An Improved Smart Card Based Remote user Authentication Scheme with Session Key Agreement During the Verification Phase

摘要

In 2009, Hsiang-Shih’s proposed an improvement toYoon-Ryu-Yoo’s scheme to prevent offline password guessattack and parallel session attack; and Kim-Chung proposed amore secure improvement to Yoon-Yoo’s scheme to with standoffline password leak, masquerading attacks and stolen verifierattack. This article shows that the two improved schemes arestill vulnerable to offline password guess attack, insider attackor extended insider attack, denial of service attack and othersecurity flaws. We also propose an improved scheme that notonly retains the advantages of the aforementioned schemes butalso enhances its security by withstanding the flaws discussed.