Remote Password Authentication Research Articles

A Provably Secure and Efficient Remote Password Authentication Scheme Using Smart Cards

Communication technology has advanced dramatically amid the 21^st century, increasing the security risk in safeguarding sensitive information. The remote password authentication (RPA) scheme is the simplest cryptosystem that serves as the first line of defence against unauthorised entity attacks. Although the literature contains numerous RPA schemes, to the best of the authors’ knowledge, only few schemes based on the integer factorisation problem (IFP) and the discrete logarithm problem (DLP) that provided a provision for session key agreement to ensure proper mutual authentication. Furthermore, none of the previous schemes provided formal security proof using the random oracle model. Therefore, this study proposed an improved RPA scheme with session key establishment between user and server. The design of the proposed RPA scheme is based on the widely established Dolev-Yao adversary model. Moreover, as the main contribution, a novel formal security analysis based on formal definitions of IFP and DLP under the random oracle model was presented. The proposed scheme's performance was compared to that of other similar competitive schemes in terms of the transmission/computational cost and time complexity. The findings revealed that the proposed scheme required higher memory storage costs in smart cards. Nonetheless, the proposed scheme is more efficient regarding the transmission cost of login and response messages and the total time complexity compared to other scheme of similar security attributes. Overall, the proposed scheme outperformed the other RPA schemes based on IFP and DLP. Finally, the potential application of converting the RPA scheme to a user identification (UI) scheme is considered for future work. Since RPA and UI schemes are similar, the proposed approach can be expanded to develop a provably secure and efficient UI scheme based on IFP and DLP.

Comment and modification of RSA based remote password authentication using smart card

Password based remote user authentication schemes with smart card is one of the important practical solutions for authenticating the remote users. In this paper, we discuss the drawbacks of the scheme RSA based remote password authentication using smart card [16] and propose suitable modifications to overcome its drawbacks and also provide some enhancement. In our scheme, we use the variant of RSA, called RPrime RSA [1], which is used to fast decrypt the message. Our scheme also provides flexibility to a user to easily choose and change his password.

Lightweight Communication Overhead Authentication Scheme Using Smart Card

<p>Authentication takes its place to grant authorized user a remote access to certain online resources. As well, prevent unauthorized user from accessing that resources. Unforyunatly most of authentication schemes consider only security factors without taking in consideration the communication resources required. Recently, Li et. al. proposed an enhanced smart card based remote user password authentication scheme. We analyzed their scheme and we pointed out that, their scheme required high communication overhead. Furthermore, their scheme suffer from forgery, user impersonation and server impersonation attacks. Through this paper to address aforesaid weaknesses, we propose a Lightweight communication overhead authentication scheme using smart card. The security and performance analysis shows that, our proposed scheme is lightweight communication and computation cost as well secure and can withstand wide spectrum of malicious attacks, like forgery, insider, replay and stolen smart card attack. Besides, our scheme encompasses desired security attributes. Therefore, it is suitable for practical use compared to other related scheme. </p>

Remote login password authentication scheme using tangent theorem on circle

A remote password authentication scheme based on a circle is proposed in this paper. In this scheme, we use some simple tangent theorem like secant tangent theorem to authenticate the user and the server. The security of this scheme depends on the tangent points located in a plane associated with the circle and tangent line. In our scheme, a legal user can freely choose and change his password using his smart card.

A Robust and Efficient Password Authentication Scheme Using Smart Cards

Password authentication scheme using smart cards is an important part of securely accessing the server program. In 2012, Chen et al. proposed a robust smart-card-based remote user password authentication scheme. Recently, Li et al. discovered the scheme of Chen et al. cannot really ensure forward secrecy, and it cannot achieve the goal of efficiency for wrong password login. Then, they proposed an enhanced remote user password authentication scheme based on smart cards. In this paper, we propose a novel authentication scheme by using elliptic curve cryptography. The new scheme can achieve both the user anonymity and the goal of efficiency of incorrect password detection, and can also establish a session key for the subsequent secure communication. Moreover, we show by a detailed analysis that it requires lower computation cost while improving the security of the scheme.

Cryptanalysis of an Improved Smartcard-based Remote Password Authentication Scheme

In recent years, several dynamic identity-based two-factor user authentication using password and smartcard have been proposed to provide mutual authentication between the user and server over unreliable networks. However, the design of secure cryptographic schemes is still notoriously hard, and there have been several instances of detected flaws in published schemes. For example in 2010, Hao and Yu demonstrated that Wang et al.'s user authe ntication scheme is insecure against off-line password guessing and server masquerade attacks, and proposed an improved scheme. Subsequently in 2012, Chao pointed out that the improved scheme of Hao and Yu is, unfortunately, susceptible to off-line password guessing and server masquerade attacks, and prone to password backward security problem; and proposed an enhanced scheme. In this paper, we demonstrated that Chao's enhanced scheme is not secure against user masquerade attack, server masquerade attack, insider attack and off-line password guessing attack in violation of its security claim as well as it fails to achieve users' anonymity.

