The Weaknesses of the Virtual Password Authentication Protocol with Cookie

Abstract

Password-based authentication protocols are susceptible to various attacks. Recently, Sood, Sarje, and Singh proposed an inverse cookie-based virtual password authentication protocol. Their protocol is practical and easy to implement. They claim that their scheme is secure to against various attacks, include online dictionary attack, offline dictionary attack, eavesdropping attack, denial of service attack, phishing attack, pharming attack, man-in-the-middle attack, replay attack, leak of verifier attack, message modification or insertion attack, and brute force attack. However, we find that some weaknesses of Sood et al.’s scheme. In this article, we will show that Sood et al.’s scheme is vulnerable to the on-line guessing password attack and the denial of service attack.