# Revisiting Anonymous Two-Factor Authentication Schemes for IoT-Enabled Devices in Cloud Computing Environments

Authors: Ping Wang; Bin Li; Hongjin Shi; Yaosheng Shen; Ding Wang
Journal: Security and Communication Networks
 (2019)

---

## Abstract

Investigating the security pitfalls of cryptographic protocols is crucial to understand how to improve security. At ICCCS’17, Wu and Xu proposed an efficient smart-card-based password authentication scheme for cloud computing environments to cope with the vulnerabilities in Jiang et al.’s scheme. However, we reveal that Wu-Xu’s scheme actually is subject to various security flaws, such as offline password guessing attack and replay attack. Besides security, user friendly is also another great concern. In 2017, Roy et al. found that in most previous two-factor schemes a user has to manage different credentials for different services and further suggested a user-friendly scheme which is claimed to be suitable for multiserver architecture and robust against various attacks. In this work, we show that Roy et al.’s scheme fails to achieve truly two-factor security and shows poor scalability. At FGCS’18, Amin et al. pointed out that most of existing two-factor schemes are either insecure or inefficient for mobile devices due to the use of public-key techniques and thus suggested an improved protocol by using only light-weight symmetric key techniques. Almost at the same time, Wei et al. also observed this issue and proposed a new scheme based on symmetric key techniques with formal security proofs in the random oracle model. Nevertheless, we point out that both Amin et al.’s and Wei et al.’s schemes cannot achieve the claimed security goals (including the most crucial goal of “truly two-factor security”). Our results invalidate any use of the scrutinized schemes for cloud computing environments.


---

## Body

## 1. Introduction

With the emerging paradigm of cloud computing and Internet of Things (IoT), various services are provided over the cloud and accessed by users from IoT-enable devices (e.g., mobile phones and smart watches). As cloud-based services can be accessed anytime and anywhere just with a connection to the Internet and IoT-enable devices are generally of resource-constrained nature, it is important and challenging to protect users and cloud servers from severe security threats, such as fraudulence, eavesdropping, and falsification, posed either by external attackers or malicious internal entities. To guarantee that the resources and services can only be accessed by legitimate parties, user authentication plays an important part in securing electronic transactions by acquiring collaborative evidence. In 2011, Hao et al. [1] suggested the first two-factor authentication scheme that is based on password and smart cards for the cloud computing environments. This initial work has brought about a number of enhanced proposals [2–9] with each different in terms of security [10], anonymity [11], usability [12], and efficiency [13].Without loss of generality, we consider the most common client-server architecture in which two participants (i.e., a serverS and a user U) get involved in two-factor authentication [14]. User U holds a memorable password and a smart card stored with some initial security parameters, and server S only needs to keep some secret key material of the system. Since there is no need to keep a table with password-related verification information on the server side, the server is free from the threat of password dataset leaks and ameliorated from the burden of maintaining a large password dataset. This feature that makes this type of schemes rather desirable, considering that there are incessant leakages of password databases from large websites[15]. The most important security goal of this kind of schemes is the so-called “two-factor security” [16]. This security concept essentially means that only the user who has the smart card and knows the correct password can be verified by the server.Most of existing two-factor schemes (e.g, [5, 8, 23]) for cloud computing are built on the basis of generic two-factor schemes like [3, 24]. Nevertheless, past research [20, 25–27] have, again and again, proved that designing a smart-card-based password authentication scheme that can attain “two-factor security” is a tough task. In 2009, Xu et al. [28] developed a smart-card-based password authentication scheme relying on the intractability of computational Diffie-Hellman problem, and stated that their scheme is able to support “two-factor security” under the hypothesis that smart cards can be tampered. In addition, their scheme was “proved secure” in the random oracle model. However, later on Sood et al. [29] found that Xu et al.’s scheme cannot resist against user impersonation attack if the parameters kept in the smart cards can be extracted, invalidating Xu et al.’s claim of ensuring “two-factor security”. In 2010, Song [30] independently found this severe flaw in Xu et al.’s scheme. Furthermore, Song presented an improvement to counter the problem emerged in Xu et al.’s scheme.In 2012, Chen et al. [31] pointed out that various security drawbacks still existed in both Sood et al.’s [29] and Song’s [30] schemes. More specifically, Sood et al.’s scheme is susceptible to server impersonation attack and Song’s scheme suffers from offline password guessing attack, in case the attacker can obtain those sensitive information kept in the smart card. Chenet al. [31] also put forward an improved scheme and argued that their scheme is robust under the condition that the sensitive data in smart card has been revealed by the attacker. It should be noted that recent rapid developments in side-channel attacks have proved that the sensitive information stored in general commercial smart cards could be extracted by power analysis or reverse engineering [32, 33]. Based on a weak yet realistic assumption, Chen et al.’s scheme [31] appears very practical.However, soon after Chen et al.’s scheme [31] was presented, Ma et al. [20] figured out that it is susceptible to exactly the same problem (i.e., prone to offline password guessing attack and no supply of forward secrecy) with the original scheme (i.e., Song’s scheme [30]). Based on their past experience of protocol design and analysis, for the first time Ma et al. [20] suggested three generic principles for designing a secure and efficient two-factor protocol, namely, the public-key principle, the forward secrecy principle, and the security-usability balance principle. Unfortunately, none of the two-factor authentication protocols mentioned above can satisfy all these three design principles and, moreover, as we illustrate, all the schemes studied in this work fail to comply with at least one of these principles.In 2017, Wu and Xu [17] also observed that previous schemes (e.g., [30, 31]) are vulnerable to various security loopholes (e.g., user impersonation attack and insider attack) and also suggested an enhanced scheme. Wu-Xu argued that their new scheme not only eradicates the security pitfalls being overlooked in previous schemes but also maintains strengths of previous schemes. Notwithstanding their claims, we will show that this scheme still has several serious defects being overlooked: (
1
) it cannot withstand offline password guessing attack if the data in smart card can be revealed, which means that the primary goal of “truly two-factor security” cannot be satisfying; (
2
) it is subject to replay attack; (
3
) it ensures no timely typo detection.Later on, Roy et al. [19] found that, in Tsai-Lo’s scheme [34], a user has to manage different credentials for different services and further suggested a user-friendly scheme which is claimed to be suitable for multiserver architecture and robust against various attacks. Therefore, this protocol shows a good application potential in multiserver cloud computing environments. In this work, we show that Roy et al.’s scheme fails to achieve truly two-factor security and cannot preserve user untraceability. We observe that the first failure of Roy et al.’s scheme is due in large part to the noncompliance with Ma et al.’s [20] security-usability tradeoff principle. Our attacks highlight the necessity of being aware of basic protocol design principles.In 2018, Amin et al. [21] pointed out that previous schemes (e.g., [35–37]) are vulnerable to various security loopholes (e.g., off-line password guessing attack, insider attack and user impersonation attack) and also developed a new scheme for distributed cloud computing environments. Amin et al. argued that their new scheme not only eradicates the security pitfalls being overlooked in previous schemes but also maintains strengths of previous schemes. Notwithstanding their claims, we will show that this scheme still has several serious defects being overlooked: (
1
) it cannot withstand offline password guessing attack if the data in smart card can be revealed, which means that the primary goal of “truly two-factor security” cannot be satisfied with; (
2
) it provides no forward secrecy; (
3
) it ensures no user untraceability.Very recently, Wei et al. [23] observed that most of previous schemes (e.g., [36–40]) only provided some heuristic security arguments and little attention has been paid to the formal treatment of protocol security. Unsurprisingly, most of them are vulnerable to various security loopholes. Thus, they suggested an enhanced scheme for cloud computing without using computation-expensive public key operations. They employed a new cryptographic primitive called authenticated encryption scheme which can guarantee both message confidentiality and integrity, and showed that their new scheme can be provably secure in the random oracle model. Though this scheme is armed with a formal proof, we will show that this scheme still has several serious defects being overlooked: (
1
) it cannot achieve the primary goal of “truly two-factor security”; (
2
) it provides no forward secrecy; (
3
) it ensures no user untraceability.The remainder of the paper is organized as follows: we revisit Wu-Xu’s scheme in Section2; we describe the security loopholes of Roy et al.’s scheme in Section 3; Amin et al.’s scheme is scrutinized in Section 4 and Wei et al.’s scheme is cryptanalyzed in Section 5. Finally, we conclude the paper in Section 6.


## 2. Revisiting Wu-Xu’s Scheme

### 2.1. Review Wu-Xu’s Scheme

In this section, we briefly review the chaotic-map based authentication scheme for cloud computing proposed by Wu and Xu [17] in ICCCS 2017. Their scheme consists of four phases: initialization, registration, authentication, and password change. For ease of presentation, we will follow the notations in Wu-Xu’s scheme as closely as possible and summarize the notations in Table 1.Table 1
Notations and abbreviations.
Symbol
Description
U
i
i
t
h user
S
remote server
M
malicious attacker
I
D
i
identity of userU
i
P
W
i
password of userU
i
x
the secret key of remote serverS
⊕
the bitwise XOR operation
∥
the string concatenation operation
h
(
⋅
)
collision free one-way hash function
→
a common channel
⇒
a secure channel


#### 2.1.1. Registration Phase

At the very start, the serverS generates a random positive integer s
∈
Z
p
∗ and a symmetric key cryptosystem with E
k
(
.
) and D
k
(
.
) and then selects a secret key x, and two one-way hash functions h
(
.
) and h
1
(
.
).Step R1.
U
i chooses her identity I
D
i, P
W
i and b
i, then computes H
P
W
i
=
h
(
P
W
i
∥
b
i
)Step R2.
U
i
⇒
S
:
{
I
D
i
,
H
P
W
i
}.Step R3.
S selects a random number r
i, computes I
M
i
=
E
x
(
(
I
D
i
⊕
r
i
)
∥
r
i
) and B
1
=
h
(
I
D
i
∥
H
P
W
i
)
⊕
H
P
W
i
⊕
h
(
x
∥
I
M
i
), and stores I
M
i, B
1, h
(
.
), E
k
(
.
)
/
D
k
(
.
), s and p into the smart card.Step R4.
S
⇒
U
i: A smart card containing {
I
M
i, B
1
,
E
k
(
.
)
/
D
k
(
.
)
,
h
(
.
)
,
s
,
p
}.Step R5.
U
i computes B
2
=
h
(
I
D
i
∥
P
W
i
)
⊕
b
i and stores B
2 into the card.


#### 2.1.2. Login and Mutual Authentication Phase

WhenU
i wants to login, the following operations will be performed:Step 1.
U
i inserts the smart card into card reader and inputs I
D
i and P
W
i.Step 2.
Smart card computesb
i
′
=
B
2
⊕
h
(
I
D
i
∥
P
W
i
).Step 3.
Smart card selects two random integersu
∈
[
1
,
p
+
1
] and r
u and computes H
P
W
i
=
h
(
P
W
i
∥
b
i
′
), C
1
=
T
u
(
s
), C
2
=
B
1
⊕
h
(
I
D
i
∥
H
P
W
i
), C
3
=
h
(
I
D
i
∥
C
1
∥
C
2
∥
r
u
), C
4
=
C
2
⊕
C
3, C
5
=
E
C
3
(
I
D
i
∥
C
1
∥
r
u
).Step 4.
Smart card→
S
:
{
C
4
,
I
M
i
,
C
5
}.Step 5.
On receiving the message from smart card,S decrypts I
M
i and gets I
D
i
′ and r
i
′ and then computes C
2
′
=
h
(
x
∥
I
M
i
), C
3
′
=
C
4
⊕
C
2
′.Step 6.
S decrypts C
5 to obtain I
D
i
′
′, C
1
′, and r
u
′, then checks if I
D
i
′
=
?
I
D
i
′
′ and C
3
′
=
?
h
(
I
D
i
′
∥
C
1
′
∥
C
2
′
∥
r
u
′
). If all above verifications are correct, S proceeds. Otherwise, the login request is interrupted.Step 7.
S chooses three random integers v
∈
[
1
,
p
+
1
], r
s and r
i
n
e
w and computes I
M
i
′
=
E
x
(
(
I
D
i
′
⊕
r
i
n
e
w
)
∥
r
i
n
e
w
), C
6
=
T
v
(
s
), s
k
s
=
T
v
(
C
1
′
), C
7
=
h
(
x
∥
I
M
i
′
), C
8
=
h
1
(
I
D
i
′
∥
I
M
i
′
∥
C
1
′
∥
C
2
′
∥
C
6
∥
C
7
∥
s
k
s
∥
r
s
), C
9
=
C
2
′
⊕
C
8, and C
10
=
E
C
8
(
I
M
i
′
∥
C
6
∥
C
7
∥
r
s
), where s
k
s is server-side session key.Step 8.
S
→
U
i
:
{
C
9
,
C
10
}.Step 9.
Smart card calculatesC
8
′
=
C
9
⊕
C
2 and obtains I
M
i
′
′, C
6
′, C
7
′, and r
s
′ by decrypting C
10. Smart card further computes s
k
u
=
T
u
(
C
6
′
) and checks C
8
′
=
?
h
1
(
I
D
i
∥
I
M
i
′
′
∥
C
1
∥
C
2
∥
C
6
′
∥
C
7
′
∥
s
k
u
∥
r
s
′
). If they are not equal, U
i aborts the communication. Otherwise, smart card computes B
1
′
=
C
2
⊕
C
7
′
⊕
B
1 and replaces (
B
1
,
I
M
i
) with (
B
1
′
,
I
M
i
′
′
).


### 2.2. Cryptanalysis of Wu-Xu’s Scheme

In this section, the security loopholes of Wu-Xu’s scheme [17] will be pointed out. More specifically, it is prone to offline password guessing attack and suffers from replay attack, which makes this scheme unpractical for real use. Before giving the detailed security analysis, we first define the various adversary models for smart-card-based password authentication.


#### 2.2.1. Adversary Models

To analyze the security provisions of password-based authentication schemes using smart cards, generally three assumptions about the attacker’s capabilities are made since the landmark work of Yang et al. [24], and we summarize them as follows:Assumption 1.
The malicious attackerM is able to eavesdrop, delete, insert, modify, or block any transcripts communicated in the public channel. That is to say, the communication channel between the common users and the server can be completely manipulated by M. This well complies with the standard adversary model that is widely accepted for distributed computing [41].Assumption 2.
The malicious attackerM can somehow get the victim user’s smart card and use side-channel attack techniques to acquire sensitive security parameters from the card memory, which is reasonable according to the recent research developments in side-channel attacks [32, 33].Assumption 3.
User’s password space is very constrained and the malicious attackerM can offline enumerate it. To be user-friendly, most protocols (e.g., the ones in [3, 24, 42–44]) enable the users to select their own password at will in the initial process of registration or later process of password change. Because human beings are incapable of memorizing random strings, instead they are likely to choose passwords that relate to their personal lives or short strings for convenience. As a result, these human-generated passwords are often very weak and belong to a small dictionary [45–47].Note that the nontamper resistant assumption about smart cards are conditional, i.e., under the conditions that(
1
) smart cards have somehow been in the possession of the attacker for a relatively long time (e.g., at least a few days), which should be sufficient for launching a side-channel attack; (
2
) the user is not on the scene; otherwise the user will observe the attack, for side-channel attacks generally need special instruments and professional/particular operations. This is why smart cards are superior to memory sticks, even though nontamper assumption about smart cards has been made: memory sticks are nontamper resistant unconditional. See more explications in [48].Obviously, if bothAssumptions
2 and 3 hold simultaneously, then an attacker (without any other assumptions/abilities) can successfully impersonate a victim user and any scheme is trivially insecure. Therefore, it is widely regarded that attackers should not be granted to obtain a victim user’s smart card as well as his password [3, 24, 49].In [17], Wu and Xu reported that their scheme is secure under the above three assumptions. For example, they stated that their scheme can withstand offline password guessing attacks even if the security parameters in smart card have been extracted. However, contrary to their claims, we will illustrate that this scheme is still vulnerable to offline guessing as well as other pitfalls. Based on the above listed assumptions, we cryptanalyze the security provisions of Wu-Xu’s scheme in the following and assume that M can extract the secret data {
B
1
,
B
2
,
h
(
·
)
,
E
k
(
·
)
,
D
k
(
·
)
} stored in U
i’s smart card, and M can also eavesdrop the messages {
C
4
,
I
M
i
,
C
5
} exchanged between the parties.


#### 2.2.2. Offline Password Guessing Attack

It is known that password-based authentication schemes are apt to be subject to two kinds of attacks regarding guessing [16, 25], i.e., offline password guessing and online password guessing, due to the limited size of the password space. Among them, the online guessing is relatively easy to detect due to the abnormal, large number of login requests issued by the attacker against the victim account within a short duration, and thus it can be countered by rate-limiting [50].It is worth noting that when targeted online password guessing [47] is considered, attackers will no longer need to launch a large number of login attempts to try candidate passwords. Instead, targeted online password guessing attacks are rather effective and, as reported by Wang et al. [47], the attacker M can have an over 20% of success rate within 100 login attempts against normal users, if M has obtained some personal information (e.g., name, birthday) of the victim user. As a quick response to the results of [47], the US Digital identity guideline NIST 800-63B [51] has been revised and the following sentence was removed: “online guessing can be readily addressed by throttling the rate of login attempts permitted” (see more details in [52, 53]). Further, NIST 800-63B proposed four countermeasures such as CAPTCHA, exponential time delay, and risk-based authentication (see Section 5.2.2 of [51]).In contrast, offline password guessing attack cannot be easily detected. In this attack, the attackerM first attempts to look for some pieces of information that can be exploited as the comparison target of his password guesses and then locally determines the exactly correct password by repeatedly testing all the candidates. Since this attack is executed without online communication with the server, there is no means for the server to detect and thwart. In all, no matter in trawling or targeted online guessing, M needs to interact with the server and there is the possibility that M may be detected, but in offline password guessing there is no such possibility. Consequently, offline password guessing is a more serious threat if password-related information has been leaked.Wu and Xu [17] claimed that an attacker is unable to, in an offline manner, determine a user’s password even if the sensitive data B
1 has been revealed from user’s smart card. However, the following attacking procedure illustrates that this claim is not tenable. Suppose that U
i’s smart card is lost/stolen and the attacker M obtains it. Then M extracts the content {
B
1
,
B
2
,
h
(
·
)
} by using the methods introduced in [33]. The following procedure describes our proposed offline password guessing attack:Step 1.
M choose a pair (
I
D
i
∗
,
P
W
i
∗
) from the identity space D
I
D and dictionary space D
P
W, respectively.Step 2.
M computes b
i
∗
=
B
2
⊕
h
(
I
D
i
∗
∥
P
W
i
∗
), where B
2 is revealed from U
i’s smart card.Step 3.
M computes C
2
∗
=
B
1
⊕
h
(
I
D
i
∗
∥
h
(
P
W
i
∗
∥
b
i
∗
)
)
⊕
h
(
P
W
i
∗
∥
b
i
∗
), where B
1 is recovered from U
i’s smart card.Step 4.
M calculates C
3
∗
=
C
2
∗
⊕
C
4, where C
4 is eavesdropped from the open channel.Step 5.
M decrypts C
5 by using C
3
∗ to obtain I
D
i
′
⊕
C
1
′
⊕
r
u
′, where C
5 is eavesdropped from the open channel.Step 6.
M calculates C
3
∗
=
h
(
I
D
i
∗
∥
C
1
′
∥
C
2
∗
∥
r
u
′
).Step 7.
M examines the authenticity of (
I
D
i
∗
,
P
W
i
∗
) pair by verifying if C
4
=
?
C
2
∗
⊕
C
3
∗.Step 8.
M returns to Step 1 of this procedure until the right pair of (
I
D
i
,
P
W
i
) is obtained or all pairs in D
I
D
×
D
P
W are exhausted.It is obvious that the above procedure is with a time complexity of{
O
(
D
I
D
∗
D
P
W
)
}
∗
(
T
D
+
4
T
H
+
7
T
X
), where T
E, T
H, and T
X denote the execution time of modular exponentiation, hash, and XOR operation, respectively. Based on the results reported in [16, 54], the offline password guessing attack is able to be carried out in seconds on a common computer, for in practice the size of identity space D
I
D and the size of dictionary space D
P
W are rather limited and M could try all the possible passwords through an offline method [20, 49]. All in all, an type II attacker M can guess (
I
D
i
,
P
W
i
) within polynomial time bound; it follows that our suggested attack is indeed effective.


