Weakness in a User Identification Scheme with Key Distribution Preserving User Anonymity

摘要

Recently, Hsu and Chuang proposed a novel user identification scheme with key distribution for distributed computer networks. The Hsu-Chuang scheme permits a user to anonymously log into a system and establish a secret key shared with the system. In this paper, we show that the Hsu-Chuang scheme is not secure against known session key attacks. To show the insecurity, we describe an adversary who can recover the private key of a user by performing know session key attacks. We also provide a countermeasure which can be used for enhancing the security the Hsu-Chuang scheme.