Analysis and enhancement of a password authentication and update scheme based on elliptic curve cryptography
Summary: Recently, a password authentication and update scheme has been presented by Islam and Biswas to remove the security weaknesses in Lin and Huang's scheme. Unfortunately, \textit{D. He} [``Comments on a password authentication and update scheme based on elliptic curve cryptography, Cryptology E-Print Archive Report 2011/411 (2011)], \textit{D. Wang} [``On the security of an improved password authentication scheme based on ECC, Lect. Notes Comput. Sci. 7473, 181--188 (2012; \url{doi:10.1007/978-3-642-34062-8_24})] and \textit{C. T. Li} [``A new password authentication and user anonymity scheme based on elliptic curve cryptography and smart card, IET Inf. Secur. 7, No. 1, 3--10 (2013; \url{doi:10.1049/iet-ifs.2012.0058})] have found out that Islam and Biswas' improvement was vulnerable to offline password guessing attack, stolen verifier attack, privilege insider attack, and denial of service attack. In this paper, we further analyze Islam and Biswas' scheme and demonstrate that their scheme cannot resist password compromise impersonation attack. In order to remedy the weaknesses mentioned above, we propose an improved anonymous remote authentication scheme using smart card without using bilinear paring computation. In addition, the verifier tables are no longer existent, and the privacy of users could be protected better. Furthermore, our proposal not only inherits the advantages in Islam and Biswas' scheme, but also provides more features, including preserving user anonymity, supporting offline password change, revocation, reregistration with the same identifier, and system update. Finally, we compare our enhancement with related works to illustrate that the improvement is more secure and robust, while maintaining low performance cost.
- Design of improved password authentication and update scheme based on elliptic curve cryptography
- Security on ``Secure remote login scheme with password and smart card update facilities
- scientific article; zbMATH DE number 6538092
- scientific article; zbMATH DE number 5506913
- An analysis on the weakness of Das et al.'s remote user authentication scheme
- A New Client-to-Client Password-Authenticated Key Agreement Protocol
- A password authentication scheme over insecure networks
- An Efficient and Provably Secure Cross-Realm Client-to-Client Password-Authenticated Key Agreement Protocol with Smart Cards
- Design of improved password authentication and update scheme based on elliptic curve cryptography
- Elliptic Curve Cryptosystems
- scientific article; zbMATH DE number 2009963 (Why is no real title available?)
- scientific article; zbMATH DE number 2114384 (Why is no real title available?)
- Modeling Key Compromise Impersonation Attacks on Group Key Exchange Protocols
- Provable secure and efficient digital rights management authentication scheme using smart card based on elliptic curve cryptography
- Cryptanalysis and improvement of an access control in user hierarchy based on elliptic curve cryptosystem
- Design of improved password authentication and update scheme based on elliptic curve cryptography
- Elastic password authentication scheme using the Passcell-based virtual scroll wheel
- scientific article; zbMATH DE number 5506913 (Why is no real title available?)
- An analysis on the weakness of Das et al.'s remote user authentication scheme
This page was built for publication: Analysis and enhancement of a password authentication and update scheme based on elliptic curve cryptography
Report a bug (only for logged in users!)Click here to report a bug for this page (MaRDI item Q2336256)
