Security analysis and design of an efficient ECC‐based two‐factor password authentication scheme

Abstract

Client‐server‐based communications provide a facility by which users can get several services from home via the Internet. As the Internet is an insecure channel, it is needed to protect information of communicators. An authentication scheme can fulfill the aforementioned requirements. Recently, Huang et al. presented an elliptic curve cryptosystem‐based password authentication scheme. This work has demonstrated that the scheme of Huang et al. has security weakness against the forgery attack. In addition, this paper also presented that the scheme of Huang et al. has some design drawbacks. Therefore, this paper has focused on excluding the security vulnerabilities of the scheme of Huang et al. by proposing an elliptic curve cryptosystem‐based password authentication scheme using smart card. The security of our scheme is based on the hardness assumption of the one‐way hash functions and elliptic curve discrete logarithm problem. Furthermore, we have demonstrated that our scheme is secured against known attacks. The performance of our scheme is also nearly equal when compared to related competing schemes. Copyright © 2016 John Wiley & Sons, Ltd.

Cryptanalysis and improvement of a biometric‐based remote user authentication protocol usable in a multiserver environment

“…This section delineates formal security analysis with the help of a random oracle model (ROM) to prove that an attacker cannot obtain identity I D i , password P W i , biometric B i , and session key S K . The formal security verification procedure is similar to the one in previous works . We first represent the concept of negligible function, collision resistance property, and Reveal oracle in Definitions 1, 2, 3, and 4, respectively, and after this, we prove the theorems.…”

“…In a single‐server environment, a user must register himself to every application server for accessing different types of on‐demand services. Many authentication protocols for single‐server environments have been devised . In a single‐server environment, for accessing different servers, one needs to remember many pairs of different secret pieces of information (e.g., user identity and password), which is the main issue in such environment.…”

Anonymous and expeditious mobile user authentication scheme for GLOMONET environments

“…• Strong security resistance: The authentication scheme must have the capabilities to provide the mutual authentication, backward secrecy, and forward secrecy. [5][6][7] Furthermore, it must support the resilience against the various kind of attacks, including man-in-the-middle attack, lost smartcard attack, session key stealing attack, and replay attack.…”

“…Therefore, it is essential that only the H A of M U is allowed to know the I D M during these roaming activities. Low communication and computation complexity: The authentication scheme should consume less bandwidth; in other words, the number of communications and parameters used during the authentication should be less. In addition to that the authentication scheme must maintain reasonable computational cost and low execution time. Strong security resistance: The authentication scheme must have the capabilities to provide the mutual authentication, backward secrecy, and forward secrecy . Furthermore, it must support the resilience against the various kind of attacks, including man‐in‐the‐middle attack, lost smartcard attack, session key stealing attack, and replay attack.…”

A Three Factor Remote User Authentication Scheme Using Collision Resist Fuzzy Extractor in Single Server Environment

“…However, Shimizu et al [4] showed that the Lamport's scheme [3] suffers from different attacks. After that so many remote user authentication schemes [5][6][7][8][9][10][11][12][13][14][15][16] have been proposed in this regard which are based on only password. But, the researchers have considered biometric feature [2] with the password to enhance the security label.…”