# A Robust Mutual Authentication with a Key Agreement Scheme for Session Initiation Protocol
## 2 Review of [PERSON] et al.'s Scheme
### Login and Authentication Phase
#### 2.2.2.2. CASE-2: Login and Authentication Phase with Password Updating  
**Step 1:**: The client inserts the memory device and inputs \(ID_{i}\) and \(PW_{i}\). Then, \(V_{i}=h(ID_{i}||PW_{i}||N_{c})\) is computed. Next, the client generates a random integer \(r_{c}\) and current timestamp \(T_{1}\), and computes \(R_{c}=r_{c}\cdot P\), \(F_{i}=h(V_{i}||A_{i}||C_{i}||T_{1})\).
**Step 2:**: The client selects new password \(PW_{i}^{new}\), and computes \(V_{i}^{new}=h(ID_{i}||PW_{i}^{new}||N_{c})\), \(G_{i}=h(V_{i}^{new}\oplus V_{i}\oplus T_{1}\oplus R_{c})\), \(k_{1}=r_{c}K_{s}\), and \(H_{i}=E_{k_{1}}(realm||F_{i}||A_{i}||C_{i}||T_{1}\)\(||V_{i}^{new}||G_{i}||CHANGEPW)\). Lastly, the client sends the REQUEST message \(\{H_{i},R_{c}\}\) to the server.
**Step 3:**: When the server receives the REQUEST message, it obtains the data \(\{realm||F_{i}||A_{i}||C_{i}||T_{1}||V_{i}^{new}||G_{i}||CHANGEPW\}\) by decrypting \(H_{i}\) with \(k_{2}=k_{s}R_{c}\). Then, the server verifies the validity of \(T_{1}\), and if it is valid, \(B_{i}^{\prime}=h(A_{i}||k_{s})\) is computed \(V_{i}^{\prime}\) is obtained by decrypting \(C_{i}\). Next, the server computes \(F_{i}^{\prime}=h(V_{i}^{\prime}||A_{i}||C_{i}||T_{1})\), \(G_{i}^{\prime}=h(V_{i}^{new}\oplus V_{i}^{\prime}\oplus T_{1}\oplus R_{c})\) and checks whether \(F_{i}^{\prime}=F_{i}\) and \(G_{i}^{\prime}=G_{i}\) hold or not. If they do, then the server executes Step 4; otherwise, the server stops the authentication process.
**Step 4:**: The server generates a random integer \(r_{s}\), timestamp \(T_{2}\), and computes \(R_{s}=r_{s}\cdot P\), \(J_{i}=h(V_{i}^{\prime}\oplus F_{i}^{\prime}\oplus r_{s}R_{c}\oplus T_{2})\), \(C_{i}^{new}=E_{B_{i}}(V_{i}^{new})\), \(SK=h(V_{i}^{\prime}\oplus r_{s}R_{c}\oplus T_{2})\), and \(L_{i}=E_{k_{2}}(R_{s}||I_{i}||T_{2}||C_{i}^{new}||realm)\). Finally, the server sends the ACCEPT message \(\{L_{i}\}\) to the client.
**Step 5:**: On receiving the ACCEPT message, the client obtains \(\{R_{s}||I_{i}||T_{2}||C_{i}^{new}||realm\}\) by decrypting \(L_{i}\) with \(k_{2}\). Then, the client verifies the validity of \(T_{2}\). If \(T_{2}\) is valid, \(J_{i}^{\prime}=h(V_{i}\oplus F_{i}\oplus r_{c}R_{s}\oplus T_{2})\) is computed and checks whether \(J_{i}^{\prime}=J_{i}\) holds or not. If it holds, \(SK=h(V_{i}\oplus r_{c}R_{s}\oplus T_{2})\) is computed and \(C_{i}\) is replaced with \(C_{i}^{new}\); otherwise, the authentication process is stopped.  
**3. Flaws and Inefficiencies of [PERSON] et al.'s Scheme**  
Although [PERSON] et al. claimed that their scheme could resist various types of attacks, we have found that their scheme cannot withstand an offline password guessing attack nor a stolen memory device attack. Furthermore, their scheme lacks a verification mechanism for a wrong password, and the password updating process is not efficient. In this section, we describe our findings in detail.  
We first illustrate the attacker model under a three-factor authentication scheme [12; 13; 14]. Assume that an attacker \(A\) has the following capabilities.  
1. \(A\) has the full control of the public channel, but not the secure channel. That means \(A\) can obtain all the transmitted data in the login and authentication phase.
2. \(A\) can alter, delete, or replay the data that was captured from the public channel.  
\(A\) has the ability to read or extract the secret data from the stolen smart card issued to a user.  
\(A\) knows the authentication scheme since \(A\) can be an outsider user or a legal user.