#### 2.2.3. Replay Attack

Resistance to replay attack is a very basic security goal of any cryptographic protocol [16, 24]. However, Wu-Xu’s scheme fails to achieve this goal. More specifically, Wu-Xu’s scheme employs random numbers but not timestamps to achieve the freshness of messages. Yet, this scheme has only two protocol flows, making it inherently vulnerable to replay attack. As is well known, any two-flow random number based scheme is unable to achieve explicit authentication while resisting replay attack, because M can simply replay the first message of a successful protocol run to impersonate the legitimate user, and the server can never know whether the replayed message is fresh or not unless the server maintains a table of all received messages. However, maintaining a table of all received messages is practically undesirable. In all, replay attack is quite realistic against Wu-Xu’s scheme.


## 2.1. Review Wu-Xu’s Scheme

In this section, we briefly review the chaotic-map based authentication scheme for cloud computing proposed by Wu and Xu [17] in ICCCS 2017. Their scheme consists of four phases: initialization, registration, authentication, and password change. For ease of presentation, we will follow the notations in Wu-Xu’s scheme as closely as possible and summarize the notations in Table 1.Table 1
Notations and abbreviations.
Symbol
Description
U
i
i
t
h user
S
remote server
M
malicious attacker
I
D
i
identity of userU
i
P
W
i
password of userU
i
x
the secret key of remote serverS
⊕
the bitwise XOR operation
∥
the string concatenation operation
h
(
⋅
)
collision free one-way hash function
→
a common channel
⇒
a secure channel


### 2.1.1. Registration Phase

At the very start, the serverS generates a random positive integer s
∈
Z
p
∗ and a symmetric key cryptosystem with E
k
(
.
) and D
k
(
.
) and then selects a secret key x, and two one-way hash functions h
(
.
) and h
1
(
.
).Step R1.
U
i chooses her identity I
D
i, P
W
i and b
i, then computes H
P
W
i
=
h
(
P
W
i
∥
b
i
)Step R2.
U
i
⇒
S
:
{
I
D
i
,
H
P
W
i
}.Step R3.
S selects a random number r
i, computes I
M
i
=
E
x
(
(
I
D
i
⊕
r
i
)
∥
r
i
) and B
1
=
h
(
I
D
i
∥
H
P
W
i
)
⊕
H
P
W
i
⊕
h
(
x
∥
I
M
i
), and stores I
M
i, B
1, h
(
.
), E
k
(
.
)
/
D
k
(
.
), s and p into the smart card.Step R4.
S
⇒
U
i: A smart card containing {
I
M
i, B
1
,
E
k
(
.
)
/
D
k
(
.
)
,
h
(
.
)
,
s
,
p
}.Step R5.
U
i computes B
2
=
h
(
I
D
i
∥
P
W
i
)
⊕
b
i and stores B
2 into the card.


### 2.1.2. Login and Mutual Authentication Phase

WhenU
i wants to login, the following operations will be performed:Step 1.
U
i inserts the smart card into card reader and inputs I
D
i and P
W
i.Step 2.
Smart card computesb
i
′
=
B
2
⊕
h
(
I
D
i
∥
P
W
i
).Step 3.
Smart card selects two random integersu
∈
[
1
,
p
+
1
] and r
u and computes H
P
W
i
=
h
(
P
W
i
∥
b
i
′
), C
1
=
T
u
(
s
), C
2
=
B
1
⊕
h
(
I
D
i
∥
H
P
W
i
), C
3
=
h
(
I
D
i
∥
C
1
∥
C
2
∥
r
u
), C
4
=
C
2
⊕
C
3, C
5
=
E
C
3
(
I
D
i
∥
C
1
∥
r
u
).Step 4.
Smart card→
S
:
{
C
4
,
I
M
i
,
C
5
}.Step 5.
On receiving the message from smart card,S decrypts I
M
i and gets I
D
i
′ and r
i
′ and then computes C
2
′
=
h
(
x
∥
I
M
i
), C
3
′
=
C
4
⊕
C
2
′.Step 6.
S decrypts C
5 to obtain I
D
i
′
′, C
1
′, and r
u
′, then checks if I
D
i
′
=
?
I
D
i
′
′ and C
3
′
=
?
h
(
I
D
i
′
∥
C
1
′
∥
C
2
′
∥
r
u
′
). If all above verifications are correct, S proceeds. Otherwise, the login request is interrupted.Step 7.
S chooses three random integers v
∈
[
1
,
p
+
1
], r
s and r
i
n
e
w and computes I
M
i
′
=
E
x
(
(
I
D
i
′
⊕
r
i
n
e
w
)
∥
r
i
n
e
w
), C
6
=
T
v
(
s
), s
k
s
=
T
v
(
C
1
′
), C
7
=
h
(
x
∥
I
M
i
′
), C
8
=
h
1
(
I
D
i
′
∥
I
M
i
′
∥
C
1
′
∥
C
2
′
∥
C
6
∥
C
7
∥
s
k
s
∥
r
s
), C
9
=
C
2
′
⊕
C
8, and C
10
=
E
C
8
(
I
M
i
′
∥
C
6
∥
C
7
∥
r
s
), where s
k
s is server-side session key.Step 8.
S
→
U
i
:
{
C
9
,
C
10
}.Step 9.
Smart card calculatesC
8
′
=
C
9
⊕
C
2 and obtains I
M
i
′
′, C
6
′, C
7
′, and r
s
′ by decrypting C
10. Smart card further computes s
k
u
=
T
u
(
C
6
′
) and checks C
8
′
=
?
h
1
(
I
D
i
∥
I
M
i
′
′
∥
C
1
∥
C
2
∥
C
6
′
∥
C
7
′
∥
s
k
u
∥
r
s
′
). If they are not equal, U
i aborts the communication. Otherwise, smart card computes B
1
′
=
C
2
⊕
C
7
′
⊕
B
1 and replaces (
B
1
,
I
M
i
) with (
B
1
′
,
I
M
i
′
′
).


## 2.1.1. Registration Phase

At the very start, the serverS generates a random positive integer s
∈
Z
p
∗ and a symmetric key cryptosystem with E
k
(
.
) and D
k
(
.
) and then selects a secret key x, and two one-way hash functions h
(
.
) and h
1
(
.
).Step R1.
U
i chooses her identity I
D
i, P
W
i and b
i, then computes H
P
W
i
=
h
(
P
W
i
∥
b
i
)Step R2.
U
i
⇒
S
:
{
I
D
i
,
H
P
W
i
}.Step R3.
S selects a random number r
i, computes I
M
i
=
E
x
(
(
I
D
i
⊕
r
i
)
∥
r
i
) and B
1
=
h
(
I
D
i
∥
H
P
W
i
)
⊕
H
P
W
i
⊕
h
(
x
∥
I
M
i
), and stores I
M
i, B
1, h
(
.
), E
k
(
.
)
/
D
k
(
.
), s and p into the smart card.Step R4.
S
⇒
U
i: A smart card containing {
I
M
i, B
1
,
E
k
(
.
)
/
D
k
(
.
)
,
h
(
.
)
,
s
,
p
}.Step R5.
U
i computes B
2
=
h
(
I
D
i
∥
P
W
i
)
⊕
b
i and stores B
2 into the card.


## 2.1.2. Login and Mutual Authentication Phase

WhenU
i wants to login, the following operations will be performed:Step 1.
U
i inserts the smart card into card reader and inputs I
D
i and P
W
i.Step 2.
Smart card computesb
i
′
=
B
2
⊕
h
(
I
D
i
∥
P
W
i
).Step 3.
Smart card selects two random integersu
∈
[
1
,
p
+
1
] and r
u and computes H
P
W
i
=
h
(
P
W
i
∥
b
i
′
), C
1
=
T
u
(
s
), C
2
=
B
1
⊕
h
(
I
D
i
∥
H
P
W
i
), C
3
=
h
(
I
D
i
∥
C
1
∥
C
2
∥
r
u
), C
4
=
C
2
⊕
C
3, C
5
=
E
C
3
(
I
D
i
∥
C
1
∥
r
u
).Step 4.
Smart card→
S
:
{
C
4
,
I
M
i
,
C
5
}.Step 5.
On receiving the message from smart card,S decrypts I
M
i and gets I
D
i
′ and r
i
′ and then computes C
2
′
=
h
(
x
∥
I
M
i
), C
3
′
=
C
4
⊕
C
2
′.Step 6.
S decrypts C
5 to obtain I
D
i
′
′, C
1
′, and r
u
′, then checks if I
D
i
′
=
?
I
D
i
′
′ and C
3
′
=
?
h
(
I
D
i
′
∥
C
1
′
∥
C
2
′
∥
r
u
′
). If all above verifications are correct, S proceeds. Otherwise, the login request is interrupted.Step 7.
S chooses three random integers v
∈
[
1
,
p
+
1
], r
s and r
i
n
e
w and computes I
M
i
′
=
E
x
(
(
I
D
i
′
⊕
r
i
n
e
w
)
∥
r
i
n
e
w
), C
6
=
T
v
(
s
), s
k
s
=
T
v
(
C
1
′
), C
7
=
h
(
x
∥
I
M
i
′
), C
8
=
h
1
(
I
D
i
′
∥
I
M
i
′
∥
C
1
′
∥
C
2
′
∥
C
6
∥
C
7
∥
s
k
s
∥
r
s
), C
9
=
C
2
′
⊕
C
8, and C
10
=
E
C
8
(
I
M
i
′
∥
C
6
∥
C
7
∥
r
s
), where s
k
s is server-side session key.Step 8.
S
→
U
i
:
{
C
9
,
C
10
}.Step 9.
Smart card calculatesC
8
′
=
C
9
⊕
C
2 and obtains I
M
i
′
′, C
6
′, C
7
′, and r
s
′ by decrypting C
10. Smart card further computes s
k
u
=
T
u
(
C
6
′
) and checks C
8
′
=
?
h
1
(
I
D
i
∥
I
M
i
′
′
∥
C
1
∥
C
2
∥
C
6
′
∥
C
7
′
∥
s
k
u
∥
r
s
′
). If they are not equal, U
i aborts the communication. Otherwise, smart card computes B
1
′
=
C
2
⊕
C
7
′
⊕
B
1 and replaces (
B
1
,
I
M
i
) with (
B
1
′
,
I
M
i
′
′
).


## 2.2. Cryptanalysis of Wu-Xu’s Scheme

In this section, the security loopholes of Wu-Xu’s scheme [17] will be pointed out. More specifically, it is prone to offline password guessing attack and suffers from replay attack, which makes this scheme unpractical for real use. Before giving the detailed security analysis, we first define the various adversary models for smart-card-based password authentication.


### 2.2.1. Adversary Models

To analyze the security provisions of password-based authentication schemes using smart cards, generally three assumptions about the attacker’s capabilities are made since the landmark work of Yang et al. [24], and we summarize them as follows:Assumption 1.
The malicious attackerM is able to eavesdrop, delete, insert, modify, or block any transcripts communicated in the public channel. That is to say, the communication channel between the common users and the server can be completely manipulated by M. This well complies with the standard adversary model that is widely accepted for distributed computing [41].Assumption 2.
The malicious attackerM can somehow get the victim user’s smart card and use side-channel attack techniques to acquire sensitive security parameters from the card memory, which is reasonable according to the recent research developments in side-channel attacks [32, 33].Assumption 3.
User’s password space is very constrained and the malicious attackerM can offline enumerate it. To be user-friendly, most protocols (e.g., the ones in [3, 24, 42–44]) enable the users to select their own password at will in the initial process of registration or later process of password change. Because human beings are incapable of memorizing random strings, instead they are likely to choose passwords that relate to their personal lives or short strings for convenience. As a result, these human-generated passwords are often very weak and belong to a small dictionary [45–47].Note that the nontamper resistant assumption about smart cards are conditional, i.e., under the conditions that(
1
) smart cards have somehow been in the possession of the attacker for a relatively long time (e.g., at least a few days), which should be sufficient for launching a side-channel attack; (
2
) the user is not on the scene; otherwise the user will observe the attack, for side-channel attacks generally need special instruments and professional/particular operations. This is why smart cards are superior to memory sticks, even though nontamper assumption about smart cards has been made: memory sticks are nontamper resistant unconditional. See more explications in [48].Obviously, if bothAssumptions
2 and 3 hold simultaneously, then an attacker (without any other assumptions/abilities) can successfully impersonate a victim user and any scheme is trivially insecure. Therefore, it is widely regarded that attackers should not be granted to obtain a victim user’s smart card as well as his password [3, 24, 49].In [17], Wu and Xu reported that their scheme is secure under the above three assumptions. For example, they stated that their scheme can withstand offline password guessing attacks even if the security parameters in smart card have been extracted. However, contrary to their claims, we will illustrate that this scheme is still vulnerable to offline guessing as well as other pitfalls. Based on the above listed assumptions, we cryptanalyze the security provisions of Wu-Xu’s scheme in the following and assume that M can extract the secret data {
B
1
,
B
2
,
h
(
·
)
,
E
k
(
·
)
,
D
k
(
·
)
} stored in U
i’s smart card, and M can also eavesdrop the messages {
C
4
,
I
M
i
,
C
5
} exchanged between the parties.


### 2.2.2. Offline Password Guessing Attack

It is known that password-based authentication schemes are apt to be subject to two kinds of attacks regarding guessing [16, 25], i.e., offline password guessing and online password guessing, due to the limited size of the password space. Among them, the online guessing is relatively easy to detect due to the abnormal, large number of login requests issued by the attacker against the victim account within a short duration, and thus it can be countered by rate-limiting [50].It is worth noting that when targeted online password guessing [47] is considered, attackers will no longer need to launch a large number of login attempts to try candidate passwords. Instead, targeted online password guessing attacks are rather effective and, as reported by Wang et al. [47], the attacker M can have an over 20% of success rate within 100 login attempts against normal users, if M has obtained some personal information (e.g., name, birthday) of the victim user. As a quick response to the results of [47], the US Digital identity guideline NIST 800-63B [51] has been revised and the following sentence was removed: “online guessing can be readily addressed by throttling the rate of login attempts permitted” (see more details in [52, 53]). Further, NIST 800-63B proposed four countermeasures such as CAPTCHA, exponential time delay, and risk-based authentication (see Section 5.2.2 of [51]).In contrast, offline password guessing attack cannot be easily detected. In this attack, the attackerM first attempts to look for some pieces of information that can be exploited as the comparison target of his password guesses and then locally determines the exactly correct password by repeatedly testing all the candidates. Since this attack is executed without online communication with the server, there is no means for the server to detect and thwart. In all, no matter in trawling or targeted online guessing, M needs to interact with the server and there is the possibility that M may be detected, but in offline password guessing there is no such possibility. Consequently, offline password guessing is a more serious threat if password-related information has been leaked.Wu and Xu [17] claimed that an attacker is unable to, in an offline manner, determine a user’s password even if the sensitive data B
1 has been revealed from user’s smart card. However, the following attacking procedure illustrates that this claim is not tenable. Suppose that U
i’s smart card is lost/stolen and the attacker M obtains it. Then M extracts the content {
B
1
,
B
2
,
h
(
·
)
} by using the methods introduced in [33]. The following procedure describes our proposed offline password guessing attack:Step 1.
M choose a pair (
I
D
i
∗
,
P
W
i
∗
) from the identity space D
I
D and dictionary space D
P
W, respectively.Step 2.
M computes b
i
∗
=
B
2
⊕
h
(
I
D
i
∗
∥
P
W
i
∗
), where B
2 is revealed from U
i’s smart card.Step 3.
M computes C
2
∗
=
B
1
⊕
h
(
I
D
i
∗
∥
h
(
P
W
i
∗
∥
b
i
∗
)
)
⊕
h
(
P
W
i
∗
∥
b
i
∗
), where B
1 is recovered from U
i’s smart card.Step 4.
M calculates C
3
∗
=
C
2
∗
⊕
C
4, where C
4 is eavesdropped from the open channel.Step 5.
M decrypts C
5 by using C
3
∗ to obtain I
D
i
′
⊕
C
1
′
⊕
r
u
′, where C
5 is eavesdropped from the open channel.Step 6.
M calculates C
3
∗
=
h
(
I
D
i
∗
∥
C
1
′
∥
C
2
∗
∥
r
u
′
).Step 7.
M examines the authenticity of (
I
D
i
∗
,
P
W
i
∗
) pair by verifying if C
4
=
?
C
2
∗
⊕
C
3
∗.Step 8.
M returns to Step 1 of this procedure until the right pair of (
I
D
i
,
P
W
i
) is obtained or all pairs in D
I
D
×
D
P
W are exhausted.It is obvious that the above procedure is with a time complexity of{
O
(
D
I
D
∗
D
P
W
)
}
∗
(
T
D
+
4
T
H
+
7
T
X
), where T
E, T
H, and T
X denote the execution time of modular exponentiation, hash, and XOR operation, respectively. Based on the results reported in [16, 54], the offline password guessing attack is able to be carried out in seconds on a common computer, for in practice the size of identity space D
I
D and the size of dictionary space D
P
W are rather limited and M could try all the possible passwords through an offline method [20, 49]. All in all, an type II attacker M can guess (
I
D
i
,
P
W
i
) within polynomial time bound; it follows that our suggested attack is indeed effective.


### 2.2.3. Replay Attack

Resistance to replay attack is a very basic security goal of any cryptographic protocol [16, 24]. However, Wu-Xu’s scheme fails to achieve this goal. More specifically, Wu-Xu’s scheme employs random numbers but not timestamps to achieve the freshness of messages. Yet, this scheme has only two protocol flows, making it inherently vulnerable to replay attack. As is well known, any two-flow random number based scheme is unable to achieve explicit authentication while resisting replay attack, because M can simply replay the first message of a successful protocol run to impersonate the legitimate user, and the server can never know whether the replayed message is fresh or not unless the server maintains a table of all received messages. However, maintaining a table of all received messages is practically undesirable. In all, replay attack is quite realistic against Wu-Xu’s scheme.


## 2.2.1. Adversary Models

To analyze the security provisions of password-based authentication schemes using smart cards, generally three assumptions about the attacker’s capabilities are made since the landmark work of Yang et al. [24], and we summarize them as follows:Assumption 1.
The malicious attackerM is able to eavesdrop, delete, insert, modify, or block any transcripts communicated in the public channel. That is to say, the communication channel between the common users and the server can be completely manipulated by M. This well complies with the standard adversary model that is widely accepted for distributed computing [41].Assumption 2.
The malicious attackerM can somehow get the victim user’s smart card and use side-channel attack techniques to acquire sensitive security parameters from the card memory, which is reasonable according to the recent research developments in side-channel attacks [32, 33].Assumption 3.
User’s password space is very constrained and the malicious attackerM can offline enumerate it. To be user-friendly, most protocols (e.g., the ones in [3, 24, 42–44]) enable the users to select their own password at will in the initial process of registration or later process of password change. Because human beings are incapable of memorizing random strings, instead they are likely to choose passwords that relate to their personal lives or short strings for convenience. As a result, these human-generated passwords are often very weak and belong to a small dictionary [45–47].Note that the nontamper resistant assumption about smart cards are conditional, i.e., under the conditions that(
1
) smart cards have somehow been in the possession of the attacker for a relatively long time (e.g., at least a few days), which should be sufficient for launching a side-channel attack; (
2
) the user is not on the scene; otherwise the user will observe the attack, for side-channel attacks generally need special instruments and professional/particular operations. This is why smart cards are superior to memory sticks, even though nontamper assumption about smart cards has been made: memory sticks are nontamper resistant unconditional. See more explications in [48].Obviously, if bothAssumptions
2 and 3 hold simultaneously, then an attacker (without any other assumptions/abilities) can successfully impersonate a victim user and any scheme is trivially insecure. Therefore, it is widely regarded that attackers should not be granted to obtain a victim user’s smart card as well as his password [3, 24, 49].In [17], Wu and Xu reported that their scheme is secure under the above three assumptions. For example, they stated that their scheme can withstand offline password guessing attacks even if the security parameters in smart card have been extracted. However, contrary to their claims, we will illustrate that this scheme is still vulnerable to offline guessing as well as other pitfalls. Based on the above listed assumptions, we cryptanalyze the security provisions of Wu-Xu’s scheme in the following and assume that M can extract the secret data {
B
1
,
B
2
,
h
(
·
)
,
E
k
(
·
)
,
D
k
(
·
)
} stored in U
i’s smart card, and M can also eavesdrop the messages {
C
4
,
I
M
i
,
C
5
} exchanged between the parties.


