Cryptanalysis and improvement of a Multi-Server Authenticated Key Agreement by Chen and Lee’s Scheme

Abstract

Multi-server authentication makes convenient to benefit from services of various service providers on the basis of one-time registration through a trusted third party. Since, the users are reluctant to register themselves separately from all servers due to the hassle of remembering many passwords and other cost constraints. The multi-server authentication enables the immediate provision of services by the real-time verification of users on an insecure channel. The literature for multi-server oriented authenticated key agreement could be traced Information Technology and Control 2018/3/47 432 back to Li et al. and Lee et al., in 2000.Since then, numerous multi-server authentication techniques have been put forth. Nonetheless, the research academia looks for more secure and efficient authentication protocols. Recently, Chen and Lee's scheme presented a two-factor multi-server key agreement protocol, which is found to be prone to impersonation, stolen smart card, key-compromise impersonation attack, and trace attacks. Besides, the scheme is also found to have the inefficient password modification procedure. We propose an improved protocol that counters the above limitations in almost an equivalent computation cost. Moreover, our protocol is supplemented with formal security analysis using BAN logic along with performance analysis and evaluation.

An anonymous authenticated key-agreement scheme for multi-server infrastructure

“…The security traits and the scrutiny of defending to numerous attacks for different schemes are described in Table 2, in which the proposed protocol is signified as a strong corroborated key-agreement in contrast to former schemes. Table 2 presents the analysis of our schemes with related schemes [20][21][22][23]25]. As per the analysis, we can conclude that our protocol is more secure than [20][21][22][23]25].…”

“…Table 2 presents the analysis of our schemes with related schemes [20][21][22][23]25]. As per the analysis, we can conclude that our protocol is more secure than [20][21][22][23]25]. All these protocols depend upon hash-based symmetric cryptography and similar in nature.…”

“…In this section, the robustness of proposed protocol is assessed with respect to other schemes [20][21][22][23]25] based on multi server architecture. The security traits and the scrutiny of defending to numerous attacks for different schemes are described in Table 2, in which the proposed protocol is signified as a strong corroborated key-agreement in contrast to former schemes.…”

“…Moreover, password change phase becomes more complex due to involvement of RC. Then, Irshad et al [25] proves that the protocol [23] is insecure against smart card stolen attack that helps to reveal the session key and password. The protocol [23] is also vulnerable to trace and spoofing attacks.…”

On the Security of a Secure and Lightweight Authentication Scheme for Next Generation IoT Infrastructure

“…After mutual authentication, both the communicating parties establish a session key which can be further used to secure communication among them for accessing the services from a remote server by a legal user. Starting from the seminal work designed by Lamport [12] in 1981, several remote user authentication mechanisms have been proposed in the literature [13]- [19]. However, the major of these schemes are inefficient for practical implementations or they are vulnerable to various potential attacks, such as privileged-insider attack, stolen smart card attack, replay and man-in-the-middle attacks, impersonation attacks, and so on.…”