Security-enhanced three-factor remote user authentication scheme based on Chebyshev chaotic maps

Abstract

With the wide deployment of new computing paradigms, such as cloud computing and edge computing, the people can access services provided by remote servers more conveniently via the Internet. To preserve the security of those messages transmitted over the public channel, remote user authentication protocols are popularly implemented in various information systems. Recently, Park et al. pointed that Cao and Ge's three-factor authentication scheme suffers from offline identity guessing attack and server impersonation attack. They also proposed a new scheme after presenting the corresponding cryptanalysis. However, we found that Park et al.'s scheme is vulnerable to offline password guessing attack, which is the most serious threat against this kind of authentication scheme. In addition, their scheme cannot provide complete correctness due to the misuse of bio-hashing and also fails to achieve user untraceability and perfect forward secrecy. To conquer these security pitfalls, we put forward a password, smart card, and biometrics-based three-factor remote user authentication scheme using the extended Chebyshev chaotic maps. The security analysis indicates that the proposed scheme can withstand various well-known attacks including offline guessing attack, impersonation attack, and so on. The performance evaluation shows that the proposed scheme provides stronger security guarantee at the cost of acceptable computation overhead. Thus, the proposed scheme is more desirable for securing communication in mobile networks.

Secure Three‐Factor Anonymous User Authentication Scheme for Cloud Computing Environment

“…According to the results of previous analysis [28,38], we assume that the lengths of the identity, random number, and timestamp are 128, 64, and 32 bits, respectively, for a comparison of the communication costs. The hash function produces 160 bits; the block size of the symmetric encryption is 128 bits; the size of the Chebyshev polynomial is 128 bits; the size of the point multiplication on the elliptic curve is 160 bits.…”

Elliptic Curve Signcryption-Based Mutual Authentication Protocol for Smart Cards

“…Zhao et al [43] have suggested a three-factor authentication mechanism based on Chebyshev chaotic maps for remote users and proved that their scheme can resist against all well-defined attacks, including impersonation attacks and offline password guessing attacks. However, Dharminder and Gupta [44] have demonstrated that chaotic maps-based security schemes fail to protect from stolen smart card attacks, identity guessing attacks, password guessing attacks, impersonation attacks, and session key attacks.…”

An independent three‐factor mutual authentication and key agreement scheme with privacy preserving for multiserver environment and a survey

“…Xu and Wu 46 found that Xie et al's scheme 45 is vulnerable to desynchronization attacks, and proposed an improvement. 35 (A2, A3) 37,38 Choi et al 37 -Park et al 38 (A3, A4) 39 Zhao et al 39 -…”

“…In the same year, Park et al 38 also pointed out that Cao‐Ge scheme 35 is vulnerable to server impersonation and offline identity guessing attacks; they also proposed an improvement. Zhao et al 39 pointed out that Park et al's scheme 38 may suffer offline password guessing attacks, and does not achieve user untraceability and perfect forward secrecy; they proposed a security‐enhanced scheme using the extended Chebyshev chaotic maps. Reddy et al 40 modified two two‐factor–based anonymous MAKA schemes 41,42 to three‐factor–based anonymous MAKA schemes.…”