Attacks on Young-Hwa An’s Improved Dynamic ID-Based Remote User Authentication Scheme

Abstract:

In 2011, Khan et al. analyzed and improved an enhanced secure dynamic ID-based remote user authentication scheme to overcome the weakness of Wang et al.’s scheme. In 2013, Young-Hwa An showed that Khan et al.’s scheme is not secure because Khan et al.’s scheme can not resist password guessing attack, forgery attack and does not provide user anonymity. After that he proposed a security improvement of dynamic ID-based remote user authentication scheme with session key agreement to remedy the weakness in Khan et al.’s scheme. Recently, through our study, we have found that Young-Hwa An’s mechanism is not secure enough. There still exists insider user’s attack, anonymity attack and forgery attack.

• Periodical: Applied Mechanics and Materials (Volumes 556-562)
• Pages: 5235-5238
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.556-562.5235
• Online since: May 2014
• Authors: Cheng Qiang Xu*, Zhen Li Zhang
• Keywords: Anonymity, Authentication, Dynamic, Forgery Attack, Security, Session Key Agreement

References

[1] Lamport L. Password authentication with insecure communication, Communications of the ACM, 24 (1981)770-772.

DOI: 10.1145/358790.358797

[2] M.S. Hwang, L.H. Li, A new remote user authentication scheme using smart cards, IEEE Transactions on Consumer Electronics , 46(1)(2000)28-30.

DOI: 10.1109/30.826377

[3] H.M. Sun, An efficient remote user authentication scheme using smart cards, IEEE Transactions on Consumer Electronics, 46(4)(2000) 958-961.

DOI: 10.1109/30.920446

[4] H.Y. Chien, J.K. Jan, Y.M. Tseng, An efficient and practical solution to remote authentication: smart card, Computers and Security, 21(4) (2002)372-375.

DOI: 10.1016/s0167-4048(02)00415-7

[5] C.L. Hsu, Security of Chien et al. 's remote user authentication scheme using smart cards, Computer Standards and Interfaces, 26(3)(2004)167-169.

DOI: 10.1016/s0920-5489(03)00094-1

[6] M. Kumar, New remote user authentication scheme using smart cards, IEEE Transactions on Consumer Electronics, 50(2)(2004)597-600.

DOI: 10.1109/tce.2004.1309433

[7] Mun, Jongho; Jin, Qiuyan; Jeon, Woongryul; Won, Dongho, An Improvement of Secure Remote User Authentication Scheme Using Smart Cards, T Convergence and Security (ICITCS), 2013 International Conference on, p.1– 4, (2013).

DOI: 10.1109/icitcs.2013.6717804

[8] M.K. Khan, J. Zhang, Improving the security of a flexible biometrics remote user authentication scheme, Computer Standards & Interfaces, 29(2007)82-85.

DOI: 10.1016/j.csi.2006.01.002

[9] M.K. Khan, Fingerprint biometric-based self-authentication and deniable authentication scheme for the electronic world, IETE Technical Review, 3(2009)191-195.

DOI: 10.4103/0256-4602.50703

[10] Manik Lal Das, Ashutosh Saxena, Ved P. Gulati, A dynamic ID-based remote user authentication scheme, IEEE Transactions on Consumer Electronics, 50(2)(2004)629-631.

DOI: 10.1109/tce.2004.1309441

[11] K. Amit, Awasthi, Sunder Lal, Security analysis of a dynamic ID-based remote user authentication scheme, [EB/OL]. Available from: <http: eprint. iacr. org/2004/238>, (2005).

[12] Awasthi AK. Comment on a dynamic ID-based remote user authentication scheme. Trans Cryptol, 1(2) (2004)15-16.

[13] Ku WC, Chan ST. Impersonation attacks on a dynamic ID-based remote user authentication scheme using smart cards. IEICS Trans Commun, E88B (5) (2005)2165-2167.

DOI: 10.1093/ietcom/e88-b.5.2165

[14] Misbahuddin M, Bindu CS. Cryptanalysis of Liao-Lee-Hwang's dynamic ID scheme. Int J Netw Secur, 2(6) (2008)211-213.

[15] Yan-yan Wang, Jia-yong Liu, Feng-xia Xiao, Jing Dan, A more efficient and secure dynamic ID-based remote user authentication scheme, Computer Communications, (32)(2009) 583-585.

DOI: 10.1016/j.comcom.2008.11.008

[16] Su R, Cao ZF. An efficient anonymous authentication mechanism for delay tolerant networks, Comput Electr Eng, 3(36) (2010)435-441.

DOI: 10.1016/j.compeleceng.2009.11.001

[17] Yoon EJ, Yoo KY, Ha KS, A user friendly authentication scheme with anonymity for wireless communications, Comput Electr Eng, 3(37) (2011)356-364.

DOI: 10.1016/j.compeleceng.2011.03.002

[18] F. Wen and X. Li, An improved dynamic ID-based remote user authentication with key agreement scheme, Computers and Electrical Engineering, 38(2012)381-387.

DOI: 10.1016/j.compeleceng.2011.11.010

[19] M.K. Khan, S.K. Kim and K. Alghathbar, Cryptanalysis and Security Enhancement of a' More Efficient and Secure Dynamic ID-based Remote User Authentication Scheme', Computer Communications, 34(3) (2011)305-309.

DOI: 10.1016/j.comcom.2010.02.011

[20] T. S. Messages, E. A. Dabbish and R.H. Sloan, Examining Smart-Card Security under the Threat of Power Analysis Attacks, IEEE Transactions on Consumers, 51(5) (2002)541-552.

DOI: 10.1109/tc.2002.1004593

[21] P. Kocher, J. Jaffe and B. Jun, Differential Power Analysis, Proceedings of Advances in Cryptology, pp.388-397, (1999).