Efficient password-authenticated key agreement protocol for smart cards based on ECC

Abstract

Today, networks are no longer limited to servers and desktops. A lot of information transfer is done over mobile devices like smart cards, cell phones, PDAs etc. User authentication and session key agreement is an important aspect of a secure information system. In this paper, we propose an efficient password-authenticated protocol for smart cards which provides user authentication and session key agreement. This protocol is based on ECC and has the following merits: 1) The computation and communication cost is low; 2) The password can be freely chosen by the user; 3) There is no time synchronisation problem; 4) It prevents the offline dictionary attack even if the information stored in the smart card is compromised; 5) It provides for mutual authentication and session key agreement; 6) All well known attacks are prevented using our protocol; 7) The identity of the user changes dynamically for every new session.