to the desynchronization between user and the server and even the legitimate user is rejected by the server. In addition, an adversary can easily generate the common session key of further transmission between user and the server. Thus the entire system collapses and authors claims are proven to be wrong and their scheme will not be secure and efficient for practical purpose.
Remote user authentication is an essential part in electronic commerce to identify legitimate users over the Internet. However, how to protect user privacy in the authentication has become an important issue recently. Therefore, many secure authentication schemes with smart cards have been proposed. In this paper, we will analyze the security weaknesses of two recently proposed authentication schemes for preserving user privacy. First, Chang et al. (2011) proposed a robust and efficient remote user authentication scheme to provide user anonymity. However, this scheme fails to protect user privacy in terms of anonymity and traceability. In addition, it is vulnerable to the server counterfeit attack and it does not provide perfect forward secrecy for session keys. Furthermore, if the smart card is lost, it will suffer from the offline password guessing attack as well as the user impersonation attack. Second, Wen and Li (2012) recently presented an improved dynamic ID-based authentication scheme with key agreement. However, this scheme is vulnerable to traceability. In addition, it does not support perfect forward secrecy for session keys. Furthermore, the insecure offline password change phase and online secret renewal phase will result in the denial of service attack.
SUMMARY A dynamic user authentication scheme allows a user and a remote server to authenticate each other without leaking the user's identity. In 2011, Wen and Li proposed an improved dynamic ID‐based remote user authentication with key agreement scheme for mobile and home networks. They claimed that their scheme was more secure than the scheme of Wang et al. However, we demonstrate that their scheme is vulnerable to the privileged insider, off‐line password guessing, impersonation, and server spoofing attacks. At the same time, it does not provide any user anonymity and forward secrecy property. Thus, it is not feasible for real‐life implementation.Copyright © 2012 John Wiley & Sons, Ltd.
In this paper, Duan et al.'s scheme is analyzed. It is showed that this scheme is insecure against offline-guessing attack, replay attack, forgery attack and a session key doesn't be provided after mutual authentication. An improved scheme is proposed that overcomes the above-mentioned security flaws with not affecting the merits of the original scheme. The proposed scheme not only allows the users to choose and change their passwords freely, but also generates a session key agreed by the user and the server.
In 2011, Khan et al. analyzed and improved an enhanced secure dynamic ID-based remote user authentication scheme to overcome the weakness of Wang et al.’s scheme. In 2013, Young-Hwa An showed that Khan et al.’s scheme is not secure because Khan et al.’s scheme can not resist password guessing attack, forgery attack and does not provide user anonymity. After that he proposed a security improvement of dynamic ID-based remote user authentication scheme with session key agreement to remedy the weakness in Khan et al.’s scheme. Recently, through our study, we have found that Young-Hwa An’s mechanism is not secure enough. There still exists insider user’s attack, anonymity attack and forgery attack.