## 2.2.2. Offline Password Guessing Attack

It is known that password-based authentication schemes are apt to be subject to two kinds of attacks regarding guessing [16, 25], i.e., offline password guessing and online password guessing, due to the limited size of the password space. Among them, the online guessing is relatively easy to detect due to the abnormal, large number of login requests issued by the attacker against the victim account within a short duration, and thus it can be countered by rate-limiting [50].It is worth noting that when targeted online password guessing [47] is considered, attackers will no longer need to launch a large number of login attempts to try candidate passwords. Instead, targeted online password guessing attacks are rather effective and, as reported by Wang et al. [47], the attacker M can have an over 20% of success rate within 100 login attempts against normal users, if M has obtained some personal information (e.g., name, birthday) of the victim user. As a quick response to the results of [47], the US Digital identity guideline NIST 800-63B [51] has been revised and the following sentence was removed: “online guessing can be readily addressed by throttling the rate of login attempts permitted” (see more details in [52, 53]). Further, NIST 800-63B proposed four countermeasures such as CAPTCHA, exponential time delay, and risk-based authentication (see Section 5.2.2 of [51]).In contrast, offline password guessing attack cannot be easily detected. In this attack, the attackerM first attempts to look for some pieces of information that can be exploited as the comparison target of his password guesses and then locally determines the exactly correct password by repeatedly testing all the candidates. Since this attack is executed without online communication with the server, there is no means for the server to detect and thwart. In all, no matter in trawling or targeted online guessing, M needs to interact with the server and there is the possibility that M may be detected, but in offline password guessing there is no such possibility. Consequently, offline password guessing is a more serious threat if password-related information has been leaked.Wu and Xu [17] claimed that an attacker is unable to, in an offline manner, determine a user’s password even if the sensitive data B
1 has been revealed from user’s smart card. However, the following attacking procedure illustrates that this claim is not tenable. Suppose that U
i’s smart card is lost/stolen and the attacker M obtains it. Then M extracts the content {
B
1
,
B
2
,
h
(
·
)
} by using the methods introduced in [33]. The following procedure describes our proposed offline password guessing attack:Step 1.
M choose a pair (
I
D
i
∗
,
P
W
i
∗
) from the identity space D
I
D and dictionary space D
P
W, respectively.Step 2.
M computes b
i
∗
=
B
2
⊕
h
(
I
D
i
∗
∥
P
W
i
∗
), where B
2 is revealed from U
i’s smart card.Step 3.
M computes C
2
∗
=
B
1
⊕
h
(
I
D
i
∗
∥
h
(
P
W
i
∗
∥
b
i
∗
)
)
⊕
h
(
P
W
i
∗
∥
b
i
∗
), where B
1 is recovered from U
i’s smart card.Step 4.
M calculates C
3
∗
=
C
2
∗
⊕
C
4, where C
4 is eavesdropped from the open channel.Step 5.
M decrypts C
5 by using C
3
∗ to obtain I
D
i
′
⊕
C
1
′
⊕
r
u
′, where C
5 is eavesdropped from the open channel.Step 6.
M calculates C
3
∗
=
h
(
I
D
i
∗
∥
C
1
′
∥
C
2
∗
∥
r
u
′
).Step 7.
M examines the authenticity of (
I
D
i
∗
,
P
W
i
∗
) pair by verifying if C
4
=
?
C
2
∗
⊕
C
3
∗.Step 8.
M returns to Step 1 of this procedure until the right pair of (
I
D
i
,
P
W
i
) is obtained or all pairs in D
I
D
×
D
P
W are exhausted.It is obvious that the above procedure is with a time complexity of{
O
(
D
I
D
∗
D
P
W
)
}
∗
(
T
D
+
4
T
H
+
7
T
X
), where T
E, T
H, and T
X denote the execution time of modular exponentiation, hash, and XOR operation, respectively. Based on the results reported in [16, 54], the offline password guessing attack is able to be carried out in seconds on a common computer, for in practice the size of identity space D
I
D and the size of dictionary space D
P
W are rather limited and M could try all the possible passwords through an offline method [20, 49]. All in all, an type II attacker M can guess (
I
D
i
,
P
W
i
) within polynomial time bound; it follows that our suggested attack is indeed effective.


## 2.2.3. Replay Attack

Resistance to replay attack is a very basic security goal of any cryptographic protocol [16, 24]. However, Wu-Xu’s scheme fails to achieve this goal. More specifically, Wu-Xu’s scheme employs random numbers but not timestamps to achieve the freshness of messages. Yet, this scheme has only two protocol flows, making it inherently vulnerable to replay attack. As is well known, any two-flow random number based scheme is unable to achieve explicit authentication while resisting replay attack, because M can simply replay the first message of a successful protocol run to impersonate the legitimate user, and the server can never know whether the replayed message is fresh or not unless the server maintains a table of all received messages. However, maintaining a table of all received messages is practically undesirable. In all, replay attack is quite realistic against Wu-Xu’s scheme.


## 3. Revisiting of Roy Et Al.’s Scheme

### 3.1. Review of Roy Et Al.’s Scheme

In this section, we first concisely review Roy et al.’s scheme [19] proposed in 2017. This scheme is an improvement over Tsai-Lo’s scheme [34] and aims to attain forward secrecy that is lacked in Tsai-Lo’s scheme. Roy et al.’s protocol involves three participants, i.e., the mobile user (M
U
i), the cloud server (C
S
j), and registration center (R
C). There are five phases in their scheme: registration, login, authentication and key establishment, password change, and revocation of mobile device. The notations and initial system parameters employed in Roy et al.’s scheme are same as employed in the scheme of Wu-Xu (see Table 1).


#### 3.1.1. Mobile User Registration

Step 1.
M
U
i chooses her identity I
D
i, password P
W
i, biometrics B
i, and two 128-bit random numbers b and k.Step 2.
M
U
i produces (
θ
i
,
ϕ
i
)
=
G
e
n
(
B
i
) and computes the masked password R
P
W
B
i
=
H
(
I
D
i
∥
H
(
P
W
i
∥
θ
i
∥
b
)
).Step 3.
M
U
i
⇒
R
C
:
{
I
D
i
,
(
R
P
W
B
i
⊕
k
)
}.Step 4.
R
C selects an 1024-bit master secret key X
j for server C
S
j. R
C also selects an 1024-bit random number r
i
j for each M
U
i and C
S
j pair.Step 5.
R
C computes A
i
j
=
H
(
H
(
I
D
i
⊕
r
i
j
)
∥
X
j
), V
i
j
=
A
i
j
⊕
R
P
W
B
i, and R
I
D
S
j
=
H
(
I
D
S
j
∥
X
j
) as the pseudoidentity of C
S
j.Step 6.
R
C selects a unique and random temporary identity T
I
D
i for M
U
i and saves n server key-plus-id combinations {
T
I
D
i
,
(
I
D
S
j
,
V
i
j
,
R
I
D
S
j
)
∣
1
≤
j
≤
n
} in mobile device of M
U
i.Step 7.
R
C
⇒
M
U
i
: A mobile device contains {
T
I
D
i
,
(
I
D
S
j
,
V
i
j
,
R
I
D
S
j
)
∣
1
≤
j
≤
n
}.Step 8.
M
U
i computes D
i
1
=
H
(
P
W
i
∥
θ
i
)
⊕
b, D
i
2
=
H
(
I
D
i
∥
P
W
i
∥
θ
i
∥
b
), V
i
j
′
=
V
i
j
⊕
k
=
A
i
j
⊕
H
(
I
D
i
∥
H
(
P
W
i
∥
θ
i
∥
b
)
), R
I
D
i
j
=
T
I
D
i
⊕
H
(
I
D
i
∥
V
i
j
′
), and R
I
D
S
j
′
=
R
I
D
S
j
⊕
H
(
θ
i
∥
b
) for 1
≤
j
≤
n.Finally,M
U
i stores ϕ
i, D
i
1, D
i
2, V
i
j
′s, R
I
D
i
js, and R
I
D
S
j
′s into her own mobile device, and deletes V
i
js, T
I
D
i, and R
I
D
S
js from the mobile device.


#### 3.1.2. Cloud Server Registration

Step 1.
C
S
j chooses her identity I
D
S
j.Step 2.
C
S
j
⇒
R
C
:
{
I
D
S
j
}.Step 3.
R
C provides the master secret key X
j to each C
S
j.Step 4.
For allM
U
is, the R
C saves the credentials {
T
I
D
i
,
(
I
D
i
,
r
i
j
)
} (for 1
≤
i
≤
m) in database of C
S
j, and also stores {
I
D
S
j
,
X
j
} in the database of C
S
j.Finally,R
C saves pair (
I
D
i
,
S
N
i
) in its own database, where S
N
i is the serial number of M
U
i’s mobile device.


#### 3.1.3. Login Phase

WhenM
U
i wants to login to C
S
j, the following operations shall be executed:Step L1.
M
U
i inputs her identity I
D
i, password P
W
i, and biometrics B
i
′ into her own mobile device. M
U
i computes θ
i
=
R
e
p
(
B
i
′
,
ϕ
i
) with ϕ
i through the fuzzy extractor reproduction procedure and generates b
′
=
D
i
1
⊕
H
(
P
W
i
∥
θ
i
) with the stored parameter D
i
1, M
U
i.Step L2. M
U
i computes H
(
I
D
i
∥
P
W
i
∥
θ
i
∥
b
′
) and checks whether D
i
2
=
H
(
I
D
i
∥
P
W
i
∥
θ
i
∥
b
′
). An equality indicates that M
U
i is legal.Step L3. M
U
i calculates R
P
W
B
i
=
H
(
I
D
i
∥
H
(
P
W
i
∥
θ
i
∥
b
′
)
). M
U
i also generates A
i
j
=
V
i
j
′
⊕
R
P
B
W
i using the device parameter V
i
j
′.Step L4.
M
U
i selects an 128 bit random number R
N
i, generates the current timestamp T
S
i, and then computes:C
1
=
A
i
j
⊕
R
N
i
⊕
T
S
i
⊕
H
(
I
D
S
j
), H
1
=
H
(
I
D
i
∥
C
1
∥
R
N
i
∥
T
S
i
), T
I
D
i
=
R
I
D
i
j
⊕
H
(
I
D
i
∥
V
i
j
′
), R
I
D
S
j
=
R
I
D
S
j
′
⊕
H
(
θ
i
∥
b
′
), and T
I
D
i
∗
=
T
I
D
i
⊕
H
(
R
I
D
S
j
∥
T
S
i
).Step L5.
M
U
i
→
C
S
j
:
{
T
I
D
i
∗
,
C
1
,
H
1
,
T
S
i
}.


#### 3.1.4. Authentication Phase

In this phase,C
S
j and M
U
i mutually authenticate each other and establish a session key. Since this phase is unrelated to our discussions, we omit it.


### 3.2. Flaws in RoyEt Al.’s Scheme

Recall that the three assumptions listed in Section3 are also clearly made in Roy et al.’s scheme. However, we observe that this scheme still remains feasible for an attacker to offline guess a user’s password. This means that the primary goal of “truly two-factor security” cannot be satisfied. In addition, the scheme cannot provide forward secrecy and sound scalability.


#### 3.2.1. Offline Password Guessing Attack

Noting that Roy et al.’s scheme [19] is originally a three-factor one, here we are only interested in its two-factor version by assuming that the third factor (i.e., the biometric) has been known to A. This is realistic as users’ biometrics are constant during their lives, and how to protect user biometric template is still an open issue [55]. We find that this scheme cannot achieve truly two-factor security: it is subject to two types of offline password guessing attack. This in turn indicates that it cannot achieve truly three-factor security.Type-I Attack. .Suppose U
i’s biometric B
i and the secret parameters {
D
i
1
,
D
i
2, φ
i
,
h
(
·
)
} stored in the smart card are somehow obtained by A. At this point, A can find out U
i’s identity and password as follows:Step 1.
GuessesU
i’s identity I
D
i
∗ and password P
W
i
∗ from dictionary space D
i
d and D
p
w.Step 2.
Computesθ
i
=
R
e
p
(
B
i
,
φ
i
), b
∗
=
H
(
P
W
i
∥
θ
i
)
⊕
D
i
1, where D
i
1 is extracted from the smart card.Step 3.
ComputesD
i
2
∗
=
H
(
I
D
i
∗
∥
P
W
i
∗
∥
θ
i
∥
b
∗
), where θ
i is extracted from the smart card.Step 4.
Checks the validity of(
I
D
i
∗
,
P
W
i
∗
) by comparing the calculated D
i
2
∗ with the extracted D
i
2.Step 5.
Repeats Steps 1~4 until finds the correct pair of(
I
D
i
∗
,
P
W
i
∗
).The time complexity of this attack isO
(
D
i
d
∗
D
p
w
∗
2
T
H
+
T
B
) [3, 16]. Generally, it is only needed to calculate the biohashing function once; thus T
B can be ignored in practice. According to the running time in [16], A may complete the above attacking procedure within 17.6 days on a Laptop. This issue arises due to the inherent “usability-security tension”: to achieve local password change (i.e., C-2 in [3]) and timely typo detection (i.e., C-9 in [3]); there is an explicit password verifier D
i
2
=
H
(
I
D
i
∥
P
W
i
∥
θ
i
∥
b
) stored in U
i’s smart card, yet this verifier leads to a Type-I offline password attack.To eliminate this security issue without loss of usability, a promising countermeasure is to adopt the “fuzzy-verifier” technique [20] and store D
i
2
=
h
(
(
H
(
I
D
i
∥
P
W
i
∥
θ
i
∥
b
)
)
m
o
d
n
) in U
i’s smart card, where n specifies/confines the capacity of (
I
D
,
P
W
) pair, 2
4
≤
n
≤
2
8. As a result, even if A gets D
i
2, she can not figure out the correct (
I
D
,
P
W
) from the above attack, because there will be D
i
d
∗
D
p
w
/
n
≈
2
32 candidate (
I
D
,
P
W
) pairs that make D
i
2
∗
=
D
i
2 in Step 4. To further identify the exactly correct (
I
D
,
P
W
) pair, A needs to interact with the server, and we can adopt the “honeywords” technique [3, 56] to confine A’s advantage to a very limited value.Type-II Attack. .In the above attack, A does not need the protocol messages. In this attack, we assume that A can somehow obtain user’s smart card and extract its secret parameters {
D
i
1
,
D
i
2
,
V
i
j
′
,
φ
i
,
h
(
·
)
} and also can eavesdrop the login messages {
T
I
D
i
∗
,
C
1
,
H
1, T
S
i
} from the public channel. Now, A canoffline guess U
i’s password and identity simultaneously as follows:Step 1.
Guesses the value ofI
D
i
∗, P
W
i
∗ from dictionary space D
i
d and D
p
w.Step 2.
Computesθ
i
=
R
e
p
(
B
i
,
φ
i
), b
∗
=
H
(
P
W
i
∥
θ
i
)
⊕
D
i
1, where D
i
1 is extracted from the smart card.Step 3.
ComputesA
i
j
∗
=
V
i
j
′
⊕
H
(
I
D
i
∗
∥
H
(
P
W
i
∗
∥
θ
i
∥
b
∗
)
).Step 4.
ComputesR
N
i
∗
=
C
1
⊕
A
i
j
∗
⊕
T
S
i
⊕
H
(
I
D
S
j
).Step 5.
ComputesH
1
∗
=
H
(
I
D
i
∗
∥
C
1
∥
R
N
i
∗
∥
T
S
i
).Step 6.
Checks the correctness of(
I
D
i
∗
,
P
W
i
∗
) by comparing if the computed H
1
∗ equals the intercepted H
1.Step 7.
Repeats Steps 1~6 of the above procedure until find the correct value of(
I
D
i
∗
,
P
W
i
∗
).The time complexity of the above attacking procedure isO
(
D
i
d
∗
D
p
w
∗
(
5
T
H
+
T
B
)
), and A may complete the procedure within 44 days on a Laptop. In comparison, the Type-I attack is more practical.


#### 3.2.2. No Forward Secrecy

A scheme that supports forward secrecy ensures that even after the long-term private key(s) of one or more participants were leaked, previously agreed session keys remain secure [27]. This is important, especially when considering the serious situations of today’s clouds like the compromise of cloud servers (e.g., [15]).If an attackerM has obtained the server C
S
j’s long-term key X
j from the breached server S and intercepted the messages {
T
I
D
i
∗
,
C
1
,
H
1
,
T
S
i
} that are exchanged between U
i and S’s authentication process from the public channel. M is able to figure out the session key using the following method:Step 1.
M computes R
I
D
S
j
=
H
(
I
D
S
j
∥
X
j
) and T
I
D
i
=
T
I
D
i
∗
⊕
H
(
R
I
D
S
j
∥
T
S
i
)Step 2.
M computes A
j
i
=
H
(
H
(
I
D
i
⊕
r
i
j
)
∥
X
j
), R
N
j
=
C
1
⊕
T
S
i
⊕
H
(
I
D
S
j
)
⊕
A
j
i, M
1
=
C
1
⊕
T
S
i
⊕
H
(
I
D
S
j
)
⊕
B
j
i;Step 3.
M calculates the session key s
k
=
H
(
I
D
i
∥
I
D
S
j
∥
A
j
i
∥
M
1
∥
R
N
j
∥
T
S
i
∥
T
S
j
).With the session keys
k computed, the entire session will be no secret to M.


#### 3.2.3. Poor Scalability

In Roy et al.’s scheme, the user side stores all the cloud servers (i.e.,C
S
j, 1
≤
j
≤
n) related information: R
I
D
i
j
=
T
I
D
i
⊕
H
(
I
D
i
∥
V
i
j
′
) and R
I
D
S
j
′
=
R
I
D
S
j
⊕
H
(
θ
i
∥
b
) for 1
≤
j
≤
n. This means that when a new server arrives, all the users have to reregister with the registration center R
C. This shows poor scalability. Similarly, the server side stores all the users (i.e., U
i, 1
≤
i
≤
m ) related information: the credentials {
T
I
D
i
,
(
I
D
i
,
r
i
j
)
} (for 1
≤
i
≤
m) in database of C
S
j. This means that when a new user arrives, all the servers have to reregister with the registration center R
C.


## 3.1. Review of Roy Et Al.’s Scheme

In this section, we first concisely review Roy et al.’s scheme [19] proposed in 2017. This scheme is an improvement over Tsai-Lo’s scheme [34] and aims to attain forward secrecy that is lacked in Tsai-Lo’s scheme. Roy et al.’s protocol involves three participants, i.e., the mobile user (M
U
i), the cloud server (C
S
j), and registration center (R
C). There are five phases in their scheme: registration, login, authentication and key establishment, password change, and revocation of mobile device. The notations and initial system parameters employed in Roy et al.’s scheme are same as employed in the scheme of Wu-Xu (see Table 1).