An extended chaotic-maps-based protocol with key agreement for multiserver environments

Due to the rapid development and growth of computer networks, there have been greater and greater demands for remote password authentication protocols. Recently, the focus has been on protocols for multiserver environments that run on smart cards. These protocols typically count on the nonce or timestamp to provide protection against the replay attack. However, as Tsaur et al. pointed out, these protocols have some security issues such as disturbance in clock synchronization and vulnerability to the man-in-the-middle attack. In order to solve the above problems, Tsaur et al. proposed a multiserver authentication scheme with key agreement in 2012, and they claimed that their scheme could effectively achieve password-authenticated key agreement while getting around the technical difficulty of implementing clock synchronization in multiserver environments. Unfortunately, we found out that Tsaur et al.’s protocol still has the following weaknesses: (1) inability to resist privileged insider attack, (2) inability to resist known-plaintext attack, (3) inability to provide user anonymity, and (4) lack of perfect forward secrecy. To fix these secure flaws of Tsaur et al.’s protocol, in this paper, we shall propose an improved multiserver authentication protocol with key agreement based on extended chaotic maps. We shall also offer formal proof of smooth execution of the improved authenticated key agreement protocol.

Geometric based remote password authentication using biometrics

Wu has discussed a geometric based remote password authentication using simple geometric properties of line. Chan and Cheng showed it to be vulnerable and suggested improvement. To provide more security to user authenticated applications combining biometrics with smart cards and passwords is a better solution. However, in such type of schemes, during the authentication phase, biometric characteristics are verified in smart cards only, not in the remote servers. From the remote server point of view, we do not really provide three-factor security, i,e., passwords, fingerprints and smart cards. Another limitation in the schemes available in literature is that they do not have two-way authentication i.e., a user can authenticate the server and the server can authenticate the user. In this paper, we propose a truly three-factor remote authentication scheme in which all three security factors - passwords, smart cards, and biometric data - are examined in the remote servers. This mechanism provides more security to the system. Furthermore, our scheme gives freedom to a user to choose his own password and flexibility to change his password whenever he desires.

Cryptanalysis of two smartcard-based remote user password authentication protocols

Since identity authentication becomes an essential mechanism to ensure robust system security in distributed networks,smartcard-based remote user password authentication protocols have been studied intensively recently.Two recently proposed smartcard-based authentication protocols were examined with the scenario-based attack techniques.The protocol presented in "Cryptanalysis and improvement of Liao et al.'s remote user authentication scheme"(PAN Chun-lan,ZHOU An-min,XIAO Feng-xia,et al.Improved remote user authentication scheme.Computer Engineering and Applications,2010,46(4):110-112) can not withstand the offline password guessing attack as the authors claimed,while the protocol presented in "Improved scheme for smart card password authentication based on bilinear pairings"(DENG Li,WANG Xiao-feng.Improved scheme for smart card password authentication based on bilinear pairings.Computer Engineering,2010,36(18):150-152) is found vulnerable to the Denial of Service(DoS) attack and insider attack.The analytical results show that,both protocols are susceptible to serious security threats and impractical for security-concerned applications.

An improved remote password authentication scheme with smart card

This paper analyzes the security performance of a latest proposed remote two-factor user authentication scheme and proposes an improved scheme based on the dynamic ID to avoid the attacks it suffers. Besides this, in our proposed scheme the password is no longer involved in the calculation of verification phase which makes our scheme more secure and costs less than the old one. At last we analyze the performance of our proposed scheme to prove it provides mutual authentication between the user and the server. Moreover, it also resists password guessing attack, server and user masquerade attack and replay attack effectively.

RSA based remote password authentication using smart card

The smart-card based remote user authentication is one of the important practical solutions for creating a secure computer environment. In this paper, we propose a new remote password authentication technique using RSA public key cryptosystem. Our scheme does not require a system to maintain a password table for verifying the legitimacy of a login user. In addition our scheme can withstand message-replaying attack by embedding a timestamp that helps produce a time-dependent login request.

Security Analysis of Remote Password Authentication Schemes for Multiserver Architecture Using Neural Networks

Security Analysis of Remote Password Authentication Schemes for Multiserver Architecture Using Neural Networks

Security Weaknesses and Improvements of a Remote User Authentication Scheme Preserving User Anonymity

In 2008, Bindu et al. proposed an improvement to Chien et al.'s remote password authentication scheme preserving user anonymity, and has asserted that the scheme is secure against replay attack, guessing attack, insider attack and man-in-the-middle attack, etc. However, in this paper, we have shown that Bindu et al.'s scheme is still insecure against man-in-the-middle attack and password guessing attack, and does not provide user anonymity. Also, we propose an improved scheme to withstand these weaknesses, while preserving their merits, even if the secret information stored in the smart card is revealed. As a result of analysis, the proposed scheme is secure against user impersonation attack, server masquerading attack, password guessing attack and does provide user anonymity. And we can see that the proposed scheme is relatively more effective than Bindu et al.'s scheme.

