Security on Dynamic ID-based Authentication Schemes

Abstract

Dynamic ID-based authentication schemes based on password and smart card are widely used to provide two-factor authentication and user anonymity. However, these schemes have one or the other possible security weaknesses. In this paper, we analyze the schemes of Li et al. and Wang et al. published in recent years. After the analysis, we demonstrates that Li et al.’s schemes are vulnerable to off-line password guessing attack if the user’s identity is compromised, Li et al.’s scheme cannot withstand the impersonation attack and linkability attack, Wang et al.’s schemes cannot resist off-line password guessing attack if the attacker steals a smart card, Wang et al.’s schemes fail to provide forward security. Our result shows that none of the existing dynamic ID based authentication schemes can achieve all the desirable security goals.