Security Issues of Chen et al.'s Dynamic ID-Based Authentication Scheme

Abstract

Chen et al. proposed in 2012, a dynamic ID-based authentication scheme for Telecare Medical Information Systems. Chen et al. preferred simpler computations unlike previous schemes proposed for TMIS, so they designed a computational complexity-free protocol. But it entails many security concerns. Here we show that an adversary can cheat the lawful participants of the scheme, can compute the agreed upon session-key; which renders the communication between the participants as un-confidential. We further illustrate that in-spite of using dynamic identity during login phase their scheme does not provide user anonymity. We also demonstrate that their design invites password guessing attack, stolen verifier attack and has an incomplete password change phase.

An Improved Anonymous Remote user Authentication Scheme with Key Agreement based on Dynamic Identity

“…But adversary may obtain the ID and other massages to disguise as a user to log into the remote systems. And many static ID-based remote user authentications can't provide users with the convenience of password change or verify the validity of the login requests without any verify Table. To overcome these risks and improve the efficiency and security, many applications and researches [12][13][14][15][16][17][18][19][20][21] based on dynamic ID have been done. And owing to the features of portability, low cost, cryptographic and computational capacity, the smart cards are used in the scheme of authentication on a large scale.…”