Abstract
A family (tree) of 2-party password-based authentication protocols based on smart cards abounds in security literature, more popularly known as remote user authentication schemes using smart cards. In this paper, we give a generic treatment to the security and analyses of such protocols, tracing back to the original versions due to Hwang et al. and Hwang-Li from which many variants have been derived. Our work here highlights the security implications of taking the break-and-tweak approach to protocol design.
This is a preview of subscription content, log in via an institution to check access.
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Anderson, R. (ed.): Security Engineering: A Guide to Building Dependable Distributed Systems. Wiley Publishing, Chichester (2001)
Awasthi, A.K., Lal, S.: A Remote User Authentication Scheme using Smart Cards with Forward Secrecy. IEEE Trans. on Consumer Electronics 49(4), 1246–1248 (2003)
Boyd, C., Mathuria, A. (eds.): Protocols for Authentication and Key Establishment. Springer, Heidelberg (2003)
Chan, C.K., Cheng, L.M.: Cryptanalysis of a Remote User Authentication Scheme using Smart Cards. IEEE Trans. on Consumer Electronics 46(4), 992–993 (2000)
Chang, C.C., Hwang, K.F.: Some Forgery Attacks on a Remote User Authentication Scheme using Smart Cards. Informatics 14(3), 289–294 (2003)
Ding, Y., Horster, P.: Undetectable On-line Password Guessing Attacks. ACM Operating Systems Review 29(4), 77–86 (1995)
Guillou, L.C., Quisquater, J.-J.: Efficient Digital Public-Key Signature with Shadow (Abstract). In: Pomerance, C. (ed.) CRYPTO 1987. LNCS, vol. 293, Springer, Heidelberg (1988)
Hwang, M.S., Li, L.H.: A New Remote User Authentication Scheme using Smart Cards. IEEE Trans. on Consumer Electronics 46(1), 28–30 (2000)
Hwang, T., Chen, Y., Laih, C.S.: Non-Interactive Password Authentications without Password Tables. In: IEEE Region 10 Conference on Computer and Communication Systems 1990, pp. 429–431 (1990)
Lamport, L.: Password Authentication with Insecure Communication. Communications of the ACM 24(11), 770–772 (1981)
Lee, S.-W., Kim, H.-S., Yoo, K.-Y.: Efficient Nonce-based Remote User Authentication Scheme using Smart Cards. Applied Mathematics and Computation 167(1), 355–361 (2005)
Leung, K.-C., Cheng, L.M., Fong, A.S., Chan, C.-K.: Cryptanalysis of a Modified Remote User Authentication Scheme using Smart Cards. IEEE Trans. on Consumer Electronics 49(4), 1243–1245 (2003)
Nam, J., Kim, S., Park, S., Won, D.: Security Analysis of a Nonce-based User Authentication Scheme using Smart Cards. IEICE Trans. Fundamentals E90A(1), 299–302 (2007)
Phan, R.C.-W., Goi, B.-M.: Cryptanalysis of an Improved Client-to-Client Password-Authenticated Key Exchange (C2C-PAKE) Scheme. In: Ioannidis, J., Keromytis, A.D., Yung, M. (eds.) ACNS 2005. LNCS, vol. 3531, pp. 33–39. Springer, Heidelberg (2005)
Phan, R.C.-W., Goi, B.-M.: Cryptanalysis of the N-Party Encrypted Diffie-Hellman Key Exchange Using Different Passwords. In: Zhou, J., Yung, M., Bao, F. (eds.) ACNS 2006. LNCS, vol. 3989, pp. 226–238. Springer, Heidelberg (2006)
Phan, R.C.-W., Goi, B.-M.: Cryptanalysis of Two Provably Secure Cross-Realm C2C-PAKE Protocols. In: Barua, R., Lange, T. (eds.) INDOCRYPT 2006. LNCS, vol. 4329, pp. 104–117. Springer, Heidelberg (2006)
Schneier, B. (ed.): Applied Cryptography, 2nd edn. John Wiley & Sons, Chichester (1996)
Schneier, B., Shostack, A.: Breaking up is Hard to do: Modeling Security Threats for Smart Cards. USENIX Workshop on Smart Card Technology, USENIX PRESS, pp. 175–185 (1999)
Shen, J.J., Lin, C.W., Hwang, M.S.: A Modified Remote User Authentication Scheme using Smart Cards. IEEE Trans. on Consumer Electronics 49(2), 414–416 (2003)
Stern, J.: Why Provable Security Matters? Advances in Cryptology - Eurocrypt ’03. In: Biham, E. (ed.) Advances in Cryptology – EUROCRPYT 2003. LNCS, vol. 2656, pp. 449–461. Springer, Heidelberg (2003)
Author information
Authors and Affiliations
Editor information
Rights and permissions
Copyright information
© 2007 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Phan, R.C.W., Goi, BM. (2007). On the Analysis and Design of a Family Tree of Smart Card Based User Authentication Schemes. In: Indulska, J., Ma, J., Yang, L.T., Ungerer, T., Cao, J. (eds) Ubiquitous Intelligence and Computing. UIC 2007. Lecture Notes in Computer Science, vol 4611. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-73549-6_118
Download citation
DOI: https://doi.org/10.1007/978-3-540-73549-6_118
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-73548-9
Online ISBN: 978-3-540-73549-6
eBook Packages: Computer ScienceComputer Science (R0)