Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Computer Engineering and Applications Journal

Analysis and improvements of dynamic identity-based remote user authentication scheme

QU Jua

Published Jan 1, 2014• 0 citations
OpenAlex

Abstract

In this paper, Duan et al.'s scheme is analyzed. It is showed that this scheme is insecure against offline-guessing attack, replay attack, forgery attack and a session key doesn't be provided after mutual authentication. An improved scheme is proposed that overcomes the above-mentioned security flaws with not affecting the merits of the original scheme. The proposed scheme not only allows the users to choose and change their passwords freely, but also generates a session key agreed by the user and the server.

Related papers

Cryptanalysis and Security Enhancement of an Efficient and Secure Dynamic ID Based Remote User Authentication Scheme for Multi-Server Environments

Subhasish Banerjee, Manash Pratim Dutta, Chandan Tilak Bhunia

Password based authentication schemes have been widely used to verify the legitimacy of a user over an insecure communication channel. A common feature among most of the published schemes is that user's identity (ID) is static in all the transaction sessions, which may leak some information about the user and can create risk of identity theft during message transaction. Therefore, to provide user anonymity, many dynamic ID based remote users authentication schemes have been proposed. Recently, Khan et al. proposed an efficient and secure dynamic ID based remote user authentication scheme and claimed that their scheme can provide strong security against various attacks. In this paper, we have demonstrated that Khan et al.'s scheme is vulnerable to server spoofing attack and insider attack, and has some flaws in login and authentication phase as well and also proposed an enhanced scheme to overcome the identified weaknesses.

International Conference on Advanced Research in Computer Science Engineering & Technology (ICARCSET)•Mar 6, 2015•4 citations

Cryptanalysis of Two Dynamic ID-Based Remote User Authentication Schemes for Preserving User Privacy

Jian-Wen Peng, Wen-Bing Horng, Ying-Ching Chiu +1 more

Remote user authentication is an essential part in electronic commerce to identify legitimate users over the Internet. However, how to protect user privacy in the authentication has become an important issue recently. Therefore, many secure authentication schemes with smart cards have been proposed. In this paper, we will analyze the security weaknesses of two recently proposed authentication schemes for preserving user privacy. First, Chang et al. (2011) proposed a robust and efficient remote user authentication scheme to provide user anonymity. However, this scheme fails to protect user privacy in terms of anonymity and traceability. In addition, it is vulnerable to the server counterfeit attack and it does not provide perfect forward secrecy for session keys. Furthermore, if the smart card is lost, it will suffer from the offline password guessing attack as well as the user impersonation attack. Second, Wen and Li (2012) recently presented an improved dynamic ID-based authentication scheme with key agreement. However, this scheme is vulnerable to traceability. In addition, it does not support perfect forward secrecy for session keys. Furthermore, the insecure offline password change phase and online secret renewal phase will result in the denial of service attack.

Journal of Applied Science and Engineering•Jan 1, 2013•0 citations

Cryptanalysis Of Dynamic ID Based Remote User Authentication Scheme With Key Agreement.

Sonam Devgan Kaul, Amit K. Awasthi

Summary. In 2012, Wen and Li proposed a secure and robust dynamic identity based remote user au-thentication scheme with key agreement using smart cards. They claimed that their scheme is efficient and secure. But in this paper, we demonstrate that their scheme is completely insecure and vulnerable to various known attacks like offline and online password guessing attack, impersonation attack, server mas-querading attack, denial of service attack and an insider attack. Also we point out that there are loopholes in password change phase and online secret renew phase which leads to the desynchronization between user and the server and even the legitimate user is rejected by the server. In addition, an adversary can easily generate the common session key of further transmission between user and the server. Thus the entire system collapses and authors claims are proven to be wrong and their scheme will not be secure and efficient for practical purpose.

•Jan 1, 2015•0 citations

Attacks on Young-Hwa An’s Improved Dynamic ID-Based Remote User Authentication Scheme

Cheng Qiang Xu, Zhen Li Zhang

In 2011, Khan et al. analyzed and improved an enhanced secure dynamic ID-based remote user authentication scheme to overcome the weakness of Wang et al.’s scheme. In 2013, Young-Hwa An showed that Khan et al.’s scheme is not secure because Khan et al.’s scheme can not resist password guessing attack, forgery attack and does not provide user anonymity. After that he proposed a security improvement of dynamic ID-based remote user authentication scheme with session key agreement to remedy the weakness in Khan et al.’s scheme. Recently, through our study, we have found that Young-Hwa An’s mechanism is not secure enough. There still exists insider user’s attack, anonymity attack and forgery attack.

Applied Mechanics and Materials•May 1, 2014•0 citations

Cryptanalysis of a dynamic ID‐based remote user authentication with key agreement scheme

Hong‐bin Tang, Liu Xin-song

SUMMARY A dynamic user authentication scheme allows a user and a remote server to authenticate each other without leaking the user's identity. In 2011, Wen and Li proposed an improved dynamic ID‐based remote user authentication with key agreement scheme for mobile and home networks. They claimed that their scheme was more secure than the scheme of Wang et al. However, we demonstrate that their scheme is vulnerable to the privileged insider, off‐line password guessing, impersonation, and server spoofing attacks. At the same time, it does not provide any user anonymity and forward secrecy property. Thus, it is not feasible for real‐life implementation.Copyright © 2012 John Wiley & Sons, Ltd.

