[Paper Review] Cryptanalysis and Improvement of Jiang et al.'s Smart Card Based Remote User Authentication Scheme

Dheerendra Mishra, Ankita Chaturvedi+1 more|arXiv (Cornell University)|Dec 17, 2013

Advanced Authentication Protocols Security15 references3 citations

TL;DR

This paper cryptanalyzes Jiang et al.'s 2013 smart card-based remote authentication scheme, identifying vulnerabilities including offline and online password guessing attacks, insider attacks, user impersonation, and lack of forward secrecy and anonymity. The authors propose an improved scheme that enhances security with efficient login, user-friendly password change, smart card revocation, and resistance to all major attacks while reducing computational overhead.

ABSTRACT

The smart card based authentication protocols try to ensure secure and authorized communication between remote entities. In 2012, Wei et al. presented an improvement of Wu et al.'s two-factor authentication scheme for TMIS which is proven vulnerable to off-line password guessing attack by Zhu. Zhu also proposed a modified scheme to overcome with weakness of Wei et al.'s scheme, although Lee and Liu showed the failure of his scheme to resist parallel session attacks. Moreover, Lee and Liu introduced an improved scheme. We analyze Wei et al.'s, Zhu's and Lee and Liu's schemes and identify that none of the schemes resist on-line password guessing attack. Moreover, these schemes do not present efficient login and password chance phase. We also show that how inefficient password change phase causes denial of service attack. Further, we propose an improved password based remote user authentication scheme with the aim to eliminate all the drawbacks of previously presented schemes.

Motivation & Objective

• To identify critical security flaws in Jiang et al.'s 2013 remote user authentication scheme using smart cards.
• To demonstrate that the scheme remains vulnerable to offline and online password guessing attacks, insider attacks, and user impersonation.
• To show the scheme fails to ensure user anonymity, forward secrecy, and efficient login and password change phases.
• To propose a new smart card-based authentication scheme that mitigates all identified weaknesses.
• To introduce a smart card revocation mechanism allowing users to recover lost cards without re-registration.

Proposed method

• The authors perform a formal cryptanalysis of Jiang et al.'s scheme, analyzing each phase (registration, login, authentication, password change) for security flaws.
• They identify that the server’s stored value $ B_i = h(ID_i)^{x+PW_i} \mod p $ leaks information about the password through the exponent, enabling offline password guessing.
• The scheme lacks session key verification and does not bind the session key to user identity, making it vulnerable to impersonation and replay attacks.
• The proposed scheme uses a new key derivation mechanism based on $ h(ID_i \parallel a \parallel PW_i) $ to verify password correctness locally on the smart card, enhancing user-friendliness.
• The improved protocol introduces a smart card revocation phase where users can recover lost cards via server assistance, eliminating the need for re-registration.
• The scheme ensures forward secrecy by using ephemeral random values and prevents insider attacks by ensuring the server’s master secret $ x $ is never exposed.

Experimental results

Research questions

• RQ1 Is Jiang et al.'s scheme secure against offline and online password guessing attacks?
• RQ2 Can an insider adversary compromise user identities or passwords using the server’s stored data?
• RQ3 Does the scheme provide user anonymity and forward secrecy?
• RQ4 Is the password change phase efficient and user-friendly?
• RQ5 Can the scheme support smart card revocation without requiring re-registration?

Key findings

• Jiang et al.'s scheme is vulnerable to offline password guessing attacks due to the exposure of $ h(ID_i)^{x+PW_i} \mod p $, which leaks password information.
• The scheme is also susceptible to online password guessing attacks because the server does not rate-limit authentication attempts.
• An insider attacker can compromise user identities and passwords by accessing the server’s database and exploiting the structure of $ B_i $.
• The scheme fails to provide user anonymity, as the user’s identity is transmitted in plaintext during login and is linked to the session key.
• The proposed scheme achieves forward secrecy by using ephemeral random values and ensures session key integrity through verification using $ h(ID_i \parallel a \parallel PW_i) $.
• The improved scheme reduces computational cost: login phase requires $ 4T_h + T_E $, compared to Jiang et al.’s $ 2T_h + T_M + 3T_E $, making it more efficient.