### 3.1.1. Mobile User Registration

Step 1.
M
U
i chooses her identity I
D
i, password P
W
i, biometrics B
i, and two 128-bit random numbers b and k.Step 2.
M
U
i produces (
θ
i
,
ϕ
i
)
=
G
e
n
(
B
i
) and computes the masked password R
P
W
B
i
=
H
(
I
D
i
∥
H
(
P
W
i
∥
θ
i
∥
b
)
).Step 3.
M
U
i
⇒
R
C
:
{
I
D
i
,
(
R
P
W
B
i
⊕
k
)
}.Step 4.
R
C selects an 1024-bit master secret key X
j for server C
S
j. R
C also selects an 1024-bit random number r
i
j for each M
U
i and C
S
j pair.Step 5.
R
C computes A
i
j
=
H
(
H
(
I
D
i
⊕
r
i
j
)
∥
X
j
), V
i
j
=
A
i
j
⊕
R
P
W
B
i, and R
I
D
S
j
=
H
(
I
D
S
j
∥
X
j
) as the pseudoidentity of C
S
j.Step 6.
R
C selects a unique and random temporary identity T
I
D
i for M
U
i and saves n server key-plus-id combinations {
T
I
D
i
,
(
I
D
S
j
,
V
i
j
,
R
I
D
S
j
)
∣
1
≤
j
≤
n
} in mobile device of M
U
i.Step 7.
R
C
⇒
M
U
i
: A mobile device contains {
T
I
D
i
,
(
I
D
S
j
,
V
i
j
,
R
I
D
S
j
)
∣
1
≤
j
≤
n
}.Step 8.
M
U
i computes D
i
1
=
H
(
P
W
i
∥
θ
i
)
⊕
b, D
i
2
=
H
(
I
D
i
∥
P
W
i
∥
θ
i
∥
b
), V
i
j
′
=
V
i
j
⊕
k
=
A
i
j
⊕
H
(
I
D
i
∥
H
(
P
W
i
∥
θ
i
∥
b
)
), R
I
D
i
j
=
T
I
D
i
⊕
H
(
I
D
i
∥
V
i
j
′
), and R
I
D
S
j
′
=
R
I
D
S
j
⊕
H
(
θ
i
∥
b
) for 1
≤
j
≤
n.Finally,M
U
i stores ϕ
i, D
i
1, D
i
2, V
i
j
′s, R
I
D
i
js, and R
I
D
S
j
′s into her own mobile device, and deletes V
i
js, T
I
D
i, and R
I
D
S
js from the mobile device.


### 3.1.2. Cloud Server Registration

Step 1.
C
S
j chooses her identity I
D
S
j.Step 2.
C
S
j
⇒
R
C
:
{
I
D
S
j
}.Step 3.
R
C provides the master secret key X
j to each C
S
j.Step 4.
For allM
U
is, the R
C saves the credentials {
T
I
D
i
,
(
I
D
i
,
r
i
j
)
} (for 1
≤
i
≤
m) in database of C
S
j, and also stores {
I
D
S
j
,
X
j
} in the database of C
S
j.Finally,R
C saves pair (
I
D
i
,
S
N
i
) in its own database, where S
N
i is the serial number of M
U
i’s mobile device.


### 3.1.3. Login Phase

WhenM
U
i wants to login to C
S
j, the following operations shall be executed:Step L1.
M
U
i inputs her identity I
D
i, password P
W
i, and biometrics B
i
′ into her own mobile device. M
U
i computes θ
i
=
R
e
p
(
B
i
′
,
ϕ
i
) with ϕ
i through the fuzzy extractor reproduction procedure and generates b
′
=
D
i
1
⊕
H
(
P
W
i
∥
θ
i
) with the stored parameter D
i
1, M
U
i.Step L2. M
U
i computes H
(
I
D
i
∥
P
W
i
∥
θ
i
∥
b
′
) and checks whether D
i
2
=
H
(
I
D
i
∥
P
W
i
∥
θ
i
∥
b
′
). An equality indicates that M
U
i is legal.Step L3. M
U
i calculates R
P
W
B
i
=
H
(
I
D
i
∥
H
(
P
W
i
∥
θ
i
∥
b
′
)
). M
U
i also generates A
i
j
=
V
i
j
′
⊕
R
P
B
W
i using the device parameter V
i
j
′.Step L4.
M
U
i selects an 128 bit random number R
N
i, generates the current timestamp T
S
i, and then computes:C
1
=
A
i
j
⊕
R
N
i
⊕
T
S
i
⊕
H
(
I
D
S
j
), H
1
=
H
(
I
D
i
∥
C
1
∥
R
N
i
∥
T
S
i
), T
I
D
i
=
R
I
D
i
j
⊕
H
(
I
D
i
∥
V
i
j
′
), R
I
D
S
j
=
R
I
D
S
j
′
⊕
H
(
θ
i
∥
b
′
), and T
I
D
i
∗
=
T
I
D
i
⊕
H
(
R
I
D
S
j
∥
T
S
i
).Step L5.
M
U
i
→
C
S
j
:
{
T
I
D
i
∗
,
C
1
,
H
1
,
T
S
i
}.


### 3.1.4. Authentication Phase

In this phase,C
S
j and M
U
i mutually authenticate each other and establish a session key. Since this phase is unrelated to our discussions, we omit it.


## 3.1.1. Mobile User Registration

Step 1.
M
U
i chooses her identity I
D
i, password P
W
i, biometrics B
i, and two 128-bit random numbers b and k.Step 2.
M
U
i produces (
θ
i
,
ϕ
i
)
=
G
e
n
(
B
i
) and computes the masked password R
P
W
B
i
=
H
(
I
D
i
∥
H
(
P
W
i
∥
θ
i
∥
b
)
).Step 3.
M
U
i
⇒
R
C
:
{
I
D
i
,
(
R
P
W
B
i
⊕
k
)
}.Step 4.
R
C selects an 1024-bit master secret key X
j for server C
S
j. R
C also selects an 1024-bit random number r
i
j for each M
U
i and C
S
j pair.Step 5.
R
C computes A
i
j
=
H
(
H
(
I
D
i
⊕
r
i
j
)
∥
X
j
), V
i
j
=
A
i
j
⊕
R
P
W
B
i, and R
I
D
S
j
=
H
(
I
D
S
j
∥
X
j
) as the pseudoidentity of C
S
j.Step 6.
R
C selects a unique and random temporary identity T
I
D
i for M
U
i and saves n server key-plus-id combinations {
T
I
D
i
,
(
I
D
S
j
,
V
i
j
,
R
I
D
S
j
)
∣
1
≤
j
≤
n
} in mobile device of M
U
i.Step 7.
R
C
⇒
M
U
i
: A mobile device contains {
T
I
D
i
,
(
I
D
S
j
,
V
i
j
,
R
I
D
S
j
)
∣
1
≤
j
≤
n
}.Step 8.
M
U
i computes D
i
1
=
H
(
P
W
i
∥
θ
i
)
⊕
b, D
i
2
=
H
(
I
D
i
∥
P
W
i
∥
θ
i
∥
b
), V
i
j
′
=
V
i
j
⊕
k
=
A
i
j
⊕
H
(
I
D
i
∥
H
(
P
W
i
∥
θ
i
∥
b
)
), R
I
D
i
j
=
T
I
D
i
⊕
H
(
I
D
i
∥
V
i
j
′
), and R
I
D
S
j
′
=
R
I
D
S
j
⊕
H
(
θ
i
∥
b
) for 1
≤
j
≤
n.Finally,M
U
i stores ϕ
i, D
i
1, D
i
2, V
i
j
′s, R
I
D
i
js, and R
I
D
S
j
′s into her own mobile device, and deletes V
i
js, T
I
D
i, and R
I
D
S
js from the mobile device.


## 3.1.2. Cloud Server Registration

Step 1.
C
S
j chooses her identity I
D
S
j.Step 2.
C
S
j
⇒
R
C
:
{
I
D
S
j
}.Step 3.
R
C provides the master secret key X
j to each C
S
j.Step 4.
For allM
U
is, the R
C saves the credentials {
T
I
D
i
,
(
I
D
i
,
r
i
j
)
} (for 1
≤
i
≤
m) in database of C
S
j, and also stores {
I
D
S
j
,
X
j
} in the database of C
S
j.Finally,R
C saves pair (
I
D
i
,
S
N
i
) in its own database, where S
N
i is the serial number of M
U
i’s mobile device.


## 3.1.3. Login Phase

WhenM
U
i wants to login to C
S
j, the following operations shall be executed:Step L1.
M
U
i inputs her identity I
D
i, password P
W
i, and biometrics B
i
′ into her own mobile device. M
U
i computes θ
i
=
R
e
p
(
B
i
′
,
ϕ
i
) with ϕ
i through the fuzzy extractor reproduction procedure and generates b
′
=
D
i
1
⊕
H
(
P
W
i
∥
θ
i
) with the stored parameter D
i
1, M
U
i.Step L2. M
U
i computes H
(
I
D
i
∥
P
W
i
∥
θ
i
∥
b
′
) and checks whether D
i
2
=
H
(
I
D
i
∥
P
W
i
∥
θ
i
∥
b
′
). An equality indicates that M
U
i is legal.Step L3. M
U
i calculates R
P
W
B
i
=
H
(
I
D
i
∥
H
(
P
W
i
∥
θ
i
∥
b
′
)
). M
U
i also generates A
i
j
=
V
i
j
′
⊕
R
P
B
W
i using the device parameter V
i
j
′.Step L4.
M
U
i selects an 128 bit random number R
N
i, generates the current timestamp T
S
i, and then computes:C
1
=
A
i
j
⊕
R
N
i
⊕
T
S
i
⊕
H
(
I
D
S
j
), H
1
=
H
(
I
D
i
∥
C
1
∥
R
N
i
∥
T
S
i
), T
I
D
i
=
R
I
D
i
j
⊕
H
(
I
D
i
∥
V
i
j
′
), R
I
D
S
j
=
R
I
D
S
j
′
⊕
H
(
θ
i
∥
b
′
), and T
I
D
i
∗
=
T
I
D
i
⊕
H
(
R
I
D
S
j
∥
T
S
i
).Step L5.
M
U
i
→
C
S
j
:
{
T
I
D
i
∗
,
C
1
,
H
1
,
T
S
i
}.


## 3.1.4. Authentication Phase

In this phase,C
S
j and M
U
i mutually authenticate each other and establish a session key. Since this phase is unrelated to our discussions, we omit it.


## 3.2. Flaws in RoyEt Al.’s Scheme

Recall that the three assumptions listed in Section3 are also clearly made in Roy et al.’s scheme. However, we observe that this scheme still remains feasible for an attacker to offline guess a user’s password. This means that the primary goal of “truly two-factor security” cannot be satisfied. In addition, the scheme cannot provide forward secrecy and sound scalability.


### 3.2.1. Offline Password Guessing Attack

Noting that Roy et al.’s scheme [19] is originally a three-factor one, here we are only interested in its two-factor version by assuming that the third factor (i.e., the biometric) has been known to A. This is realistic as users’ biometrics are constant during their lives, and how to protect user biometric template is still an open issue [55]. We find that this scheme cannot achieve truly two-factor security: it is subject to two types of offline password guessing attack. This in turn indicates that it cannot achieve truly three-factor security.Type-I Attack. .Suppose U
i’s biometric B
i and the secret parameters {
D
i
1
,
D
i
2, φ
i
,
h
(
·
)
} stored in the smart card are somehow obtained by A. At this point, A can find out U
i’s identity and password as follows:Step 1.
GuessesU
i’s identity I
D
i
∗ and password P
W
i
∗ from dictionary space D
i
d and D
p
w.Step 2.
Computesθ
i
=
R
e
p
(
B
i
,
φ
i
), b
∗
=
H
(
P
W
i
∥
θ
i
)
⊕
D
i
1, where D
i
1 is extracted from the smart card.Step 3.
ComputesD
i
2
∗
=
H
(
I
D
i
∗
∥
P
W
i
∗
∥
θ
i
∥
b
∗
), where θ
i is extracted from the smart card.Step 4.
Checks the validity of(
I
D
i
∗
,
P
W
i
∗
) by comparing the calculated D
i
2
∗ with the extracted D
i
2.Step 5.
Repeats Steps 1~4 until finds the correct pair of(
I
D
i
∗
,
P
W
i
∗
).The time complexity of this attack isO
(
D
i
d
∗
D
p
w
∗
2
T
H
+
T
B
) [3, 16]. Generally, it is only needed to calculate the biohashing function once; thus T
B can be ignored in practice. According to the running time in [16], A may complete the above attacking procedure within 17.6 days on a Laptop. This issue arises due to the inherent “usability-security tension”: to achieve local password change (i.e., C-2 in [3]) and timely typo detection (i.e., C-9 in [3]); there is an explicit password verifier D
i
2
=
H
(
I
D
i
∥
P
W
i
∥
θ
i
∥
b
) stored in U
i’s smart card, yet this verifier leads to a Type-I offline password attack.To eliminate this security issue without loss of usability, a promising countermeasure is to adopt the “fuzzy-verifier” technique [20] and store D
i
2
=
h
(
(
H
(
I
D
i
∥
P
W
i
∥
θ
i
∥
b
)
)
m
o
d
n
) in U
i’s smart card, where n specifies/confines the capacity of (
I
D
,
P
W
) pair, 2
4
≤
n
≤
2
8. As a result, even if A gets D
i
2, she can not figure out the correct (
I
D
,
P
W
) from the above attack, because there will be D
i
d
∗
D
p
w
/
n
≈
2
32 candidate (
I
D
,
P
W
) pairs that make D
i
2
∗
=
D
i
2 in Step 4. To further identify the exactly correct (
I
D
,
P
W
) pair, A needs to interact with the server, and we can adopt the “honeywords” technique [3, 56] to confine A’s advantage to a very limited value.Type-II Attack. .In the above attack, A does not need the protocol messages. In this attack, we assume that A can somehow obtain user’s smart card and extract its secret parameters {
D
i
1
,
D
i
2
,
V
i
j
′
,
φ
i
,
h
(
·
)
} and also can eavesdrop the login messages {
T
I
D
i
∗
,
C
1
,
H
1, T
S
i
} from the public channel. Now, A canoffline guess U
i’s password and identity simultaneously as follows:Step 1.
Guesses the value ofI
D
i
∗, P
W
i
∗ from dictionary space D
i
d and D
p
w.Step 2.
Computesθ
i
=
R
e
p
(
B
i
,
φ
i
), b
∗
=
H
(
P
W
i
∥
θ
i
)
⊕
D
i
1, where D
i
1 is extracted from the smart card.Step 3.
ComputesA
i
j
∗
=
V
i
j
′
⊕
H
(
I
D
i
∗
∥
H
(
P
W
i
∗
∥
θ
i
∥
b
∗
)
).Step 4.
ComputesR
N
i
∗
=
C
1
⊕
A
i
j
∗
⊕
T
S
i
⊕
H
(
I
D
S
j
).Step 5.
ComputesH
1
∗
=
H
(
I
D
i
∗
∥
C
1
∥
R
N
i
∗
∥
T
S
i
).Step 6.
Checks the correctness of(
I
D
i
∗
,
P
W
i
∗
) by comparing if the computed H
1
∗ equals the intercepted H
1.Step 7.
Repeats Steps 1~6 of the above procedure until find the correct value of(
I
D
i
∗
,
P
W
i
∗
).The time complexity of the above attacking procedure isO
(
D
i
d
∗
D
p
w
∗
(
5
T
H
+
T
B
)
), and A may complete the procedure within 44 days on a Laptop. In comparison, the Type-I attack is more practical.


### 3.2.2. No Forward Secrecy

A scheme that supports forward secrecy ensures that even after the long-term private key(s) of one or more participants were leaked, previously agreed session keys remain secure [27]. This is important, especially when considering the serious situations of today’s clouds like the compromise of cloud servers (e.g., [15]).If an attackerM has obtained the server C
S
j’s long-term key X
j from the breached server S and intercepted the messages {
T
I
D
i
∗
,
C
1
,
H
1
,
T
S
i
} that are exchanged between U
i and S’s authentication process from the public channel. M is able to figure out the session key using the following method:Step 1.
M computes R
I
D
S
j
=
H
(
I
D
S
j
∥
X
j
) and T
I
D
i
=
T
I
D
i
∗
⊕
H
(
R
I
D
S
j
∥
T
S
i
)Step 2.
M computes A
j
i
=
H
(
H
(
I
D
i
⊕
r
i
j
)
∥
X
j
), R
N
j
=
C
1
⊕
T
S
i
⊕
H
(
I
D
S
j
)
⊕
A
j
i, M
1
=
C
1
⊕
T
S
i
⊕
H
(
I
D
S
j
)
⊕
B
j
i;Step 3.
M calculates the session key s
k
=
H
(
I
D
i
∥
I
D
S
j
∥
A
j
i
∥
M
1
∥
R
N
j
∥
T
S
i
∥
T
S
j
).With the session keys
k computed, the entire session will be no secret to M.


### 3.2.3. Poor Scalability

In Roy et al.’s scheme, the user side stores all the cloud servers (i.e.,C
S
j, 1
≤
j
≤
n) related information: R
I
D
i
j
=
T
I
D
i
⊕
H
(
I
D
i
∥
V
i
j
′
) and R
I
D
S
j
′
=
R
I
D
S
j
⊕
H
(
θ
i
∥
b
) for 1
≤
j
≤
n. This means that when a new server arrives, all the users have to reregister with the registration center R
C. This shows poor scalability. Similarly, the server side stores all the users (i.e., U
i, 1
≤
i
≤
m ) related information: the credentials {
T
I
D
i
,
(
I
D
i
,
r
i
j
)
} (for 1
≤
i
≤
m) in database of C
S
j. This means that when a new user arrives, all the servers have to reregister with the registration center R
C.


