Security of the Jan-Tseng integrated schemes for user authentication and access control

Abstract

The authors show that two proposed password-based user authentication and access control schemes by Jan and Tseng are not secure against impersonation attack, i.e. an adversary can successfully pretend to be any legitimate user and take over all access rights granted to that user without being detected. The authors also present corrections to these two schemes, and provide the same administration functions as orignally intended.