A Provably-Anonymous Authentication Scheme for Roaming Services

Abstract

In this work, we extend the widely accepted security model of Bellare, Pointcheval and Rogaway (2000) in order to prove the security of smart-card-based roaming authentication (SRA) schemes. More specifically, in this extended model, we provide formal definitions of authenticated key exchange and user anonymity for SRA schemes, in order to capture side-channel, offline dictionary, and other common attacks. We then present a new SRA scheme and prove its security in our extended model. To the best of our knowledge, our proposed scheme is the first provably-secure SRA scheme that achieves user anonymity. We conclude by demonstrating that our scheme is also computationally efficient relative to other similar published schemes without a security proof.