Cryptanalysis of Smart-card-based remote User Authentication Scheme for Multi-server Environment

Abstract

The traditional remote user authentication scheme is designed for single-server environment. However, with the increasing of network services, the user is not only required to severally register with each server, but also must store a mass of different identities and passwords. Therefore, a large number of password based remote user authentication scheme for multi-server environment have been proposed by researchers. Unfortunately, all the proposed remote user authentication scheme for multi-server environment have a big design defect in the login phase that user have to use the original static ID to login to server without encrypt. To fix this problem, Li et al. proposed a dynamic ID based remote user authentication scheme for multi-server environment. Recently, Shunmuganathan et al. pointed out that Li et al.'s scheme is vulnerable to off-line password guessing attack, stolen smart card attack and user impersonation attack. Later, they proposed an improved protocol to fix these problems. However, we found that Shunmuganathan et al.'s scheme is still vulnerable to off-line password guessing attack, off-line identity guessing attack and user impersonation attack.