Exploiting hash functions to intensify the remote user authentication scheme

Abstract

Nowadays, the client–server model plays an important part in the Internet architecture. The procedure that a server authenticates a remote user securely has become a significant issue. Hence, many remote user authentication schemes are proposed. Hsiang and Shih pointed out the weaknesses of Yoon et al.'s scheme and proposed an improved scheme not only preserving original merits but also mending the weaknesses. The scheme protects against masquerading attacks, offline password guessing attacks and parallel session attacks. However, He et al. found that Hsiang et al.'s scheme is still vulnerable to password guessing attack, masquerading server attack and masquerading attack. Furthermore, we also found Hsiang–Shih's scheme could be threatened by a malicious insider that can originate an infringed account attack and a resembling account attack. In this paper, we first describe how a malicious insider carries out an infringed account attack and then present a resembling account attack on Hsiang–Shih's scheme. After that, we propose an improvement assisted by hashing functions to enhance Hsiang–Shih's scheme.