## 3.2.1. Offline Password Guessing Attack

Noting that Roy et al.’s scheme [19] is originally a three-factor one, here we are only interested in its two-factor version by assuming that the third factor (i.e., the biometric) has been known to A. This is realistic as users’ biometrics are constant during their lives, and how to protect user biometric template is still an open issue [55]. We find that this scheme cannot achieve truly two-factor security: it is subject to two types of offline password guessing attack. This in turn indicates that it cannot achieve truly three-factor security.Type-I Attack. .Suppose U
i’s biometric B
i and the secret parameters {
D
i
1
,
D
i
2, φ
i
,
h
(
·
)
} stored in the smart card are somehow obtained by A. At this point, A can find out U
i’s identity and password as follows:Step 1.
GuessesU
i’s identity I
D
i
∗ and password P
W
i
∗ from dictionary space D
i
d and D
p
w.Step 2.
Computesθ
i
=
R
e
p
(
B
i
,
φ
i
), b
∗
=
H
(
P
W
i
∥
θ
i
)
⊕
D
i
1, where D
i
1 is extracted from the smart card.Step 3.
ComputesD
i
2
∗
=
H
(
I
D
i
∗
∥
P
W
i
∗
∥
θ
i
∥
b
∗
), where θ
i is extracted from the smart card.Step 4.
Checks the validity of(
I
D
i
∗
,
P
W
i
∗
) by comparing the calculated D
i
2
∗ with the extracted D
i
2.Step 5.
Repeats Steps 1~4 until finds the correct pair of(
I
D
i
∗
,
P
W
i
∗
).The time complexity of this attack isO
(
D
i
d
∗
D
p
w
∗
2
T
H
+
T
B
) [3, 16]. Generally, it is only needed to calculate the biohashing function once; thus T
B can be ignored in practice. According to the running time in [16], A may complete the above attacking procedure within 17.6 days on a Laptop. This issue arises due to the inherent “usability-security tension”: to achieve local password change (i.e., C-2 in [3]) and timely typo detection (i.e., C-9 in [3]); there is an explicit password verifier D
i
2
=
H
(
I
D
i
∥
P
W
i
∥
θ
i
∥
b
) stored in U
i’s smart card, yet this verifier leads to a Type-I offline password attack.To eliminate this security issue without loss of usability, a promising countermeasure is to adopt the “fuzzy-verifier” technique [20] and store D
i
2
=
h
(
(
H
(
I
D
i
∥
P
W
i
∥
θ
i
∥
b
)
)
m
o
d
n
) in U
i’s smart card, where n specifies/confines the capacity of (
I
D
,
P
W
) pair, 2
4
≤
n
≤
2
8. As a result, even if A gets D
i
2, she can not figure out the correct (
I
D
,
P
W
) from the above attack, because there will be D
i
d
∗
D
p
w
/
n
≈
2
32 candidate (
I
D
,
P
W
) pairs that make D
i
2
∗
=
D
i
2 in Step 4. To further identify the exactly correct (
I
D
,
P
W
) pair, A needs to interact with the server, and we can adopt the “honeywords” technique [3, 56] to confine A’s advantage to a very limited value.Type-II Attack. .In the above attack, A does not need the protocol messages. In this attack, we assume that A can somehow obtain user’s smart card and extract its secret parameters {
D
i
1
,
D
i
2
,
V
i
j
′
,
φ
i
,
h
(
·
)
} and also can eavesdrop the login messages {
T
I
D
i
∗
,
C
1
,
H
1, T
S
i
} from the public channel. Now, A canoffline guess U
i’s password and identity simultaneously as follows:Step 1.
Guesses the value ofI
D
i
∗, P
W
i
∗ from dictionary space D
i
d and D
p
w.Step 2.
Computesθ
i
=
R
e
p
(
B
i
,
φ
i
), b
∗
=
H
(
P
W
i
∥
θ
i
)
⊕
D
i
1, where D
i
1 is extracted from the smart card.Step 3.
ComputesA
i
j
∗
=
V
i
j
′
⊕
H
(
I
D
i
∗
∥
H
(
P
W
i
∗
∥
θ
i
∥
b
∗
)
).Step 4.
ComputesR
N
i
∗
=
C
1
⊕
A
i
j
∗
⊕
T
S
i
⊕
H
(
I
D
S
j
).Step 5.
ComputesH
1
∗
=
H
(
I
D
i
∗
∥
C
1
∥
R
N
i
∗
∥
T
S
i
).Step 6.
Checks the correctness of(
I
D
i
∗
,
P
W
i
∗
) by comparing if the computed H
1
∗ equals the intercepted H
1.Step 7.
Repeats Steps 1~6 of the above procedure until find the correct value of(
I
D
i
∗
,
P
W
i
∗
).The time complexity of the above attacking procedure isO
(
D
i
d
∗
D
p
w
∗
(
5
T
H
+
T
B
)
), and A may complete the procedure within 44 days on a Laptop. In comparison, the Type-I attack is more practical.


## 3.2.2. No Forward Secrecy

A scheme that supports forward secrecy ensures that even after the long-term private key(s) of one or more participants were leaked, previously agreed session keys remain secure [27]. This is important, especially when considering the serious situations of today’s clouds like the compromise of cloud servers (e.g., [15]).If an attackerM has obtained the server C
S
j’s long-term key X
j from the breached server S and intercepted the messages {
T
I
D
i
∗
,
C
1
,
H
1
,
T
S
i
} that are exchanged between U
i and S’s authentication process from the public channel. M is able to figure out the session key using the following method:Step 1.
M computes R
I
D
S
j
=
H
(
I
D
S
j
∥
X
j
) and T
I
D
i
=
T
I
D
i
∗
⊕
H
(
R
I
D
S
j
∥
T
S
i
)Step 2.
M computes A
j
i
=
H
(
H
(
I
D
i
⊕
r
i
j
)
∥
X
j
), R
N
j
=
C
1
⊕
T
S
i
⊕
H
(
I
D
S
j
)
⊕
A
j
i, M
1
=
C
1
⊕
T
S
i
⊕
H
(
I
D
S
j
)
⊕
B
j
i;Step 3.
M calculates the session key s
k
=
H
(
I
D
i
∥
I
D
S
j
∥
A
j
i
∥
M
1
∥
R
N
j
∥
T
S
i
∥
T
S
j
).With the session keys
k computed, the entire session will be no secret to M.


## 3.2.3. Poor Scalability

In Roy et al.’s scheme, the user side stores all the cloud servers (i.e.,C
S
j, 1
≤
j
≤
n) related information: R
I
D
i
j
=
T
I
D
i
⊕
H
(
I
D
i
∥
V
i
j
′
) and R
I
D
S
j
′
=
R
I
D
S
j
⊕
H
(
θ
i
∥
b
) for 1
≤
j
≤
n. This means that when a new server arrives, all the users have to reregister with the registration center R
C. This shows poor scalability. Similarly, the server side stores all the users (i.e., U
i, 1
≤
i
≤
m ) related information: the credentials {
T
I
D
i
,
(
I
D
i
,
r
i
j
)
} (for 1
≤
i
≤
m) in database of C
S
j. This means that when a new user arrives, all the servers have to reregister with the registration center R
C.


## 4. Revisiting Amin Et Al.’s Scheme

In 2018, Amin et al. [21] pointed out that previous schemes (e.g., [35–37]) are vulnerable to various security loopholes and developed a new scheme for distributed cloud computing environments. However, here we show that this scheme still has several serious defects being overlooked (i.e., offline password guessing attack, no forward secrecy, and no user untraceability).


### 4.1. Review AminEt Al.’s Scheme

#### 4.1.1. Cloud Server Registration Phase

The registration phase is partitioned into two parts: cloud server registration and user registration. When the cloud serverS
m registers, S
m chooses her identity S
I
D
m, a random nonce d, and sends S
I
D
m
,
d to C
S. Upon getting S
m’s registration request, the control server C
S computes P
S
I
D
m
=
h
S
I
D
m
∥
d, B
S
m
=
h
(
P
S
I
D
m
∥
y
), and sends B
S
m to S
m over a secure channel. Finally, S
m keeps the secret data B
S
m
,
d in a secure place (e.g., a usb-key).


#### 4.1.2. User Registration Phase

When the userU
i registers, she first prefers an identity I
D
i, password P
W
i, and 2 random nonces b
1
,
b
2. Then, she computes A
i
=
h
(
P
W
i
∥
b
1
), P
I
D
i
=
h
(
I
D
i
∥
b
2
), b
b
i
=
b
2
⊕
A
i, and sends 〈
A
i
,
P
I
D
i
〉 to the C
S securely. Once getting A
i
,
P
I
D
i, C
S conducts the following steps:(1)
C
i
=
h
A
i
∥
P
I
D
i
D
i
=
h
P
I
D
i
∥
x
E
i
=
D
i
⊕
A
i
.Finally,C
S stores the parameters {
C
i
,
E
i
,
h
(
·
)
} in the smartcard and delivers the smartcard for U
i through a private communication channel. Then, U
i stores D
P
,
b
b
i in the card, where D
P
=
h
(
I
D
i
∥
P
W
i
)
⊕
b
1. Finally, the smartcard stores C
i
,
E
i
,
b
b
i
,
D
P
,
h
·.


#### 4.1.3. Login Phase

U
i first inputs the smartcard into a card reader C
R and keys I
D
i
∗ and P
W
i
∗ on the reader. Then, C
R calculates(2)
b
1
∗
=
D
P
⊕
h
I
D
i
∗
∥
P
W
i
∗
A
i
∗
=
h
P
W
i
∗
∥
b
1
∗
b
2
∗
=
b
b
i
⊕
A
i
∗
P
I
D
i
∗
=
h
I
D
i
∗
∥
b
2
∗
C
i
∗
=
h
A
i
∗
∥
P
I
D
i
∗
.Then, the card readerC
R checks whether (
C
i
∗
=
?
C
i
). If (
C
i
∗
=
=
C
i
), it means that (
I
D
i
∗
=
I
D
i
) and (
P
W
i
∗
=
P
W
i
). Then, C
R produces a 128 bit random nonce N
i and computes(3)
D
i
=
E
i
⊕
A
i
G
i
=
h
P
I
D
i
∥
S
I
D
m
∥
N
i
∥
T
S
i
∥
D
i
F
i
=
D
i
⊕
N
i
Z
i
=
S
I
D
m
⊕
h
D
i
∥
N
iwhereS
I
D
m is the identity of the cloud server from which by U
i wants to login. Then, C
R sends the login request G
i
,
F
i
,
Z
i
,
P
I
D
i
,
T
S
i to S
m publicly.


#### 4.1.4. Authentication Phase

This phase is to achieve mutual authentication and key agreement amongU
i, S
m, and C
S.Step 1.
S
m first verifies whether (
T
S
m
-
T
S
i
<
△
T
), where T
S
m is the cloud server’s current timestamp and △
T is the allowed transmission delay time. If the equality is not true, S
m rejects the connection; otherwise, S
m generates a 128 bit random nonce N
m and computes(4)
J
i
=
B
S
m
⊕
N
m
K
i
=
h
N
m
∥
B
S
m
∥
G
i
∥
T
S
j
.
Then,S
m sends 〈
J
i
,
K
i
,
P
S
I
D
m
,
G
i
,
F
i
,
Z
i, P
I
D
i
,
T
S
i
,
T
S
m
〉 to the C
S over a public channel.Step 2.
On getting login messages,C
S first checks whether (
T
S
c
s
-
T
S
m
<
△
T
∗
), where T
S
c
s is the cloud server’s current timestamp and △
T
∗ the expected delay time for transmission. If the equality is not true, S
m rejects the connection; otherwise, C
S computes(5)
D
i
=
h
P
I
D
i
∥
x
N
i
∗
=
F
i
⊕
D
i
S
I
D
m
∗
=
Z
i
⊕
h
D
i
∥
N
i
∗
G
i
∗
=
h
P
I
D
i
∥
S
I
D
m
∗
∥
N
i
∗
∥
D
i
∥
T
S
i
.
Then,C
S checks whether (
G
i
∗
=
?
G
i
). If (
G
i
∗
=
=
G
i
), C
S deems U
i as legal; otherwise, rejects the connection. Then, C
S computes(6)
B
S
m
∗
=
h
P
S
I
D
m
∥
y
N
m
∗
=
B
S
m
∗
⊕
J
i
K
i
∗
=
h
B
S
m
∗
∥
N
m
∗
∥
G
i
∥
T
S
m
.
Once again,C
S checks (
K
i
∗
=
?
K
i
). If (
K
i
∗
=
=
K
i
), C
S deems S
m as legal; otherwise, it rejects the connection. Then, C
S selects a 128 bit random nonce N
c
s and computes(7)
P
c
s
=
N
m
⊕
N
c
s
⊕
h
N
i
∥
D
i
R
c
s
=
N
i
⊕
N
c
s
⊕
h
B
S
m
∗
∥
N
m
∗
S
K
c
s
=
h
N
i
⊕
N
m
⊕
N
c
s
Q
c
s
=
h
N
m
⊕
N
c
s
∥
S
K
c
s
V
c
s
=
h
N
i
∥
N
c
s
∥
S
K
c
s
whereS
K
c
s is the agreed session key. Then, C
S sends P
c
s
,
R
c
s
,
Q
c
s
,
V
c
s to S
m.Step 3.
On getting the reply fromC
S, S
m calculates(8)
W
m
=
h
B
S
m
∥
N
m
N
i
⊕
N
c
s
=
R
c
s
⊕
W
m
S
K
m
=
h
N
i
⊕
N
c
s
⊕
N
m
V
c
s
∗
=
h
N
i
⊕
N
c
s
∥
S
K
m
.
Then,S
m verifies V
c
s
∗
=
?
V
c
s or not and if V
c
s
∗
≠
V
c
s, rejects the connection, and then sends P
c
s
,
Q
c
s to U
i publicly.Step 4.
On gettingS
m, U
i calculates(9)
L
i
=
h
N
i
∥
D
i
N
m
⊕
N
c
s
=
P
c
s
⊕
L
i
S
K
i
=
h
N
m
⊕
N
c
s
⊕
N
i
Q
c
s
∗
=
h
N
m
⊕
N
c
s
∥
S
K
i
.
Then,U
i verifies (
Q
c
s
∗
=
?
Q
c
s
) and if (
Q
c
s
∗
=
=
Q
c
s
), it demonstrates the authenticity of S
m and C
S. Finally, mutual authentication are attained among U
i, S
m and C
S. Now, U
i and S
m share the same session key S
K
m
=
S
K
i, and they can exchange sensitive information subsequently using S
K
m
=
S
K
i.


#### 4.1.5. Password Change Phase

This phase is performed locally: not interacting with the server. WhenU
i wants to update her password, she provides I
D
i and P
W
i after inputting the smartcard. Then, C
R executes the operations:(10)
b
1
∗
=
D
P
⊕
h
I
D
i
∗
∥
P
W
i
∗
A
i
∗
=
h
P
W
i
∗
∥
b
1
∗
b
2
∗
=
b
b
i
⊕
A
i
∗
P
I
D
i
∗
=
h
I
D
i
∗
∥
b
2
∗
C
i
∗
=
h
A
i
∗
∥
P
I
D
i
∗
.The smartcard verifies(
C
i
∗
=
?
C
i
). If (
C
i
∗
=
=
C
i
), user U
i is asked to enter a new password P
W
i
n
e
w and calculates(11)
A
i
n
e
w
=
h
P
W
i
n
e
w
∥
b
1
C
i
n
e
w
=
h
A
i
n
e
w
∥
P
I
D
i
∗
D
i
=
E
i
⊕
A
i
=
h
P
I
D
i
∗
∥
x
,
b
b
i
∗
=
b
2
∗
⊕
A
i
n
e
w
E
i
n
e
w
=
D
i
⊕
A
i
n
e
w
D
P
n
e
w
=
h
I
D
i
∥
P
W
i
n
e
w
⊕
b
1
∗
.Finally,C
R substitutes C
i
,
E
i
,
b
b
i
,
D
P
n
e
w with C
i
n
e
w
,
E
i
n
e
w
,
b
b
i
∗
,
D
P
n
e
w, respectively, in the card.


### 4.2. Cryptanalysis of Amin Et Al.’s Scheme

Recall that the three assumptions listed in Section2.2.1 are also clearly made in Amin et al.’s scheme [21]. However, we observe that this scheme still remains feasible for an attacker to offline guess a user’s password. This means that the primary goal of “truly two-factor security” cannot be satisfying. In addition, the scheme cannot provide forward secrecy and user untraceability.


#### 4.2.1. Offline Password Guessing Attack

We find Amin et al.’s scheme cannot achieve truly two-factor security: it is subject to two types of offline password guessing attack when the smart card factor is compromised.Type-I Attack. .Suppose the secret parameters {
C
i
,
E
i, b
b
i
,
D
P
,
h
(
·
)
} stored in U
i’s smart card are somehow obtained by A. At this point, A can find out U
i’s identity and password as follows:Step 1.
GuessesU
i’s identity I
D
i
∗ and password P
W
i
∗ from dictionary space D
i
d and D
p
w.Step 2.
Computesb
1
∗
=
D
P
⊕
h
(
I
D
i
∗
∥
P
W
i
∗
), where D
P is extracted from the smart card.Step 3.
ComputesA
i
∗
=
h
(
P
W
i
∗
∥
b
1
∗
);Step 4.
Computesb
2
∗
=
b
b
i
⊕
A
i
∗, where b
b
i is extracted from the smart card.Step 5.
ComputesP
I
D
i
∗
=
h
(
I
D
i
∗
∥
b
2
∗
);Step 6.
ComputesC
i
∗
=
h
(
A
i
∗
∥
P
I
D
i
∗
);Step 7.
Checks the validity of(
I
D
i
∗
,
P
W
i
∗
) by comparing the computed C
i
∗ with C
i which is extracted from card.Step 8.
Repeats Steps 1~7 until determine the right pair of(
I
D
i
∗
,
P
W
i
∗
).The time complexity of this attack isO
(
D
i
d
∗
D
p
w
∗
4
T
H
) [3, 16]. According to the running time in [16], A may complete the above attacking procedure within 35.2 days on a Laptop. This issue arises due to the inherent “usability-security tension”: to achieve local password change (i.e., C-2 in [3]) and timely typo detection (i.e., C-9 in [3]); there is an explicit password verifier C
i = h
(
A
i
∥
P
I
D
i
)
=
h
(
h
(
P
W
i
∥
b
1
)
∥
h
(
I
D
i
∥
b
2
)
) stored in U
i’s smart card, yet this verifier leads to a Type-I offline password attack.To tackle this security issue while not losing usability, a viable countermeasure is to adopt the “fuzzy-verifier” technique [20] and keep C
i
=
h
(
h
(
P
W
i
∥
b
1
)
∥
h
(
I
D
i
∥
b
2
)
m
o
d
n
) in U
i’s smart card, where n confines the capacity of (
I
D
,
P
W
) pair, 2
4
≤
n
≤
2
8. As a result, even if A obtains D
i
2, she can not identify the correct (
I
D
,
P
W
) from the above attack, because there will be D
i
d
∗
D
p
w
/
n
≈
2
32 candidate (
I
D
,
P
W
) pairs that make D
i
2
∗
=
D
i
2 in Step 4. To further identify the exactly correct (
I
D
,
P
W
) pair, A needs to interact with the server, and we can adopt the “honeywords” technique [3, 56] to confine A’s advantage to a very limited value.Type-II Attack. .In the above attack, A does not need the protocol messages. In this attack, we assume that A can somehow obtain user’s smart card and extract its secret parameters {
C
i
,
E
i
,
b
b
i
,
D
P
,
h
(
·
)
} and can also eavesdrop the login messages {
G
i
,
F
i, Z
i
} from the public channel. Now, A canoffline guess U
i’s password and identity simultaneously as follows:Step 1.
Guesses the value ofI
D
i
∗, P
W
i
∗ from dictionary space D
i
d and D
p
w.Step 2.
Computesb
1
∗
=
D
P
⊕
h
(
I
D
i
∗
∥
P
W
i
∗
), where D
P is extracted from the smart card.Step 3.
ComputesA
i
∗
=
h
(
P
W
i
∗
∥
b
1
∗
);Step 4.
ComputesD
i
∗
=
E
i
⊕
A
i
∗.Step 5.
ComputesN
i
∗
=
F
i
⊕
D
i
∗;Step 6.
ComputesZ
i
∗
=
S
I
D
m
⊕
h
(
D
i
∗
⊕
N
i
∗
);Step 7.
Checks the correctness of(
I
D
i
∗
,
P
W
i
∗
) by comparing if the computed Z
1
∗ equals the intercepted Z
1.Step 8.
Repeats Steps 1~7 of the above procedure until the correct value of(
I
D
i
∗
,
P
W
i
∗
) is found.The time complexity of the above attacking procedure isO
(
D
i
d
∗
D
p
w
∗
3
T
H
), and A may complete the procedure within 26.4 days on a Laptop. In comparison, the Type-I attack is more practical. Amin et al. noted that user’s mobile devices and IoT sensors are generally of “low memory, low power, and battery and network limitations” [21], and thus they prefer to only use lightweight symmetric key techniques to achieve robust security. It is just this motivation that makes their scheme vulnerable to the Type-II offline password guessing attack. And the rationales can be found in [20, 57].


