Security Analysis of Improved User Authentication Schemes Using Smart Cards

摘要

Smart card based remote user authentication is a broadly adopted method of authentication within insecure communication channels. Recently, Wen and Li proposed a dynamic ID-based remote user authentication protocol with key agreement. Unfortunately, Kim, Nam and Won pointed out that Wen and Li's authentication protocol suffers from leakage of some key information to an adversary and a man-in-the-middle attack. Kim et al. proposed an improved ID-based remote user authentication scheme. In this work, we revisit Kim et al.'s protocol. Our results indicate that their scheme is vulnerable to smart card loss attack, stolen verifier attack and privileged insider attack. Furthermore, the authentication protocol cannot provide perfect forward secrecy and user anonymity. These weaknesses also exist in Wen and Li's authentication scheme.