# Elliptic Curve Signcryption-Based Mutual Authentication Protocol for Smart Cards
## 2 Literature Review  
Authentication and key exchange are the primary security requirements in a user-server model. [PERSON] et al. [7] mentioned that, to implement the authentication process in a client-server environment, approaches based on the certificate, approaches based on the password, and approaches based on the identity are three possible methods. Among these three approaches, password-based approaches are found to be the most suitable in this environment, as they are comparatively simple and easy to implement. In password-based schemes, a user wanting to access some service selects a password and enters this password when using the services offered by a server. The server, in turn, maintains a table with the entries of identities and passwords of the users, so that the validity of passwords entered by the users can be verified. Two-tier authentication methods have been designed to overcome the problem of offline password guessing in password-based methods, as it requires the user to show the credentials through smart cards and enter the password. These two-tier authentication schemes have been found stronger and secure, because even if either of the two secret components, i.e., either the smart card or the password, are revealed to an opponent, the scheme remains secure. However, both components must not be exposed to the opponent together. Due to the higher security of two-tier authentication schemes, the authentication schemes utilizing the smart card and the password have both been discussed under the related work. [PERSON] and [PERSON] [8] designed a two-tier authentication approach using both the smart card and the password, which enhanced the security level of password-based schemes. [PERSON] et al. [9] developed the concept of the smart card and password-integrated authentication mechanism based on dynamic identity. The advantage of the dynamic identity-based approach over the static identity-based approach is that the privacy of the user is not revealed when dynamic identity is used. However, [PERSON] et al. [10] have explored the weakness in [PERSON] et al. 's [9] approach and proved that it is defenseless against  
Figure 3: Communication model. impersonation attack. They have also developed an integrated smart card and password authentication mechanism based on dynamic identity, which can counter the impersonation attack. [PERSON] et al. [11] and [PERSON] et al. [12] have also presented improvements in the earlier presented schemes, but both these schemes have failed to provide security from offline password guessing attacks in the event of a smart card being lost. [PERSON] and [PERSON] [13] have designed a dynamic identity-based authentication mechanism, to facilitate the user authentication in a multi-server environment, and it can be applied in multi-server settings. [PERSON] and [PERSON] [14] have revealed that the mechanism proposed by [PERSON] and [PERSON] [13] cannot counter an insider attack, forgery, or an impersonation attack. [PERSON] and [PERSON] have also presented an authentication approach which removed the weaknesses in the mechanism of [PERSON] and [PERSON] [13]. Later, [PERSON] et al. [15] demonstrated that the scheme of [PERSON] and [PERSON] [14] is susceptible to replay attacks, impersonation attacks, and stolen smart card attacks. However, the protocol of [PERSON] et al. [15] has been unable to defend smart cards from replay attacks and impersonation attacks. [PERSON] et al. [16] have developed a multi-server authentication mechanism which does not use the verification table. This mechanism also facilitates users at remote location to access the services of multiple servers without individual registration. Furthermore, a user is able to change its password securely without registering with the registration center or the server. Later, [PERSON] [17] performed a critical analysis over [PERSON] et al. 's [16] mechanism and figured out that this mechanism failed to provide security from server counterfeit attacks, man-in-the-middle attacks, and user impersonation attacks.