#### 4.2.2. No Forward Secrecy

A scheme that supports forward secrecy ensures that even after the long-term private key(s) of one or more participants was(were) leaked, previously agreed session keys remain secure [27]. This is important, especially when considering the serious situations of today’s clouds like the compromise of cloud servers (e.g., [15]).If an attackerM has obtained the cloud server S
m’s long-term key B
S
m from the breached server S
m and intercepted the messages {
J
i; P
c
s
,
R
c
s
,
Q
c
s
,
V
c
s
} that are exchanged between U
i and S
m’s authentication process from the public channel. M is able to figure out the session key using the following method:Step 1.
M computes N
m
=
J
i
⊕
B
S
m;Step 2.
M computes W
m
=
h
(
B
S
m
∥
N
m
);Step 3.
M computes N
i
⊕
N
c
s
=
R
c
s
⊕
W
m;Step 4.
M calculates the session key S
K
m
=
h
(
N
i
⊕
N
c
s
⊕
N
m
).With the session keyS
K
m computed, the entire session will be no secret to M. This vulnerability is due to a result of violating the “forward secrecy principle” given in [20]: public-key technique is necessary to attain forward secrecy and at least two exponential operations (or point multiplications in ECC) are needed at the server side.


#### 4.2.3. No User Untraceability

As revealed in [22], in the context of user authentication, there are two types of user anonymity: (
1
) the basic one, i.e., user identity-protection which requires that the attacker is unable to get the target user’s real identity from eavesdropping the protocol messages; (
2
) the advanced one, i.e., user untraceability which guarantees that the attacker is unable to neither figure out the target user’s identity nor determine whether two conversations are come from the same (unknown) user from eavesdropping the protocol messages. Therefore, most schemes (e.g., [4, 35, 39, 58–62]) that aim to preserve user anonymity attempt to fulfil the latter advanced notion of user anonymity. However, in Amin et al.’s scheme [21], the pseudoidentity P
I
D
i is sent in every login request. Thus, the attacker can track all the login activities through this static pesudoidentity P
I
D
i.


## 4.1. Review AminEt Al.’s Scheme

### 4.1.1. Cloud Server Registration Phase

The registration phase is partitioned into two parts: cloud server registration and user registration. When the cloud serverS
m registers, S
m chooses her identity S
I
D
m, a random nonce d, and sends S
I
D
m
,
d to C
S. Upon getting S
m’s registration request, the control server C
S computes P
S
I
D
m
=
h
S
I
D
m
∥
d, B
S
m
=
h
(
P
S
I
D
m
∥
y
), and sends B
S
m to S
m over a secure channel. Finally, S
m keeps the secret data B
S
m
,
d in a secure place (e.g., a usb-key).


### 4.1.2. User Registration Phase

When the userU
i registers, she first prefers an identity I
D
i, password P
W
i, and 2 random nonces b
1
,
b
2. Then, she computes A
i
=
h
(
P
W
i
∥
b
1
), P
I
D
i
=
h
(
I
D
i
∥
b
2
), b
b
i
=
b
2
⊕
A
i, and sends 〈
A
i
,
P
I
D
i
〉 to the C
S securely. Once getting A
i
,
P
I
D
i, C
S conducts the following steps:(1)
C
i
=
h
A
i
∥
P
I
D
i
D
i
=
h
P
I
D
i
∥
x
E
i
=
D
i
⊕
A
i
.Finally,C
S stores the parameters {
C
i
,
E
i
,
h
(
·
)
} in the smartcard and delivers the smartcard for U
i through a private communication channel. Then, U
i stores D
P
,
b
b
i in the card, where D
P
=
h
(
I
D
i
∥
P
W
i
)
⊕
b
1. Finally, the smartcard stores C
i
,
E
i
,
b
b
i
,
D
P
,
h
·.


### 4.1.3. Login Phase

U
i first inputs the smartcard into a card reader C
R and keys I
D
i
∗ and P
W
i
∗ on the reader. Then, C
R calculates(2)
b
1
∗
=
D
P
⊕
h
I
D
i
∗
∥
P
W
i
∗
A
i
∗
=
h
P
W
i
∗
∥
b
1
∗
b
2
∗
=
b
b
i
⊕
A
i
∗
P
I
D
i
∗
=
h
I
D
i
∗
∥
b
2
∗
C
i
∗
=
h
A
i
∗
∥
P
I
D
i
∗
.Then, the card readerC
R checks whether (
C
i
∗
=
?
C
i
). If (
C
i
∗
=
=
C
i
), it means that (
I
D
i
∗
=
I
D
i
) and (
P
W
i
∗
=
P
W
i
). Then, C
R produces a 128 bit random nonce N
i and computes(3)
D
i
=
E
i
⊕
A
i
G
i
=
h
P
I
D
i
∥
S
I
D
m
∥
N
i
∥
T
S
i
∥
D
i
F
i
=
D
i
⊕
N
i
Z
i
=
S
I
D
m
⊕
h
D
i
∥
N
iwhereS
I
D
m is the identity of the cloud server from which by U
i wants to login. Then, C
R sends the login request G
i
,
F
i
,
Z
i
,
P
I
D
i
,
T
S
i to S
m publicly.


### 4.1.4. Authentication Phase

This phase is to achieve mutual authentication and key agreement amongU
i, S
m, and C
S.Step 1.
S
m first verifies whether (
T
S
m
-
T
S
i
<
△
T
), where T
S
m is the cloud server’s current timestamp and △
T is the allowed transmission delay time. If the equality is not true, S
m rejects the connection; otherwise, S
m generates a 128 bit random nonce N
m and computes(4)
J
i
=
B
S
m
⊕
N
m
K
i
=
h
N
m
∥
B
S
m
∥
G
i
∥
T
S
j
.
Then,S
m sends 〈
J
i
,
K
i
,
P
S
I
D
m
,
G
i
,
F
i
,
Z
i, P
I
D
i
,
T
S
i
,
T
S
m
〉 to the C
S over a public channel.Step 2.
On getting login messages,C
S first checks whether (
T
S
c
s
-
T
S
m
<
△
T
∗
), where T
S
c
s is the cloud server’s current timestamp and △
T
∗ the expected delay time for transmission. If the equality is not true, S
m rejects the connection; otherwise, C
S computes(5)
D
i
=
h
P
I
D
i
∥
x
N
i
∗
=
F
i
⊕
D
i
S
I
D
m
∗
=
Z
i
⊕
h
D
i
∥
N
i
∗
G
i
∗
=
h
P
I
D
i
∥
S
I
D
m
∗
∥
N
i
∗
∥
D
i
∥
T
S
i
.
Then,C
S checks whether (
G
i
∗
=
?
G
i
). If (
G
i
∗
=
=
G
i
), C
S deems U
i as legal; otherwise, rejects the connection. Then, C
S computes(6)
B
S
m
∗
=
h
P
S
I
D
m
∥
y
N
m
∗
=
B
S
m
∗
⊕
J
i
K
i
∗
=
h
B
S
m
∗
∥
N
m
∗
∥
G
i
∥
T
S
m
.
Once again,C
S checks (
K
i
∗
=
?
K
i
). If (
K
i
∗
=
=
K
i
), C
S deems S
m as legal; otherwise, it rejects the connection. Then, C
S selects a 128 bit random nonce N
c
s and computes(7)
P
c
s
=
N
m
⊕
N
c
s
⊕
h
N
i
∥
D
i
R
c
s
=
N
i
⊕
N
c
s
⊕
h
B
S
m
∗
∥
N
m
∗
S
K
c
s
=
h
N
i
⊕
N
m
⊕
N
c
s
Q
c
s
=
h
N
m
⊕
N
c
s
∥
S
K
c
s
V
c
s
=
h
N
i
∥
N
c
s
∥
S
K
c
s
whereS
K
c
s is the agreed session key. Then, C
S sends P
c
s
,
R
c
s
,
Q
c
s
,
V
c
s to S
m.Step 3.
On getting the reply fromC
S, S
m calculates(8)
W
m
=
h
B
S
m
∥
N
m
N
i
⊕
N
c
s
=
R
c
s
⊕
W
m
S
K
m
=
h
N
i
⊕
N
c
s
⊕
N
m
V
c
s
∗
=
h
N
i
⊕
N
c
s
∥
S
K
m
.
Then,S
m verifies V
c
s
∗
=
?
V
c
s or not and if V
c
s
∗
≠
V
c
s, rejects the connection, and then sends P
c
s
,
Q
c
s to U
i publicly.Step 4.
On gettingS
m, U
i calculates(9)
L
i
=
h
N
i
∥
D
i
N
m
⊕
N
c
s
=
P
c
s
⊕
L
i
S
K
i
=
h
N
m
⊕
N
c
s
⊕
N
i
Q
c
s
∗
=
h
N
m
⊕
N
c
s
∥
S
K
i
.
Then,U
i verifies (
Q
c
s
∗
=
?
Q
c
s
) and if (
Q
c
s
∗
=
=
Q
c
s
), it demonstrates the authenticity of S
m and C
S. Finally, mutual authentication are attained among U
i, S
m and C
S. Now, U
i and S
m share the same session key S
K
m
=
S
K
i, and they can exchange sensitive information subsequently using S
K
m
=
S
K
i.


### 4.1.5. Password Change Phase

This phase is performed locally: not interacting with the server. WhenU
i wants to update her password, she provides I
D
i and P
W
i after inputting the smartcard. Then, C
R executes the operations:(10)
b
1
∗
=
D
P
⊕
h
I
D
i
∗
∥
P
W
i
∗
A
i
∗
=
h
P
W
i
∗
∥
b
1
∗
b
2
∗
=
b
b
i
⊕
A
i
∗
P
I
D
i
∗
=
h
I
D
i
∗
∥
b
2
∗
C
i
∗
=
h
A
i
∗
∥
P
I
D
i
∗
.The smartcard verifies(
C
i
∗
=
?
C
i
). If (
C
i
∗
=
=
C
i
), user U
i is asked to enter a new password P
W
i
n
e
w and calculates(11)
A
i
n
e
w
=
h
P
W
i
n
e
w
∥
b
1
C
i
n
e
w
=
h
A
i
n
e
w
∥
P
I
D
i
∗
D
i
=
E
i
⊕
A
i
=
h
P
I
D
i
∗
∥
x
,
b
b
i
∗
=
b
2
∗
⊕
A
i
n
e
w
E
i
n
e
w
=
D
i
⊕
A
i
n
e
w
D
P
n
e
w
=
h
I
D
i
∥
P
W
i
n
e
w
⊕
b
1
∗
.Finally,C
R substitutes C
i
,
E
i
,
b
b
i
,
D
P
n
e
w with C
i
n
e
w
,
E
i
n
e
w
,
b
b
i
∗
,
D
P
n
e
w, respectively, in the card.


## 4.1.1. Cloud Server Registration Phase

The registration phase is partitioned into two parts: cloud server registration and user registration. When the cloud serverS
m registers, S
m chooses her identity S
I
D
m, a random nonce d, and sends S
I
D
m
,
d to C
S. Upon getting S
m’s registration request, the control server C
S computes P
S
I
D
m
=
h
S
I
D
m
∥
d, B
S
m
=
h
(
P
S
I
D
m
∥
y
), and sends B
S
m to S
m over a secure channel. Finally, S
m keeps the secret data B
S
m
,
d in a secure place (e.g., a usb-key).


## 4.1.2. User Registration Phase

When the userU
i registers, she first prefers an identity I
D
i, password P
W
i, and 2 random nonces b
1
,
b
2. Then, she computes A
i
=
h
(
P
W
i
∥
b
1
), P
I
D
i
=
h
(
I
D
i
∥
b
2
), b
b
i
=
b
2
⊕
A
i, and sends 〈
A
i
,
P
I
D
i
〉 to the C
S securely. Once getting A
i
,
P
I
D
i, C
S conducts the following steps:(1)
C
i
=
h
A
i
∥
P
I
D
i
D
i
=
h
P
I
D
i
∥
x
E
i
=
D
i
⊕
A
i
.Finally,C
S stores the parameters {
C
i
,
E
i
,
h
(
·
)
} in the smartcard and delivers the smartcard for U
i through a private communication channel. Then, U
i stores D
P
,
b
b
i in the card, where D
P
=
h
(
I
D
i
∥
P
W
i
)
⊕
b
1. Finally, the smartcard stores C
i
,
E
i
,
b
b
i
,
D
P
,
h
·.


## 4.1.3. Login Phase

U
i first inputs the smartcard into a card reader C
R and keys I
D
i
∗ and P
W
i
∗ on the reader. Then, C
R calculates(2)
b
1
∗
=
D
P
⊕
h
I
D
i
∗
∥
P
W
i
∗
A
i
∗
=
h
P
W
i
∗
∥
b
1
∗
b
2
∗
=
b
b
i
⊕
A
i
∗
P
I
D
i
∗
=
h
I
D
i
∗
∥
b
2
∗
C
i
∗
=
h
A
i
∗
∥
P
I
D
i
∗
.Then, the card readerC
R checks whether (
C
i
∗
=
?
C
i
). If (
C
i
∗
=
=
C
i
), it means that (
I
D
i
∗
=
I
D
i
) and (
P
W
i
∗
=
P
W
i
). Then, C
R produces a 128 bit random nonce N
i and computes(3)
D
i
=
E
i
⊕
A
i
G
i
=
h
P
I
D
i
∥
S
I
D
m
∥
N
i
∥
T
S
i
∥
D
i
F
i
=
D
i
⊕
N
i
Z
i
=
S
I
D
m
⊕
h
D
i
∥
N
iwhereS
I
D
m is the identity of the cloud server from which by U
i wants to login. Then, C
R sends the login request G
i
,
F
i
,
Z
i
,
P
I
D
i
,
T
S
i to S
m publicly.


## 4.1.4. Authentication Phase

This phase is to achieve mutual authentication and key agreement amongU
i, S
m, and C
S.Step 1.
S
m first verifies whether (
T
S
m
-
T
S
i
<
△
T
), where T
S
m is the cloud server’s current timestamp and △
T is the allowed transmission delay time. If the equality is not true, S
m rejects the connection; otherwise, S
m generates a 128 bit random nonce N
m and computes(4)
J
i
=
B
S
m
⊕
N
m
K
i
=
h
N
m
∥
B
S
m
∥
G
i
∥
T
S
j
.
Then,S
m sends 〈
J
i
,
K
i
,
P
S
I
D
m
,
G
i
,
F
i
,
Z
i, P
I
D
i
,
T
S
i
,
T
S
m
〉 to the C
S over a public channel.Step 2.
On getting login messages,C
S first checks whether (
T
S
c
s
-
T
S
m
<
△
T
∗
), where T
S
c
s is the cloud server’s current timestamp and △
T
∗ the expected delay time for transmission. If the equality is not true, S
m rejects the connection; otherwise, C
S computes(5)
D
i
=
h
P
I
D
i
∥
x
N
i
∗
=
F
i
⊕
D
i
S
I
D
m
∗
=
Z
i
⊕
h
D
i
∥
N
i
∗
G
i
∗
=
h
P
I
D
i
∥
S
I
D
m
∗
∥
N
i
∗
∥
D
i
∥
T
S
i
.
Then,C
S checks whether (
G
i
∗
=
?
G
i
). If (
G
i
∗
=
=
G
i
), C
S deems U
i as legal; otherwise, rejects the connection. Then, C
S computes(6)
B
S
m
∗
=
h
P
S
I
D
m
∥
y
N
m
∗
=
B
S
m
∗
⊕
J
i
K
i
∗
=
h
B
S
m
∗
∥
N
m
∗
∥
G
i
∥
T
S
m
.
Once again,C
S checks (
K
i
∗
=
?
K
i
). If (
K
i
∗
=
=
K
i
), C
S deems S
m as legal; otherwise, it rejects the connection. Then, C
S selects a 128 bit random nonce N
c
s and computes(7)
P
c
s
=
N
m
⊕
N
c
s
⊕
h
N
i
∥
D
i
R
c
s
=
N
i
⊕
N
c
s
⊕
h
B
S
m
∗
∥
N
m
∗
S
K
c
s
=
h
N
i
⊕
N
m
⊕
N
c
s
Q
c
s
=
h
N
m
⊕
N
c
s
∥
S
K
c
s
V
c
s
=
h
N
i
∥
N
c
s
∥
S
K
c
s
whereS
K
c
s is the agreed session key. Then, C
S sends P
c
s
,
R
c
s
,
Q
c
s
,
V
c
s to S
m.Step 3.
On getting the reply fromC
S, S
m calculates(8)
W
m
=
h
B
S
m
∥
N
m
N
i
⊕
N
c
s
=
R
c
s
⊕
W
m
S
K
m
=
h
N
i
⊕
N
c
s
⊕
N
m
V
c
s
∗
=
h
N
i
⊕
N
c
s
∥
S
K
m
.
Then,S
m verifies V
c
s
∗
=
?
V
c
s or not and if V
c
s
∗
≠
V
c
s, rejects the connection, and then sends P
c
s
,
Q
c
s to U
i publicly.Step 4.
On gettingS
m, U
i calculates(9)
L
i
=
h
N
i
∥
D
i
N
m
⊕
N
c
s
=
P
c
s
⊕
L
i
S
K
i
=
h
N
m
⊕
N
c
s
⊕
N
i
Q
c
s
∗
=
h
N
m
⊕
N
c
s
∥
S
K
i
.
Then,U
i verifies (
Q
c
s
∗
=
?
Q
c
s
) and if (
Q
c
s
∗
=
=
Q
c
s
), it demonstrates the authenticity of S
m and C
S. Finally, mutual authentication are attained among U
i, S
m and C
S. Now, U
i and S
m share the same session key S
K
m
=
S
K
i, and they can exchange sensitive information subsequently using S
K
m
=
S
K
i.


## 4.1.5. Password Change Phase

This phase is performed locally: not interacting with the server. WhenU
i wants to update her password, she provides I
D
i and P
W
i after inputting the smartcard. Then, C
R executes the operations:(10)
b
1
∗
=
D
P
⊕
h
I
D
i
∗
∥
P
W
i
∗
A
i
∗
=
h
P
W
i
∗
∥
b
1
∗
b
2
∗
=
b
b
i
⊕
A
i
∗
P
I
D
i
∗
=
h
I
D
i
∗
∥
b
2
∗
C
i
∗
=
h
A
i
∗
∥
P
I
D
i
∗
.The smartcard verifies(
C
i
∗
=
?
C
i
). If (
C
i
∗
=
=
C
i
), user U
i is asked to enter a new password P
W
i
n
e
w and calculates(11)
A
i
n
e
w
=
h
P
W
i
n
e
w
∥
b
1
C
i
n
e
w
=
h
A
i
n
e
w
∥
P
I
D
i
∗
D
i
=
E
i
⊕
A
i
=
h
P
I
D
i
∗
∥
x
,
b
b
i
∗
=
b
2
∗
⊕
A
i
n
e
w
E
i
n
e
w
=
D
i
⊕
A
i
n
e
w
D
P
n
e
w
=
h
I
D
i
∥
P
W
i
n
e
w
⊕
b
1
∗
.Finally,C
R substitutes C
i
,
E
i
,
b
b
i
,
D
P
n
e
w with C
i
n
e
w
,
E
i
n
e
w
,
b
b
i
∗
,
D
P
n
e
w, respectively, in the card.


## 4.2. Cryptanalysis of Amin Et Al.’s Scheme

Recall that the three assumptions listed in Section2.2.1 are also clearly made in Amin et al.’s scheme [21]. However, we observe that this scheme still remains feasible for an attacker to offline guess a user’s password. This means that the primary goal of “truly two-factor security” cannot be satisfying. In addition, the scheme cannot provide forward secrecy and user untraceability.