International Journal of Communication Systems•Sep 3, 2012•40 citations

Efficient and Secure Dynamic ID-Based Remote User Authentication Scheme with Session Key Agreement for Multi-Server Environment

Rafael Martínez-Peláez, Francisco Rico-Novella, Cristina Satizábal +1 more

In 2007, Liao-Wang proposed a dynamic ID-based remote user authentication scheme for multi-server environment using smart cards.However, Hsiang-Shih demonstrated that Liao-Wang's scheme has security flaws.Moreover, Hsiang-Shih proposed an improvement scheme which resolves the security flaws of Liao-Wang scheme.In this paper, we propose an enhanced remote user authentication scheme which maintains the merits of Hsiang-Shih's scheme.Performance evaluation demonstrated the efficiency of the proposed scheme over related works.Security analysis proved that the proposed scheme is secure against known attacks.

International Journal of Network Security & Its Applications•Oct 22, 2010•9 citations
In this paper, Duan et al.'s scheme is analyzed. It is showed that this scheme is insecure against offline-guessing attack, replay attack, forgery attack and a session key doesn't be provided after mutual authentication. An improved scheme is proposed that overcomes the above-mentioned security flaws with not affecting the merits of the original scheme. The proposed scheme not only allows the users to choose and change their passwords freely, but also generates a session key agreed by the user and the server.
Password based authentication schemes have been widely used to verify the legitimacy of a user over an insecure communication channel. A common feature among most of the published schemes is that user's identity (ID) is static in all the transaction sessions, which may leak some information about the user and can create risk of identity theft during message transaction. Therefore, to provide user anonymity, many dynamic ID based remote users authentication schemes have been proposed. Recently, Khan et al. proposed an efficient and secure dynamic ID based remote user authentication scheme and claimed that their scheme can provide strong security against various attacks. In this paper, we have demonstrated that Khan et al.'s scheme is vulnerable to server spoofing attack and insider attack, and has some flaws in login and authentication phase as well and also proposed an enhanced scheme to overcome the identified weaknesses.
Remote user authentication is an essential part in electronic commerce to identify legitimate users over the Internet. However, how to protect user privacy in the authentication has become an important issue recently. Therefore, many secure authentication schemes with smart cards have been proposed. In this paper, we will analyze the security weaknesses of two recently proposed authentication schemes for preserving user privacy. First, Chang et al. (2011) proposed a robust and efficient remote user authentication scheme to provide user anonymity. However, this scheme fails to protect user privacy in terms of anonymity and traceability. In addition, it is vulnerable to the server counterfeit attack and it does not provide perfect forward secrecy for session keys. Furthermore, if the smart card is lost, it will suffer from the offline password guessing attack as well as the user impersonation attack. Second, Wen and Li (2012) recently presented an improved dynamic ID-based authentication scheme with key agreement. However, this scheme is vulnerable to traceability. In addition, it does not support perfect forward secrecy for session keys. Furthermore, the insecure offline password change phase and online secret renewal phase will result in the denial of service attack.
Summary. In 2012, Wen and Li proposed a secure and robust dynamic identity based remote user au-thentication scheme with key agreement using smart cards. They claimed that their scheme is efficient and secure. But in this paper, we demonstrate that their scheme is completely insecure and vulnerable to various known attacks like offline and online password guessing attack, impersonation attack, server mas-querading attack, denial of service attack and an insider attack. Also we point out that there are loopholes in password change phase and online secret renew phase which leads to the desynchronization between user and the server and even the legitimate user is rejected by the server. In addition, an adversary can easily generate the common session key of further transmission between user and the server. Thus the entire system collapses and authors claims are proven to be wrong and their scheme will not be secure and efficient for practical purpose.
In 2011, Khan et al. analyzed and improved an enhanced secure dynamic ID-based remote user authentication scheme to overcome the weakness of Wang et al.’s scheme. In 2013, Young-Hwa An showed that Khan et al.’s scheme is not secure because Khan et al.’s scheme can not resist password guessing attack, forgery attack and does not provide user anonymity. After that he proposed a security improvement of dynamic ID-based remote user authentication scheme with session key agreement to remedy the weakness in Khan et al.’s scheme. Recently, through our study, we have found that Young-Hwa An’s mechanism is not secure enough. There still exists insider user’s attack, anonymity attack and forgery attack.
SUMMARY A dynamic user authentication scheme allows a user and a remote server to authenticate each other without leaking the user's identity. In 2011, Wen and Li proposed an improved dynamic ID‐based remote user authentication with key agreement scheme for mobile and home networks. They claimed that their scheme was more secure than the scheme of Wang et al. However, we demonstrate that their scheme is vulnerable to the privileged insider, off‐line password guessing, impersonation, and server spoofing attacks. At the same time, it does not provide any user anonymity and forward secrecy property. Thus, it is not feasible for real‐life implementation.Copyright © 2012 John Wiley & Sons, Ltd.
In 2007, Liao-Wang proposed a dynamic ID-based remote user authentication scheme for multi-server environment using smart cards.However, Hsiang-Shih demonstrated that Liao-Wang's scheme has security flaws.Moreover, Hsiang-Shih proposed an improvement scheme which resolves the security flaws of Liao-Wang scheme.In this paper, we propose an enhanced remote user authentication scheme which maintains the merits of Hsiang-Shih's scheme.Performance evaluation demonstrated the efficiency of the proposed scheme over related works.Security analysis proved that the proposed scheme is secure against known attacks.