AN IMPROVED DOS-RESISTANT ID-BASED PASSWORD AUTHENTICATION SCHEME WITHOUT USING SMART CARD

In 2010,Hwang,et al.proposed a ＇DoS-resistant ID-based password authentication scheme using smart cards＇ as an improvement of Kim-Lee-Yoo＇s ＇ID-based password authentication scheme＇.In this paper,we cryptanalyze Hwang,et al.＇s scheme and point out that the revealed session key could threat the secur...

Full description

Saved in:
Bibliographic Details
Published inJournal of electronics (China) Vol. 28; no. 4; pp. 580 - 586
Main Authors Wen, Fengtong, Li, Xuelei, Cui, Shenjun
Format Journal Article
LanguageEnglish
Published Heidelberg SP Science Press 01.11.2011
Subjects
Electrical Engineering
Engineering
Key agreement
Nonce
Forward security
TP309
Authentication
Mobile device
Online AccessGet full text

Cover

More Information
Summary:In 2010,Hwang,et al.proposed a ＇DoS-resistant ID-based password authentication scheme using smart cards＇ as an improvement of Kim-Lee-Yoo＇s ＇ID-based password authentication scheme＇.In this paper,we cryptanalyze Hwang,et al.＇s scheme and point out that the revealed session key could threat the security of the scheme.We demonstrate that extracting information from smart cards is equal to knowing the session key.Thus known session key attacks are also effective under the as-sumption that the adversary could obtain the information stored in the smart cards.We proposed an improved scheme with security analysis to remedy the weaknesses of Hwang,et al.＇s scheme.The new scheme does not only keep all the merits of the original,but also provides several additional phases to improve the flexibility.Finally,the improved scheme is more secure,efficient,practical,and convenient,because elliptic curve cryptosystem is introduced,the expensive smart cards and synchronized clock system are replaced by mobile devices and nonces.
Bibliography:11-2003/TN
Authentication Key agreement Forward security Mobile device Nonce
In 2010,Hwang,et al.proposed a ＇DoS-resistant ID-based password authentication scheme using smart cards＇ as an improvement of Kim-Lee-Yoo＇s ＇ID-based password authentication scheme＇.In this paper,we cryptanalyze Hwang,et al.＇s scheme and point out that the revealed session key could threat the security of the scheme.We demonstrate that extracting information from smart cards is equal to knowing the session key.Thus known session key attacks are also effective under the as-sumption that the adversary could obtain the information stored in the smart cards.We proposed an improved scheme with security analysis to remedy the weaknesses of Hwang,et al.＇s scheme.The new scheme does not only keep all the merits of the original,but also provides several additional phases to improve the flexibility.Finally,the improved scheme is more secure,efficient,practical,and convenient,because elliptic curve cryptosystem is introduced,the expensive smart cards and synchronized clock system are replaced by mobile devices and nonces.
ISSN:0217-9822
1993-0615
DOI:10.1007/s11767-012-0712-3