Analysis and Enhancement of a Password Authentication and Update Scheme Based on Elliptic Curve Cryptography

Abstract

Recently, a password authentication and update scheme has been presented by Islam and Biswas to remove the security weaknesses in Lin and Huang’s scheme. Unfortunately, He et al., Wang et al., and Li have found out that Islam and Biswas’ improvement was vulnerable to offline password guessing attack, stolen verifier attack, privilege insider attack, and denial of service attack. In this paper, we further analyze Islam and Biswas’ scheme and demonstrate that their scheme cannot resist password compromise impersonation attack. In order to remedy the weaknesses mentioned above, we propose an improved anonymous remote authentication scheme using smart card without using bilinear paring computation. In addition, the verifier tables are no longer existent, and the privacy of users could be protected better. Furthermore, our proposal not only inherits the advantages in Islam and Biswas’ scheme, but also provides more features, including preserving user anonymity, supporting offline password change, revocation, reregistration with the same identifier, and system update. Finally, we compare our enhancement with related works to illustrate that the improvement is more secure and robust, while maintaining low performance cost.

Wireless body area networks: A critical review of the state-of-the-art security schemes

“…Similarly, the technique in [95] lacks user anonymity and is vulnerable to smart card loss, offline password guessing and credentials leakage attacks. Consequently, an improved a biometric based distributed key management protocol is developed in [96].…”

A Secure and Lightweight Three‐Factor Remote User Authentication Protocol for Future IoT Applications

“…Usually, the real-time users adopt to use easy-tomemorialize parameters, such as secret keys and identities, for their convenience, as explain in [23][24][25]; hence, user anonymity is not provided. For the enhancement security of IoT WSNs, studies in [26][27][28][29][30] presented lightweight remote user authentication schemes. Nonetheless, these contributions have need of improvements to resist attacks while persevering optimum communication and computation performance.…”

Chaotic-map based authenticated security framework with privacy preservation for remote point-of-care

“…Likewise, an enhanced remote authentication using smart devices was offered to claim that their scheme can prevent password-guessing attacks i.e. online/offline [39]. Additionally, their scheme holds client anonymity to prevent information outflow.…”