### 4.2.1. Offline Password Guessing Attack

We find Amin et al.’s scheme cannot achieve truly two-factor security: it is subject to two types of offline password guessing attack when the smart card factor is compromised.Type-I Attack. .Suppose the secret parameters {
C
i
,
E
i, b
b
i
,
D
P
,
h
(
·
)
} stored in U
i’s smart card are somehow obtained by A. At this point, A can find out U
i’s identity and password as follows:Step 1.
GuessesU
i’s identity I
D
i
∗ and password P
W
i
∗ from dictionary space D
i
d and D
p
w.Step 2.
Computesb
1
∗
=
D
P
⊕
h
(
I
D
i
∗
∥
P
W
i
∗
), where D
P is extracted from the smart card.Step 3.
ComputesA
i
∗
=
h
(
P
W
i
∗
∥
b
1
∗
);Step 4.
Computesb
2
∗
=
b
b
i
⊕
A
i
∗, where b
b
i is extracted from the smart card.Step 5.
ComputesP
I
D
i
∗
=
h
(
I
D
i
∗
∥
b
2
∗
);Step 6.
ComputesC
i
∗
=
h
(
A
i
∗
∥
P
I
D
i
∗
);Step 7.
Checks the validity of(
I
D
i
∗
,
P
W
i
∗
) by comparing the computed C
i
∗ with C
i which is extracted from card.Step 8.
Repeats Steps 1~7 until determine the right pair of(
I
D
i
∗
,
P
W
i
∗
).The time complexity of this attack isO
(
D
i
d
∗
D
p
w
∗
4
T
H
) [3, 16]. According to the running time in [16], A may complete the above attacking procedure within 35.2 days on a Laptop. This issue arises due to the inherent “usability-security tension”: to achieve local password change (i.e., C-2 in [3]) and timely typo detection (i.e., C-9 in [3]); there is an explicit password verifier C
i = h
(
A
i
∥
P
I
D
i
)
=
h
(
h
(
P
W
i
∥
b
1
)
∥
h
(
I
D
i
∥
b
2
)
) stored in U
i’s smart card, yet this verifier leads to a Type-I offline password attack.To tackle this security issue while not losing usability, a viable countermeasure is to adopt the “fuzzy-verifier” technique [20] and keep C
i
=
h
(
h
(
P
W
i
∥
b
1
)
∥
h
(
I
D
i
∥
b
2
)
m
o
d
n
) in U
i’s smart card, where n confines the capacity of (
I
D
,
P
W
) pair, 2
4
≤
n
≤
2
8. As a result, even if A obtains D
i
2, she can not identify the correct (
I
D
,
P
W
) from the above attack, because there will be D
i
d
∗
D
p
w
/
n
≈
2
32 candidate (
I
D
,
P
W
) pairs that make D
i
2
∗
=
D
i
2 in Step 4. To further identify the exactly correct (
I
D
,
P
W
) pair, A needs to interact with the server, and we can adopt the “honeywords” technique [3, 56] to confine A’s advantage to a very limited value.Type-II Attack. .In the above attack, A does not need the protocol messages. In this attack, we assume that A can somehow obtain user’s smart card and extract its secret parameters {
C
i
,
E
i
,
b
b
i
,
D
P
,
h
(
·
)
} and can also eavesdrop the login messages {
G
i
,
F
i, Z
i
} from the public channel. Now, A canoffline guess U
i’s password and identity simultaneously as follows:Step 1.
Guesses the value ofI
D
i
∗, P
W
i
∗ from dictionary space D
i
d and D
p
w.Step 2.
Computesb
1
∗
=
D
P
⊕
h
(
I
D
i
∗
∥
P
W
i
∗
), where D
P is extracted from the smart card.Step 3.
ComputesA
i
∗
=
h
(
P
W
i
∗
∥
b
1
∗
);Step 4.
ComputesD
i
∗
=
E
i
⊕
A
i
∗.Step 5.
ComputesN
i
∗
=
F
i
⊕
D
i
∗;Step 6.
ComputesZ
i
∗
=
S
I
D
m
⊕
h
(
D
i
∗
⊕
N
i
∗
);Step 7.
Checks the correctness of(
I
D
i
∗
,
P
W
i
∗
) by comparing if the computed Z
1
∗ equals the intercepted Z
1.Step 8.
Repeats Steps 1~7 of the above procedure until the correct value of(
I
D
i
∗
,
P
W
i
∗
) is found.The time complexity of the above attacking procedure isO
(
D
i
d
∗
D
p
w
∗
3
T
H
), and A may complete the procedure within 26.4 days on a Laptop. In comparison, the Type-I attack is more practical. Amin et al. noted that user’s mobile devices and IoT sensors are generally of “low memory, low power, and battery and network limitations” [21], and thus they prefer to only use lightweight symmetric key techniques to achieve robust security. It is just this motivation that makes their scheme vulnerable to the Type-II offline password guessing attack. And the rationales can be found in [20, 57].


### 4.2.2. No Forward Secrecy

A scheme that supports forward secrecy ensures that even after the long-term private key(s) of one or more participants was(were) leaked, previously agreed session keys remain secure [27]. This is important, especially when considering the serious situations of today’s clouds like the compromise of cloud servers (e.g., [15]).If an attackerM has obtained the cloud server S
m’s long-term key B
S
m from the breached server S
m and intercepted the messages {
J
i; P
c
s
,
R
c
s
,
Q
c
s
,
V
c
s
} that are exchanged between U
i and S
m’s authentication process from the public channel. M is able to figure out the session key using the following method:Step 1.
M computes N
m
=
J
i
⊕
B
S
m;Step 2.
M computes W
m
=
h
(
B
S
m
∥
N
m
);Step 3.
M computes N
i
⊕
N
c
s
=
R
c
s
⊕
W
m;Step 4.
M calculates the session key S
K
m
=
h
(
N
i
⊕
N
c
s
⊕
N
m
).With the session keyS
K
m computed, the entire session will be no secret to M. This vulnerability is due to a result of violating the “forward secrecy principle” given in [20]: public-key technique is necessary to attain forward secrecy and at least two exponential operations (or point multiplications in ECC) are needed at the server side.


### 4.2.3. No User Untraceability

As revealed in [22], in the context of user authentication, there are two types of user anonymity: (
1
) the basic one, i.e., user identity-protection which requires that the attacker is unable to get the target user’s real identity from eavesdropping the protocol messages; (
2
) the advanced one, i.e., user untraceability which guarantees that the attacker is unable to neither figure out the target user’s identity nor determine whether two conversations are come from the same (unknown) user from eavesdropping the protocol messages. Therefore, most schemes (e.g., [4, 35, 39, 58–62]) that aim to preserve user anonymity attempt to fulfil the latter advanced notion of user anonymity. However, in Amin et al.’s scheme [21], the pseudoidentity P
I
D
i is sent in every login request. Thus, the attacker can track all the login activities through this static pesudoidentity P
I
D
i.


## 4.2.1. Offline Password Guessing Attack

We find Amin et al.’s scheme cannot achieve truly two-factor security: it is subject to two types of offline password guessing attack when the smart card factor is compromised.Type-I Attack. .Suppose the secret parameters {
C
i
,
E
i, b
b
i
,
D
P
,
h
(
·
)
} stored in U
i’s smart card are somehow obtained by A. At this point, A can find out U
i’s identity and password as follows:Step 1.
GuessesU
i’s identity I
D
i
∗ and password P
W
i
∗ from dictionary space D
i
d and D
p
w.Step 2.
Computesb
1
∗
=
D
P
⊕
h
(
I
D
i
∗
∥
P
W
i
∗
), where D
P is extracted from the smart card.Step 3.
ComputesA
i
∗
=
h
(
P
W
i
∗
∥
b
1
∗
);Step 4.
Computesb
2
∗
=
b
b
i
⊕
A
i
∗, where b
b
i is extracted from the smart card.Step 5.
ComputesP
I
D
i
∗
=
h
(
I
D
i
∗
∥
b
2
∗
);Step 6.
ComputesC
i
∗
=
h
(
A
i
∗
∥
P
I
D
i
∗
);Step 7.
Checks the validity of(
I
D
i
∗
,
P
W
i
∗
) by comparing the computed C
i
∗ with C
i which is extracted from card.Step 8.
Repeats Steps 1~7 until determine the right pair of(
I
D
i
∗
,
P
W
i
∗
).The time complexity of this attack isO
(
D
i
d
∗
D
p
w
∗
4
T
H
) [3, 16]. According to the running time in [16], A may complete the above attacking procedure within 35.2 days on a Laptop. This issue arises due to the inherent “usability-security tension”: to achieve local password change (i.e., C-2 in [3]) and timely typo detection (i.e., C-9 in [3]); there is an explicit password verifier C
i = h
(
A
i
∥
P
I
D
i
)
=
h
(
h
(
P
W
i
∥
b
1
)
∥
h
(
I
D
i
∥
b
2
)
) stored in U
i’s smart card, yet this verifier leads to a Type-I offline password attack.To tackle this security issue while not losing usability, a viable countermeasure is to adopt the “fuzzy-verifier” technique [20] and keep C
i
=
h
(
h
(
P
W
i
∥
b
1
)
∥
h
(
I
D
i
∥
b
2
)
m
o
d
n
) in U
i’s smart card, where n confines the capacity of (
I
D
,
P
W
) pair, 2
4
≤
n
≤
2
8. As a result, even if A obtains D
i
2, she can not identify the correct (
I
D
,
P
W
) from the above attack, because there will be D
i
d
∗
D
p
w
/
n
≈
2
32 candidate (
I
D
,
P
W
) pairs that make D
i
2
∗
=
D
i
2 in Step 4. To further identify the exactly correct (
I
D
,
P
W
) pair, A needs to interact with the server, and we can adopt the “honeywords” technique [3, 56] to confine A’s advantage to a very limited value.Type-II Attack. .In the above attack, A does not need the protocol messages. In this attack, we assume that A can somehow obtain user’s smart card and extract its secret parameters {
C
i
,
E
i
,
b
b
i
,
D
P
,
h
(
·
)
} and can also eavesdrop the login messages {
G
i
,
F
i, Z
i
} from the public channel. Now, A canoffline guess U
i’s password and identity simultaneously as follows:Step 1.
Guesses the value ofI
D
i
∗, P
W
i
∗ from dictionary space D
i
d and D
p
w.Step 2.
Computesb
1
∗
=
D
P
⊕
h
(
I
D
i
∗
∥
P
W
i
∗
), where D
P is extracted from the smart card.Step 3.
ComputesA
i
∗
=
h
(
P
W
i
∗
∥
b
1
∗
);Step 4.
ComputesD
i
∗
=
E
i
⊕
A
i
∗.Step 5.
ComputesN
i
∗
=
F
i
⊕
D
i
∗;Step 6.
ComputesZ
i
∗
=
S
I
D
m
⊕
h
(
D
i
∗
⊕
N
i
∗
);Step 7.
Checks the correctness of(
I
D
i
∗
,
P
W
i
∗
) by comparing if the computed Z
1
∗ equals the intercepted Z
1.Step 8.
Repeats Steps 1~7 of the above procedure until the correct value of(
I
D
i
∗
,
P
W
i
∗
) is found.The time complexity of the above attacking procedure isO
(
D
i
d
∗
D
p
w
∗
3
T
H
), and A may complete the procedure within 26.4 days on a Laptop. In comparison, the Type-I attack is more practical. Amin et al. noted that user’s mobile devices and IoT sensors are generally of “low memory, low power, and battery and network limitations” [21], and thus they prefer to only use lightweight symmetric key techniques to achieve robust security. It is just this motivation that makes their scheme vulnerable to the Type-II offline password guessing attack. And the rationales can be found in [20, 57].


## 4.2.2. No Forward Secrecy

A scheme that supports forward secrecy ensures that even after the long-term private key(s) of one or more participants was(were) leaked, previously agreed session keys remain secure [27]. This is important, especially when considering the serious situations of today’s clouds like the compromise of cloud servers (e.g., [15]).If an attackerM has obtained the cloud server S
m’s long-term key B
S
m from the breached server S
m and intercepted the messages {
J
i; P
c
s
,
R
c
s
,
Q
c
s
,
V
c
s
} that are exchanged between U
i and S
m’s authentication process from the public channel. M is able to figure out the session key using the following method:Step 1.
M computes N
m
=
J
i
⊕
B
S
m;Step 2.
M computes W
m
=
h
(
B
S
m
∥
N
m
);Step 3.
M computes N
i
⊕
N
c
s
=
R
c
s
⊕
W
m;Step 4.
M calculates the session key S
K
m
=
h
(
N
i
⊕
N
c
s
⊕
N
m
).With the session keyS
K
m computed, the entire session will be no secret to M. This vulnerability is due to a result of violating the “forward secrecy principle” given in [20]: public-key technique is necessary to attain forward secrecy and at least two exponential operations (or point multiplications in ECC) are needed at the server side.


## 4.2.3. No User Untraceability

As revealed in [22], in the context of user authentication, there are two types of user anonymity: (
1
) the basic one, i.e., user identity-protection which requires that the attacker is unable to get the target user’s real identity from eavesdropping the protocol messages; (
2
) the advanced one, i.e., user untraceability which guarantees that the attacker is unable to neither figure out the target user’s identity nor determine whether two conversations are come from the same (unknown) user from eavesdropping the protocol messages. Therefore, most schemes (e.g., [4, 35, 39, 58–62]) that aim to preserve user anonymity attempt to fulfil the latter advanced notion of user anonymity. However, in Amin et al.’s scheme [21], the pseudoidentity P
I
D
i is sent in every login request. Thus, the attacker can track all the login activities through this static pesudoidentity P
I
D
i.


## 5. Revisiting Wei Et Al.’s Scheme

In 2018, Wei et al. [23] observed that most of previous schemes (e.g., [36–40]) only provided some heuristic security arguments and little attention has been to the formal treatment of protocol security. Accordingly, they employed an authenticated encryption scheme to construct a new two-factor scheme that can provide provable security in the random oracle model. Though this scheme is armed with a formal proof, we will show that this scheme still has several serious defects being overlooked: (
1
) it cannot achieve the primary goal of “truly two-factor security”; (
2
) it provides no forward secrecy; (
3
) it ensures no user untraceability.


### 5.1. Review Wei Et Al.’s Scheme

There are three phases in et al.’s scheme: registration, authentication and key exchange, and password update.


#### 5.1.1. Registration Phase

When the userU
i registers, she first prefers an identity I
D
i, password P
W
i, and a random nonces b; then U
i calculates P
W
i
∗
=
h
(
P
W
i
∥
b
) and sends {
I
D
i
,
P
W
i
∗
} to the gateway node G
W via a secure channel. On receiving {
I
D
i
,
P
W
i
∗
}, G
W computes V
i
=
h
(
I
D
i
∥
K
) and N
i
=
V
i
⊕
h
(
I
D
i
∥
P
W
i
∗
). G
W also selects U
i’s pseudoidentity D
I
D
i and keeps the item (
D
I
D
i
,
I
D
i
) in its database. Finally, G
W produces a smart card with security parameters (
D
I
D
i
,
N
i
,
h
(
·
)
) and sends to U
i the card via a trusted channel. Then, U
i adds the random number b into the card.


#### 5.1.2. Authentication and Key Exchange Phase

U
i aims to access the service from the cloud server S
j, U
i executes the authentication and key exchange phase with G
W and S
j as follows.(1)
U
i inserts her card into the card reader, keys her identity I
D
i, and password P
W
i. The card computes P
W
i
∗
=
h
(
P
W
i
∥
b
) and gets V
i
∗
=
N
i
⊕
h
(
I
D
i
∥
P
W
i
∗
). Then, the card calculates a key k
1
=
h
(
V
i
∗
∥
T
1
), where T
1 is the current timestamp in U
i’s system. The card also selects a random nonce R
1
∈
{
0,1
}
l and encrypts R
1 using an authenticated encryption scheme to obtain C
1
=
E
k
1
T
1
,
D
I
D
i
(
R
1
). Finally, the card transmits the message (
D
I
D
i
,
S
j
,
C
1
,
T
1
) to G
W.
(2)
Upon receiving(
D
I
D
i
,
S
j
,
C
1
,
T
1
) at time T
1
∗, G
W verifies whether T
1
∗
-
T
1
≤
Δ
T or not, where Δ
T stands for the largest time interval allowed for the transmission delay. If the check passes, G
W retrieves U
i’s real identity I
D
i in the database using D
I
D
i and calculates k
1
=
h
(
h
(
I
D
i
∥
K
)
∥
T
1
). G
W then decrypts C
1 and recovers R
1
=
D
k
1
T
1
,
D
I
D
i
(
C
1
). If the decryption fails, the connection is rejected; otherwise, U
i is verified by G
W. G
W calculates a key k
2
=
h
(
I
D
∥
h
(
K
∥
S
j
)
∥
T
2
), where T
2 is the current timestamp at G
W. Then, G
W encrypts R
1 using an authenticated encryption scheme to obtain C
2
=
E
k
2
T
2
,
I
D
{
R
1
}. Finally, G
W transmits (
I
D
,
C
2
,
T
2
) to the server S
j.
(3)
On getting(
I
D
,
C
2
,
T
2
) at time T
2
∗, the server S
j verifies if T
2
∗
-
T
2
≤
Δ
T. If it is true, S
j calculates k
2
=
h
(
I
D
∥
x
j
∥
T
2
) and decrypts C
2 and calculates R
1
=
D
k
2
T
2
,
I
D
{
C
2
}. If the decryption fails, the connection is rejected; otherwise, S
j computes k
3
=
h
(
I
D
∥
R
1
∥
T
3
), where T
3 is the current timestamp at S
j. Then, S
j selects a random number R
2
∈
{
0,1
}
l and encrypts R
2 using k
3 to get C
3
=
E
k
3
T
3
,
I
D
{
R
2
}. S
j transmits (
C
3
,
T
3
) to U
i. Finally, S
j calculates the session key s
k
=
h
(
I
D
∥
T
3
∥
R
1
∥
R
2
) and accepts U
i.
(4)
On getting(
C
3
,
T
3
) at time T
3
∗, U
i checks if T
3
∗
-
T
3
≤
Δ
T. If it holds, G
W calculates k
3
=
h
(
I
D
∥
R
1
∥
T
3
) and decrypts R
2
=
D
k
3
T
3
,
I
D
{
C
4
}. If the decryption does not fail, U
i deems the session as valid and computes s
k
=
h
(
I
D
∥
T
3
∥
R
1
∥
R
2
).Finally,U
i and S
j share the common session key s
k.


#### 5.1.3. Password Updating Phase

This phase is executed whenU
i aims to update her password P
W
i with a new one. Because this phase has little relevance with the following cryptanalysis, we omit it.


### 5.2. Cryptanalysis of AminEt Al.’s Scheme

Recall that the three assumptions listed in Section2.2.1 are also clearly made in Wei et al.’s scheme [23]. Though this scheme enjoys many desirable attributes such as rigorous security model and the introduction of an authenticated encryption scheme (i.e., Hoang et al.’s AEZ [63]), we now show its defects.


#### 5.2.1. Offline Password Guessing Attack

We find Aminet al.’s scheme cannot achieve truly two-factor security: it is subject to Type-II offline password guessing attack as illustrated in Section 4.2.1.Type-II Attack. .In this attack, we assume that A can somehow obtain user’s smart card and extract its secret parameters {
D
I
D
i
,
N
i
,
b
,
h
(
·
)
} and also can eavesdrop the login messages {
D
I
D
i
,
S
j
,
C
1
,
T
1
} from the public channel. Now, A canoffline guess U
i’s password and identity simultaneously as follows:Step 1.
Guesses the value ofI
D
i
′, P
W
i
′ from dictionary space D
i
d and D
p
w.Step 2.
ComputesP
W
i
∗
′
=
h
(
P
W
i
′
∥
b
), where b is extracted from the smart card.Step 3.
ComputesV
i
′
=
N
i
⊕
h
(
I
D
i
′
∥
P
W
i
∗
′
), where N
i is extracted from the smart card.Step 4.
Computesk
1
′
=
h
(
V
i
′
∥
T
1
);Step 5.
DecryptsC
1 with k
1
′;Step 6.
If the above decryption succeeds, it indicates thatI
D
i
′ and P
W
i
′ are correct and terminate.Step 7.
Repeats Steps 1~5 of the above procedure until find the correct value of(
I
D
i
,
P
W
i
).The time complexity of the above attacking procedure isO
(
D
i
d
∗
D
p
w
∗
3
T
H
), and A may finish the attack within 26.4 days on a common PC. In comparison, the Type-I attack is more realistic. Wei et al. noted that user’s mobile devices and IoT sensors are generally resource-constrained and made an attempt to design a secure and efficient scheme “without using computation-expensive public key operations” [23]. It is just this motivation that makes their scheme vulnerable to the Type-II offline password guessing attack. And the rationales are referred to [20, 57].