An efficient and secure multi-server authentication scheme with key agreement

Remote user authentication is used to validate the legitimacy of a remote log-in user. Due to the rapid growth of computer networks, many network environments have been becoming multi-server based. Recently, much research has been focused on proposing remote password authentication schemes based on smart cards for securing multi-server environments. Each of these schemes used either a nonce or a timestamp technique to prevent the replay attack. However, using the nonce technique to withstand the replay attack is potentially susceptible to the man-in-the-middle attack. Alternatively, when employing the timestamp method to secure remote password authentication, it will require the cost of implementing clock synchronization. In order to solve the above two issues, this paper proposes a self-verified timestamp technique to help the smart-card-based authentication scheme not only effectively achieve password-authenticated key agreement but also avoid the difficulty of implementing clock synchronization in multi-server environments. A secure authenticated key agreement should accomplish both mutual authentication and session key establishment. Therefore, in this paper we further give the formal proof on the execution of the proposed authenticated key agreement scheme.

A Security Improved Remote Password Authentication Scheme Using Smart Card

Increasing number of network applications require authentication of the user's identity which is the first step to ensure security. This paper analyzes the security performance of one proposed remote two-factor user authentication scheme and discusses the attacks it suffers. Then we propose an improved scheme based on the RSA cryptography and one-way secure hash function to avoid the attacks it suffers. After that we prove the proposed scheme is autonomous and effective for both sides in the authentication process.

Weaknesses and improvement of Wang et al.'s remote user password authentication scheme for resource-limited environments

Recently, Wang et al. showed that two new verifier-free remote user password authentication schemes, Ku-Chen's scheme and Yoon et al.'s scheme, are vulnerable to an off-line password guessing attack, a forgery attack, and a denial-of-service attack, and then proposed an improved scheme for the real application in resource-limited environments. Unfortunately, we find that Wang et al.'s scheme is still vulnerable to an impersonation attack and an off-line password guessing attack. In addition, Wang et al.'s scheme is not easily reparable and is unable to provide perfect forward secrecy. Finally, we propose an improved scheme with better security strength.

A new method for using hash functions to solve remote user authentication

Recently, Peyravian and Zunic proposed the remote password authentication schemes only based on the collision-resistant hash function. The schemes are, therefore, easy to implement and simple to use. The attractive properties cause a series of discussion. Several security flaws are found and remedied. Unfortunately, most of the remedies either are insecure or violate the original advantages because of involving public-key cryptosystems or modular exponential operations. Hence, it is still a challenge to design a secure scheme abiding by the beneficial assumption of the Peyravian–Zunic schemes. The proposed scheme not only keeps the original advantages (user friendness and computational cheapness) but also highlights certain of valuable features, such as (1) mutual authentication (higher security level), (2) server’s ignorance of users’ passwords (further security guaranee to users, specially for financial services), (3) immunity from maintaining security-sensitive table (maintaining burden reduction to servers), and so forth.

Security enhancement of an IC-card-based remote login mechanism

Wang et al. presented a remote password authentication scheme using IC (Integrated Circuit) cards in 2004. Unfortunately, we discovered that their scheme is unable to withstand the forgery attack. We consequently propose in this paper a novel version to resist this kind of attacks. Furthermore, our scheme can also provide mutual authentication between a remote server and login users. The security of our scheme is based on the public one-way hash function. What is more, the timestamp mechanism is applied in our scheme to protect such potential attacks in the case that an intruder may replay a previously intercepted login request to access the remote server.

Cryptanalysis on Tan-Zhu remote password authentication scheme

Cryptanalysis on Tan-Zhu remote password authentication scheme

An Efficient and Secure Remote Authentication Scheme Using Smart Cards

Security of data communication becomes a crucial challenge due to the rapid development of computer and information technologies. To ensure security of resource transmission, engineers have proposed numerous schemes for protection. Among them, the remote password authentication schemes using smart cards are regarded as very efficient. As a result, smart-card based authentication schemes has become a popular research topic in recent years. In 2000, Hwang and Li proposed a new remote authentication scheme using smart cards based on ElGamal's crypto- system. Unfortunately, the scheme Hwang and Li propose suffers from some secu- rity flaws. In this article, the authors propose a practical and secure version provid- ing mutual authentication, increasing the authentication efficiency, and allowing the user to choose and change his/ her password at will.