A provably secure anonymous authentication scheme for Session Initiation Protocol

Abstract

Recently, Lu et al. presented a mutual authentication scheme for Session Initiation Protocol. Lu et al. claimed their scheme provides safeguard against familiar attacks and offers efficient authentication facility. However, this paper divulges that the scheme of Lu et al. is prone to server and user impersonation attacks. Additionally, the scheme of Lu et al. implicates correctness concerns. Consequently, an enhanced scheme is proposed, not only to resolve correctness concerns but also to provide robustness against server and user impersonation attacks. The proposed scheme makes use of a user‐specific secret parameter to deal with the security and correctness issues. The formal and informal security analysis proves the robustness and efficiency of the proposed scheme against all familiar attacks. Furthermore, security analysis is also substantiated through popular automated tool PROVERIF. Copyright © 2016 John Wiley & Sons, Ltd.

Cryptanalysis and improvement of 2 mutual authentication schemes for Session Initiation Protocol

“…We now point out that the protocol of Chaudhry et al is vulnerable to privileged insider attack and lacks password update phase. In the following attacks, we assume that a malicious adversary has completed capable of controlling the public insecure channel.…”

“…Thus, when an adversary is a privileged insider malicious member, can impersonate the legal user to the server. Accordingly, the scheme of Chaudhry et al does not withdrawn privileged inside adversary attack.…”

“…The authors demonstrated that their scheme is vulnerable to many known attacks including those attacks found in the scheme of Zhang et al . Unfortunately, Chaudhry et al proved that the protocol of Lu et al is vulnerable to phony attacks. Meanwhile, Kumari et al also pointed out that the protocol of Lu et al does not resist identity guessing attack and forgery attack.…”

“…Meanwhile, Kumari et al also pointed out that the protocol of Lu et al does not resist identity guessing attack and forgery attack. Unfortunately, we suspect that the protocols of Chaudhry et al and Kumari et al have some potential security vulnerabilities. We find that schemes of Chaudhry et al and Kumari et al used the timestamps to resist replay attack, as we know that authentication protocols with timestamp must consider the difficult problem of clock synchronization.…”

“…Unfortunately, we suspect that the protocols of Chaudhry et al and Kumari et al have some potential security vulnerabilities. We find that schemes of Chaudhry et al and Kumari et al used the timestamps to resist replay attack, as we know that authentication protocols with timestamp must consider the difficult problem of clock synchronization. Thus, those schemes with timestamps may be not suitable for application in some actual scenes.…”