#### 5.2.2. No Forward Secrecy

As with Amin et al.’s scheme [21], Wei et al.’s scheme also only employs symmetric key techniques and thus violates the “forward secrecy principle” proposed in [20], and see more in Section 4.2.2. We now show the details.If an attackerM has obtained the cloud server S
j’s long-term key x
j from the breached server S
j and intercepted the messages {
I
D
,
C
2
,
T
2
,
T
3
,
C
3
} that are exchanged among U
i, G
W, and S
j’s authentication process from the public channel, M is able to figure out the session key using the following method:Step 1.
M computes k
2
=
h
(
I
D
∥
x
j
∥
T
2
);Step 2.
M decrypts C
2 using k
2 to obtain R
1=D
k
2
T
2
,
I
D
{
C
2
};Step 3.
M calculates k
3
=
h
(
I
D
∥
R
1
∥
T
3
);Step 4.
M decrypts C
3 using k
3 to obtain R
2= D
k
3
T
3
,
I
D
{
C
3
};Step 5.
M calculates the session key s
k
=
h
(
I
D
∥
T
3
∥
R
1
∥
R
2
).


#### 5.2.3. No User Un-Traceability

As with Amin et al.’s scheme [21], Wei et al.’s scheme also only employs the pseudo-identity technique to preserve user anonymity, and this breaches the “anonymity principle” proposed in [22]: under the non-tamper resistant assumption of smart cards, public-key primitives are necessary for achieving user un-traceability for two-factor user authentication schemes. In Weiet al.’s scheme [21], the static pseudo-identity D
I
D
i is sent in every login request. Thus, the attacker can track all the login activities through this static pesudo-identity D
I
D
i.


## 5.1. Review Wei Et Al.’s Scheme

There are three phases in et al.’s scheme: registration, authentication and key exchange, and password update.


### 5.1.1. Registration Phase

When the userU
i registers, she first prefers an identity I
D
i, password P
W
i, and a random nonces b; then U
i calculates P
W
i
∗
=
h
(
P
W
i
∥
b
) and sends {
I
D
i
,
P
W
i
∗
} to the gateway node G
W via a secure channel. On receiving {
I
D
i
,
P
W
i
∗
}, G
W computes V
i
=
h
(
I
D
i
∥
K
) and N
i
=
V
i
⊕
h
(
I
D
i
∥
P
W
i
∗
). G
W also selects U
i’s pseudoidentity D
I
D
i and keeps the item (
D
I
D
i
,
I
D
i
) in its database. Finally, G
W produces a smart card with security parameters (
D
I
D
i
,
N
i
,
h
(
·
)
) and sends to U
i the card via a trusted channel. Then, U
i adds the random number b into the card.


### 5.1.2. Authentication and Key Exchange Phase

U
i aims to access the service from the cloud server S
j, U
i executes the authentication and key exchange phase with G
W and S
j as follows.(1)
U
i inserts her card into the card reader, keys her identity I
D
i, and password P
W
i. The card computes P
W
i
∗
=
h
(
P
W
i
∥
b
) and gets V
i
∗
=
N
i
⊕
h
(
I
D
i
∥
P
W
i
∗
). Then, the card calculates a key k
1
=
h
(
V
i
∗
∥
T
1
), where T
1 is the current timestamp in U
i’s system. The card also selects a random nonce R
1
∈
{
0,1
}
l and encrypts R
1 using an authenticated encryption scheme to obtain C
1
=
E
k
1
T
1
,
D
I
D
i
(
R
1
). Finally, the card transmits the message (
D
I
D
i
,
S
j
,
C
1
,
T
1
) to G
W.
(2)
Upon receiving(
D
I
D
i
,
S
j
,
C
1
,
T
1
) at time T
1
∗, G
W verifies whether T
1
∗
-
T
1
≤
Δ
T or not, where Δ
T stands for the largest time interval allowed for the transmission delay. If the check passes, G
W retrieves U
i’s real identity I
D
i in the database using D
I
D
i and calculates k
1
=
h
(
h
(
I
D
i
∥
K
)
∥
T
1
). G
W then decrypts C
1 and recovers R
1
=
D
k
1
T
1
,
D
I
D
i
(
C
1
). If the decryption fails, the connection is rejected; otherwise, U
i is verified by G
W. G
W calculates a key k
2
=
h
(
I
D
∥
h
(
K
∥
S
j
)
∥
T
2
), where T
2 is the current timestamp at G
W. Then, G
W encrypts R
1 using an authenticated encryption scheme to obtain C
2
=
E
k
2
T
2
,
I
D
{
R
1
}. Finally, G
W transmits (
I
D
,
C
2
,
T
2
) to the server S
j.
(3)
On getting(
I
D
,
C
2
,
T
2
) at time T
2
∗, the server S
j verifies if T
2
∗
-
T
2
≤
Δ
T. If it is true, S
j calculates k
2
=
h
(
I
D
∥
x
j
∥
T
2
) and decrypts C
2 and calculates R
1
=
D
k
2
T
2
,
I
D
{
C
2
}. If the decryption fails, the connection is rejected; otherwise, S
j computes k
3
=
h
(
I
D
∥
R
1
∥
T
3
), where T
3 is the current timestamp at S
j. Then, S
j selects a random number R
2
∈
{
0,1
}
l and encrypts R
2 using k
3 to get C
3
=
E
k
3
T
3
,
I
D
{
R
2
}. S
j transmits (
C
3
,
T
3
) to U
i. Finally, S
j calculates the session key s
k
=
h
(
I
D
∥
T
3
∥
R
1
∥
R
2
) and accepts U
i.
(4)
On getting(
C
3
,
T
3
) at time T
3
∗, U
i checks if T
3
∗
-
T
3
≤
Δ
T. If it holds, G
W calculates k
3
=
h
(
I
D
∥
R
1
∥
T
3
) and decrypts R
2
=
D
k
3
T
3
,
I
D
{
C
4
}. If the decryption does not fail, U
i deems the session as valid and computes s
k
=
h
(
I
D
∥
T
3
∥
R
1
∥
R
2
).Finally,U
i and S
j share the common session key s
k.


### 5.1.3. Password Updating Phase

This phase is executed whenU
i aims to update her password P
W
i with a new one. Because this phase has little relevance with the following cryptanalysis, we omit it.


## 5.1.1. Registration Phase

When the userU
i registers, she first prefers an identity I
D
i, password P
W
i, and a random nonces b; then U
i calculates P
W
i
∗
=
h
(
P
W
i
∥
b
) and sends {
I
D
i
,
P
W
i
∗
} to the gateway node G
W via a secure channel. On receiving {
I
D
i
,
P
W
i
∗
}, G
W computes V
i
=
h
(
I
D
i
∥
K
) and N
i
=
V
i
⊕
h
(
I
D
i
∥
P
W
i
∗
). G
W also selects U
i’s pseudoidentity D
I
D
i and keeps the item (
D
I
D
i
,
I
D
i
) in its database. Finally, G
W produces a smart card with security parameters (
D
I
D
i
,
N
i
,
h
(
·
)
) and sends to U
i the card via a trusted channel. Then, U
i adds the random number b into the card.


## 5.1.2. Authentication and Key Exchange Phase

U
i aims to access the service from the cloud server S
j, U
i executes the authentication and key exchange phase with G
W and S
j as follows.(1)
U
i inserts her card into the card reader, keys her identity I
D
i, and password P
W
i. The card computes P
W
i
∗
=
h
(
P
W
i
∥
b
) and gets V
i
∗
=
N
i
⊕
h
(
I
D
i
∥
P
W
i
∗
). Then, the card calculates a key k
1
=
h
(
V
i
∗
∥
T
1
), where T
1 is the current timestamp in U
i’s system. The card also selects a random nonce R
1
∈
{
0,1
}
l and encrypts R
1 using an authenticated encryption scheme to obtain C
1
=
E
k
1
T
1
,
D
I
D
i
(
R
1
). Finally, the card transmits the message (
D
I
D
i
,
S
j
,
C
1
,
T
1
) to G
W.
(2)
Upon receiving(
D
I
D
i
,
S
j
,
C
1
,
T
1
) at time T
1
∗, G
W verifies whether T
1
∗
-
T
1
≤
Δ
T or not, where Δ
T stands for the largest time interval allowed for the transmission delay. If the check passes, G
W retrieves U
i’s real identity I
D
i in the database using D
I
D
i and calculates k
1
=
h
(
h
(
I
D
i
∥
K
)
∥
T
1
). G
W then decrypts C
1 and recovers R
1
=
D
k
1
T
1
,
D
I
D
i
(
C
1
). If the decryption fails, the connection is rejected; otherwise, U
i is verified by G
W. G
W calculates a key k
2
=
h
(
I
D
∥
h
(
K
∥
S
j
)
∥
T
2
), where T
2 is the current timestamp at G
W. Then, G
W encrypts R
1 using an authenticated encryption scheme to obtain C
2
=
E
k
2
T
2
,
I
D
{
R
1
}. Finally, G
W transmits (
I
D
,
C
2
,
T
2
) to the server S
j.
(3)
On getting(
I
D
,
C
2
,
T
2
) at time T
2
∗, the server S
j verifies if T
2
∗
-
T
2
≤
Δ
T. If it is true, S
j calculates k
2
=
h
(
I
D
∥
x
j
∥
T
2
) and decrypts C
2 and calculates R
1
=
D
k
2
T
2
,
I
D
{
C
2
}. If the decryption fails, the connection is rejected; otherwise, S
j computes k
3
=
h
(
I
D
∥
R
1
∥
T
3
), where T
3 is the current timestamp at S
j. Then, S
j selects a random number R
2
∈
{
0,1
}
l and encrypts R
2 using k
3 to get C
3
=
E
k
3
T
3
,
I
D
{
R
2
}. S
j transmits (
C
3
,
T
3
) to U
i. Finally, S
j calculates the session key s
k
=
h
(
I
D
∥
T
3
∥
R
1
∥
R
2
) and accepts U
i.
(4)
On getting(
C
3
,
T
3
) at time T
3
∗, U
i checks if T
3
∗
-
T
3
≤
Δ
T. If it holds, G
W calculates k
3
=
h
(
I
D
∥
R
1
∥
T
3
) and decrypts R
2
=
D
k
3
T
3
,
I
D
{
C
4
}. If the decryption does not fail, U
i deems the session as valid and computes s
k
=
h
(
I
D
∥
T
3
∥
R
1
∥
R
2
).Finally,U
i and S
j share the common session key s
k.


## 5.1.3. Password Updating Phase

This phase is executed whenU
i aims to update her password P
W
i with a new one. Because this phase has little relevance with the following cryptanalysis, we omit it.


## 5.2. Cryptanalysis of AminEt Al.’s Scheme

Recall that the three assumptions listed in Section2.2.1 are also clearly made in Wei et al.’s scheme [23]. Though this scheme enjoys many desirable attributes such as rigorous security model and the introduction of an authenticated encryption scheme (i.e., Hoang et al.’s AEZ [63]), we now show its defects.


### 5.2.1. Offline Password Guessing Attack

We find Aminet al.’s scheme cannot achieve truly two-factor security: it is subject to Type-II offline password guessing attack as illustrated in Section 4.2.1.Type-II Attack. .In this attack, we assume that A can somehow obtain user’s smart card and extract its secret parameters {
D
I
D
i
,
N
i
,
b
,
h
(
·
)
} and also can eavesdrop the login messages {
D
I
D
i
,
S
j
,
C
1
,
T
1
} from the public channel. Now, A canoffline guess U
i’s password and identity simultaneously as follows:Step 1.
Guesses the value ofI
D
i
′, P
W
i
′ from dictionary space D
i
d and D
p
w.Step 2.
ComputesP
W
i
∗
′
=
h
(
P
W
i
′
∥
b
), where b is extracted from the smart card.Step 3.
ComputesV
i
′
=
N
i
⊕
h
(
I
D
i
′
∥
P
W
i
∗
′
), where N
i is extracted from the smart card.Step 4.
Computesk
1
′
=
h
(
V
i
′
∥
T
1
);Step 5.
DecryptsC
1 with k
1
′;Step 6.
If the above decryption succeeds, it indicates thatI
D
i
′ and P
W
i
′ are correct and terminate.Step 7.
Repeats Steps 1~5 of the above procedure until find the correct value of(
I
D
i
,
P
W
i
).The time complexity of the above attacking procedure isO
(
D
i
d
∗
D
p
w
∗
3
T
H
), and A may finish the attack within 26.4 days on a common PC. In comparison, the Type-I attack is more realistic. Wei et al. noted that user’s mobile devices and IoT sensors are generally resource-constrained and made an attempt to design a secure and efficient scheme “without using computation-expensive public key operations” [23]. It is just this motivation that makes their scheme vulnerable to the Type-II offline password guessing attack. And the rationales are referred to [20, 57].


### 5.2.2. No Forward Secrecy

As with Amin et al.’s scheme [21], Wei et al.’s scheme also only employs symmetric key techniques and thus violates the “forward secrecy principle” proposed in [20], and see more in Section 4.2.2. We now show the details.If an attackerM has obtained the cloud server S
j’s long-term key x
j from the breached server S
j and intercepted the messages {
I
D
,
C
2
,
T
2
,
T
3
,
C
3
} that are exchanged among U
i, G
W, and S
j’s authentication process from the public channel, M is able to figure out the session key using the following method:Step 1.
M computes k
2
=
h
(
I
D
∥
x
j
∥
T
2
);Step 2.
M decrypts C
2 using k
2 to obtain R
1=D
k
2
T
2
,
I
D
{
C
2
};Step 3.
M calculates k
3
=
h
(
I
D
∥
R
1
∥
T
3
);Step 4.
M decrypts C
3 using k
3 to obtain R
2= D
k
3
T
3
,
I
D
{
C
3
};Step 5.
M calculates the session key s
k
=
h
(
I
D
∥
T
3
∥
R
1
∥
R
2
).


### 5.2.3. No User Un-Traceability

As with Amin et al.’s scheme [21], Wei et al.’s scheme also only employs the pseudo-identity technique to preserve user anonymity, and this breaches the “anonymity principle” proposed in [22]: under the non-tamper resistant assumption of smart cards, public-key primitives are necessary for achieving user un-traceability for two-factor user authentication schemes. In Weiet al.’s scheme [21], the static pseudo-identity D
I
D
i is sent in every login request. Thus, the attacker can track all the login activities through this static pesudo-identity D
I
D
i.


## 5.2.1. Offline Password Guessing Attack

We find Aminet al.’s scheme cannot achieve truly two-factor security: it is subject to Type-II offline password guessing attack as illustrated in Section 4.2.1.Type-II Attack. .In this attack, we assume that A can somehow obtain user’s smart card and extract its secret parameters {
D
I
D
i
,
N
i
,
b
,
h
(
·
)
} and also can eavesdrop the login messages {
D
I
D
i
,
S
j
,
C
1
,
T
1
} from the public channel. Now, A canoffline guess U
i’s password and identity simultaneously as follows:Step 1.
Guesses the value ofI
D
i
′, P
W
i
′ from dictionary space D
i
d and D
p
w.Step 2.
ComputesP
W
i
∗
′
=
h
(
P
W
i
′
∥
b
), where b is extracted from the smart card.Step 3.
ComputesV
i
′
=
N
i
⊕
h
(
I
D
i
′
∥
P
W
i
∗
′
), where N
i is extracted from the smart card.Step 4.
Computesk
1
′
=
h
(
V
i
′
∥
T
1
);Step 5.
DecryptsC
1 with k
1
′;Step 6.
If the above decryption succeeds, it indicates thatI
D
i
′ and P
W
i
′ are correct and terminate.Step 7.
Repeats Steps 1~5 of the above procedure until find the correct value of(
I
D
i
,
P
W
i
).The time complexity of the above attacking procedure isO
(
D
i
d
∗
D
p
w
∗
3
T
H
), and A may finish the attack within 26.4 days on a common PC. In comparison, the Type-I attack is more realistic. Wei et al. noted that user’s mobile devices and IoT sensors are generally resource-constrained and made an attempt to design a secure and efficient scheme “without using computation-expensive public key operations” [23]. It is just this motivation that makes their scheme vulnerable to the Type-II offline password guessing attack. And the rationales are referred to [20, 57].


## 5.2.2. No Forward Secrecy

As with Amin et al.’s scheme [21], Wei et al.’s scheme also only employs symmetric key techniques and thus violates the “forward secrecy principle” proposed in [20], and see more in Section 4.2.2. We now show the details.If an attackerM has obtained the cloud server S
j’s long-term key x
j from the breached server S
j and intercepted the messages {
I
D
,
C
2
,
T
2
,
T
3
,
C
3
} that are exchanged among U
i, G
W, and S
j’s authentication process from the public channel, M is able to figure out the session key using the following method:Step 1.
M computes k
2
=
h
(
I
D
∥
x
j
∥
T
2
);Step 2.
M decrypts C
2 using k
2 to obtain R
1=D
k
2
T
2
,
I
D
{
C
2
};Step 3.
M calculates k
3
=
h
(
I
D
∥
R
1
∥
T
3
);Step 4.
M decrypts C
3 using k
3 to obtain R
2= D
k
3
T
3
,
I
D
{
C
3
};Step 5.
M calculates the session key s
k
=
h
(
I
D
∥
T
3
∥
R
1
∥
R
2
).


## 5.2.3. No User Un-Traceability

As with Amin et al.’s scheme [21], Wei et al.’s scheme also only employs the pseudo-identity technique to preserve user anonymity, and this breaches the “anonymity principle” proposed in [22]: under the non-tamper resistant assumption of smart cards, public-key primitives are necessary for achieving user un-traceability for two-factor user authentication schemes. In Weiet al.’s scheme [21], the static pseudo-identity D
I
D
i is sent in every login request. Thus, the attacker can track all the login activities through this static pesudo-identity D
I
D
i.


## 6. Conclusion

A large amount of efforts have been devoted to the design of smart-card-based password authentication scheme, yet it still remains an open challenge to devise an efficient, secure, and privacy-preserving scheme under the assumption that smart cards can be tampered. Very recently, Wu-Xu, Roy et al., Amin et al., and Wei et al. made four other attempts. However, through careful analysis we show that all of them still have several serious drawbacks being overlooked (see Table2), and most these drawbacks are due to violation of basic protocols design principles (e.g., [3, 20]). Taking our attacks in mind, we are considering designing an efficient two-factor scheme with provable security.Table 2
Summary of our cryptanalysis results and the underlying vulnerabilities.
Scheme
Weaknesses
Vulnerabilities
Wu-Xu [17]
Offline password guessing attack
When using Elgamal-like encryption (e.g., chaotic-based), at least two exponentiations are needed at the user side [18]
Replay attack
Their scheme employs random numbers but has only two protocol flows
Roy et al. [19]
Offline password guessing attack
No public-key technique used [20]
No forward secrecy
No public-key technique used [20]
Poor scalability
Poor design
Amin et al. [21]
Offline password guessing attack
No public-key technique used [20]
No forward secrecy
No public-key technique used [20]
No user un-traceability
No public-key technique used [22]
Wei et al. [23]
Offline password guessing attack
No public-key technique used [20]
No forward secrecy
No public-key technique used [20]
No user un-traceability
No public-key technique used [22]



---

*Source: 2516963-2019-05-23.xml*