Browse > Article
http://dx.doi.org/10.33778/kcsa.2022.22.4.179

Vulnerability Attack for Mutual Password Authentication Scheme with Session Key agreement  

Seo Han Na (인제대학교 컴퓨터공학부 )
Choi Youn Sung (인제대학교 AI융합대학)
Publication Information
Convergence Security Journal / v.22, no.4, 2022 , pp. 179-188 More about this Journal
Abstract
Password authentication schemes (PAS) are the most common mechanisms used to ensure secure communication in open networks. Mathematical-based cryptographic authentication schemes such as factorization and discrete logarithms have been proposed and provided strong security features, but they have the disadvantage of high computational and message transmission costs required to construct passwords. Fairuz et al. therefore argued for an improved cryptographic authentication scheme based on two difficult fixed issues related to session key consent using the smart card scheme. However, in this paper, we have made clear through security analysis that Fairuz et al.'s protocol has security holes for Privileged Insider Attack, Lack of Perfect Forward Secrecy, Lack of User Anonymity, DoS Attack, Off-line Password Guessing Attack.
Keywords
Password authentication scheme; Vulnerability analysis; IFP; DLP;
Citations & Related Records
연도 인용수 순위
  • Reference
1 P. Kocher, J. Jaffe, and B. Jun, "Differential power analysis," in Annualinternational cryptology conference. Springer, pp. 388-397, 1999 
2 T. S. Messerges, E. A. Dabbish, and R. H. Sloan, "Examining smart-cardsecurity under the threat of power analysis attacks," IEEE Transactionson Computers, Vol. 51, No. 5, pp.541-552, 2002.    DOI
3 R. Amin, S. Islam, M. K. Khan, A. Karati, D. Giri, and S. Kumari, "A two-factor RSA-based robust authentication system for multiserverenvironments," Security and Communication Networks, Vol. 2017, 2017.
4 김병훈, 신제철, 하옥현, "침입탐지시스템 탐지성능 향상 위한 해시기반 패턴 매칭 시스템," 융합보안논문지, 제9권, 제4호, pp.21-27, 2009. 
5 김성환, 김동성, 송영덕, 박종서, "유비쿼터스 컴퓨팅 보안을 위한 경량 블록 암호 구현," 융합보안논문지, 제5권, 제3호, pp.23-32, 2005. 
6 황득영, 김진묵 "공장 자동화를 위한 RFID 경량암호 프로토콜에 관한 연구," 융합보안논문지, 제16권, 제7호, pp.173-180, 2016. 
7 백용진, 홍석원, 김상복, "클라우드 환경에서 네트워크 가용성 개선을 위한 대칭키 암호화 기반 인증 모델," 융합보안논문지, 제19권, 제5호, pp.47-53, 2019. 
8 노시춘, "DES(Data Encryption Standard) 속성진단과 강화된 대칭키 암호 알고리즘 적용방법," 융합보안논문지, 제12권, 제4호, pp.85-90, 2012. 
9 W.-H Yang and S.-P. Shieh, "Password authentication scheme with smart cards", Computers & Security, Vol. 18, No. 8, pp. 727-733, 1999.    DOI
10 J.-J. Shen, C.-W. Lin, and M.-S. Hwang, "Security enhancement for the timestamp-based password authentication scheme using smart cards", Computers & Security, Vol. 22, No. 7, pp. 591-595, 2003.    DOI
11 E.-J. Yoon, E.-K. Ryu, and K.-Y. Yoo, "Security of Shen et al.'s timestamp-based password authentication scheme," International Conference on Computational Science and Its Applications, Springer, pp. 665-671, 2004.. 
12 C.-C. Yang and R.-C. Wang, "An improvement of security enhancement for the timestamp-based password authentication scheme using smartcards," ACM SIGOPS Operating Systems Review, Vol. 38, No. 3, pp.91-96, 2004. 
13 X. Wang, J. Zhang, W. Zhang, and M. Khan, "Security improvement on the timestamp-based password authentication scheme using smart cards," in 2006 IEEE International Conference on Engineering of Intelligent Systems. IEEE, pp.1-3, 2006. 
14 J.-Y. Liu, A.-M. Zhou, and M.-X. Gao, "A new mutual authentication scheme based on nonce and smart cards," Computer Communications, Vol. 31, No. 10, pp.2205-2209, 2008.    DOI
15 A. K. Awasthi, K. Srivastava, and R. Mittal, "An improved timestamp-based remote user authentication scheme," Computers & Electrical Engineering, Vol. 37, No. 6, pp.869-874, 2011.    DOI
16 T.-H. Chen, G. Horng, and K.-C. Wu, "A secure YS-like user authentication scheme," Informatica, Vol. 18, No. 1, pp.27-36, 2007.    DOI
17 Y. An, "Security enhancements of an improved timestamp-based remote user authentication scheme," in Computer Applications for Security, Control and System Engineering. Springer, pp.54-61, 2012. 
18 S. Kumari, M. K. Gupta, M. K. Khan, and X. Li, "An improved timestamp-based password authentication scheme: comments, cryptanalysis, and improvement," Security and Communication Networks, Vol. 7, No. 11, pp.1921-1932, 2014.    DOI
19 D. Dolev and A. Yao, "On the security of public key protocols," IEEE Transactions on Information Theory, Vol. 29, No. 2, pp.198-208, 1983.    DOI
20 J. Xu, W.-T. Zhu, and D.-G. Feng, "An improved smart card based password authentication scheme with provable security," Computer Standards & Interfaces, Vol. 31, No. 4, pp.723-728, 2009    DOI