Cryptanalysis and improvement on an IC-card-based remote login mechanism

摘要

Wang et al. presented a remote password authentication scheme using IC (integrated Circuit)cards in 2004. Recently,Cheng et al. pointed that the Wang et al.’s scheme is unable to withstand the forgery attack. They consequently proposed a novel version to resist the forgery attack. Although Cheng et al. claimed that their scheme is secure against all known attacks and more practical in application than other IC-card-based authentication schemes,in this paper,we show that Cheng et al. scheme is vulnerable to the guessing attack,parallel session attack and key-compromise attack. To remedy these flaws,this paper proposes an improvement over Cheng et al. scheme with more security.