Security Enhancement of an Improved Remote User Authentication Scheme with Key Agreement

Kaul, Sonam Devgan; Awasthi, Amit K.

doi:10.1007/s11277-016-3297-6

Cited by 53 publications

(69 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This subsection describes the threat model. Based on previous researches [5][6][7][8][9][10][11][12][13][14][16][17][18][19], we constructed several common assumptions, including the capabilities of an attacker.…”

Section: Threat Modelmentioning

confidence: 99%

“…In this section, we briefly review the Kaul and Awasthi's scheme [14] to examine the cryptanalysis on their scheme. It consists of the following phases: registration, login, authentication, and password change.…”

Section: Review Of the Kaul And Awasthi's Schemementioning

confidence: 99%

“…Recently, Kaul and Awasthi [14] proved that Kumari et al 's proposal [13] fails to protect important security parameters and session key shared between communication parties. With compensating these defections, they presented their own authentication method [14], claiming it can resist different types of attacks. However, we discovered that they compromise several security flaws.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Efficient and Secure Biometric-Based User Authenticated Key Agreement Scheme with Anonymity

Kang

Jung

Kim

et al. 2018

Security and Communication Networks

View full text Add to dashboard Cite

At present, a number of users employ an authentication protocol so as to enjoy protected electronic transactions in wireless networks. In order to establish an efficient and robust the transaction system, numerous researches have been conducted relating to authentication protocols. Recently, Kaul and Awasthi presented an user authentication and key agreement scheme, arguing that their scheme is able to resist various types of attacks and preserve diverse security properties. However, this scheme possesses critical vulnerabilities. First, the scheme cannot prevent two kinds of attacks, including off-line password guessing attacks and user impersonation attacks. Second, user anonymity rule cannot be upheld. Third, session key can be compromised by an attacker. Fourth, there is high possibility that the time synchronization trouble occurs. Therefore, we suggest an upgraded version of the user authenticated key agreement method that provides enhanced security. Our security and performance analysis shows that compared, to other associated protocols, our method not only improves the security level but also ensures efficiency.

show abstract

Section: Threat Modelmentioning

confidence: 99%

Section: Review Of the Kaul And Awasthi's Schemementioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Efficient and Secure Biometric-Based User Authenticated Key Agreement Scheme with Anonymity

Kang

Jung

Kim

et al. 2018

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…In 2016, Kang et al [44] showed that Djellali et al 's scheme [45] suffers from offline dictionary attack, impersonation attack, and replay attack and then developed an enhanced scheme that achieves user anonymity with a Markov chain; and Kaul et al [46] also designed an improved authentication scheme based on Kumari et al 's scheme [34]. These schemes all claim to be resistant to various attacks, such as offline dictionary attack and impersonation attack.…”

Section: Our Contributionsmentioning

confidence: 99%

“…Kaul et al 's Scheme. This section gives a brief review of Kaul et al 's scheme [46] (Figure 3), and password change phase is also omitted.…”

Section: Security and Communication Networkmentioning

confidence: 99%

Cryptanalysis of Three Password-Based Remote User Authentication Schemes with Non-Tamper-Resistant Smart Card

Wang¹,

Xu²

2017

Security and Communication Networks

View full text Add to dashboard Cite

Remote user authentication is the first step to guarantee the security of online services. Online services grow rapidly and numerous remote user authentication schemes were proposed with high capability and efficiency. Recently, there are three new improved remote user authentication schemes which claim to be resistant to various attacks. Unfortunately, according to our analysis, these schemes all fail to achieve some critical security goals. This paper demonstrates that they all suffer from offline dictionary attack or fail to achieve forward secrecy and user anonymity. It is worth mentioning that we divide offline dictionary attacks into two categories: (1) the ones using the verification from smart cards and (2) the ones using the verification from the open channel. The second is more complicated and intractable than the first type. Such distinction benefits the exploration of better design principles. We also discuss some practical solutions to the two kinds of attacks, respectively. Furthermore, we proposed a reference model to deal with the first kind of attack and proved its effectiveness by taking one of our cryptanalysis schemes as an example.

show abstract

A novel and provably secure mutual authentication protocol for cloud environment using elliptic curve cryptography and fuzzy verifier

Patel

Shukla

Patel

2023

Concurrency and Computation

View full text Add to dashboard Cite

SummaryCloud computing is an emerging paradigm that enables on‐demand data storage without considering the local infrastructure limitations of end‐users. The extensive growth in number of servers, resources, and networks intensifies security and privacy concerns in clouds. This necessitates secure mutual authentication and key agreement mechanism to verify the legitimacy of participating entities. In accordance, several authentication protocols have been designed to authenticate end‐users over insecure channels. This article presents security analysis of recent protocols that claim to render security and privacy features. We demonstrate that Kaur et al.'s protocol is vulnerable to replay attack, Dharminder et al.'s protocol is prone to user traceability and known session‐specific temporary information (KSSTI) attacks, and Bouchaala et al.'s protocol is prone to replay and KSSTI attacks. To withstand the aforementioned attacks, we propose an enhanced protocol based on fuzzy verifier and elliptic curve cryptography for clouds. Our protocol safeguards against security attacks while providing privacy functionalities. The security analysis is illustrated under real‐or‐random model, and correctness is verified under the Scyther security verification tool. Finally, comparative analysis with existing protocols shows that our protocol delivers robust security with reasonable computational and communication overheads than state‐of‐the‐art protocols.

show abstract

Security Enhancement of an Improved Remote User Authentication Scheme with Key Agreement

Cited by 53 publications

References 15 publications

Efficient and Secure Biometric-Based User Authenticated Key Agreement Scheme with Anonymity

Efficient and Secure Biometric-Based User Authenticated Key Agreement Scheme with Anonymity

Cryptanalysis of Three Password-Based Remote User Authentication Schemes with Non-Tamper-Resistant Smart Card

A novel and provably secure mutual authentication protocol for cloud environment using elliptic curve cryptography and fuzzy verifier

Contact Info

Product

Resources

About