# Two-Factor User Authentication with Key Agreement Scheme Based on Elliptic Curve Cryptosystem

Authors: Juan Qu; Xiao-Ling Tan
Journal: Journal of Electrical and Computer Engineering
 (2014)

---

## Abstract

A password authentication scheme using smart card is called two-factor authentication scheme. Two-factor authentication scheme is the most accepted and commonly used mechanism that provides the authorized users a secure and efficient method for accessing resources over insecure communication channel. Up to now, various two-factor user authentication schemes have been proposed. However, most of them are vulnerable to smart card loss attack, offline password guessing attack, impersonation attack, and so on. In this paper, we design a password remote user authentication with key agreement scheme using elliptic curve cryptosystem. Security analysis shows that the proposed scheme has high level of security. Moreover, the proposed scheme is more practical and secure in contrast to some related schemes.


---

## Body

## 1. Introduction

Due to the rapid growth of Internet technology, more and more people use the network to acquire desired services and exchange data. Remote user authentication is one of the most important mechanisms to identify the legal user over insecure communication network. Since Lamport [1] proposed the first password-based remote user authentication scheme, many password-based single-factor authentication schemes [2–7] have been proposed in the literatures. However, most of password-based single-factor authentication schemes have various security pitfalls. In order to provide better security of the system, Hwang and Li [8] developed a two-factor authentication scheme in 2000. Two-factor authentication scheme is that the authentication schemes are based on the user’s password and smart card. In the two-factor authentication scheme, when the user wants to access resources on a server, he/she inserts the smart card into a card reader and inputs his/her password. Then the smart card using the user’s password generates a login request message and sends the request to the server. When receiving the login request, the server verifies the validity of the request message. In 2009, Xu et al. [9] proposed a smart-card-based password authentication scheme. They claimed that their scheme could resist stolen smart card attack. But, in 2010, Sood et al. [10] and Song [11] pointed out that Xu et al.’s scheme was vulnerable to impersonation attack and internal attack. And they proposed the improved scheme, respectively. In 2012, Chen et al. [12] analyzed Xu et al.’s scheme and pointed out that any user can impersonate other users and fool the service providing server. Meanwhile, Chen et al. [12] pointed out the security flaws of Sood et al. [10] and Song’s [11] scheme. According to Chen et al. [12], Sood et al.’s scheme [10] does not guarantee mutual authentication during authentication phase, and Song’s scheme is susceptible to an internal offline guessing attack. Then, an improved scheme is presented in Chen et al.’s scheme paper. Unfortunately, in 2013, Kumari and Khan [13] pointed out that Chen et al.’s scheme cannot withstand user impersonation attack, server spoofing attack, and offline password guessing attack. Besides, Chen et al.’s scheme does not provide important features such as user anonymity, confidentiality to air messages, and revocation of lost/stolen smart card. Also in 2013, Jiang et al. [14] still pointed out that Chen et al. was insecure against offline dictionary attacks and proposed an improved authentication protocol without using smart card.In 2009, Yang and Chang [15] proposed an ID-based remote mutual authentication with key agreement scheme on ECC. In their scheme, the server and the user accomplish mutual authentication through the user’s unique identity. And they claimed that the computation costs and the number of communication costs of their scheme are less than some related schemes. Nevertheless, Islam and Biswas [16] stated that Yang and Chang’s scheme [15] is vulnerable to replay attack, known session-specific temporary information attack. Besides, Yang and Chang’s scheme [15] does not provide user’s anonymity and session key forward secrecy. Islam and Biswas further found that Yang and Chang’s scheme does not define how to revoke the authentication key with same identity. Later, Truong et al. [17] pointed out that Islam and Biswas’s [16] scheme still cannot resist known session-specific temporary information attack. In this paper, we present a two-factor user authentication with key agreement scheme using elliptic curve cryptosystem based on Yang and Islam’s scheme. Security analysis shows that our proposed scheme can resist various attacks.The rest of the paper is organized as follows. Section2 introduces some preliminaries. In Section 3, the proposed two-factor authentication with key agreement scheme is described; the corresponding security analysis is given in Section 4. Finally, we conclude this paper in Section 5.


## 2. Preliminaries

In this section, we will introduce the basic concepts of elliptic curve cryptosystem (ECC). In all elliptic curve cryptosystem, the elliptic curve equation is defined as the form ofE
p
(
a
,
b
): y
2
=
x
3
+
a
x
+
b
(
m
_
od
p
). Given an integer s
∈
F
p
* and a point P
∈
E
p
(
a
,
b
), the point multiplication s
P over E
p
(
a
,
b
) can be defined as s
·
P
=
P
+
P
+
P
+
⋯
+
P (s times). Generally, the security of ECC relies on the difficulties of the following problems.Definition
1. Given two points P and Q over E
p
(
a
,
b
), the elliptic curve discrete logarithm problem (ECDLP) is to find an integer s
∈
F
p
* such that Q
=
s
·
P.Definition
2. Given three points P, s
·
P, and t
·
P over E
p
(
a
,
b
) for s, t
∈
F
p
*, the computational Diffie-Hellman problem (CDLP) is to find the point (
s
t
)
P over E
p
(
a
,
b
).Definition
3. Given two points P and Q
=
s
·
P
+
t
·
P over F
p
* for s, t
∈
F
p
*, the elliptic curve factorization problem (ECFP) is to find two points s
·
P and t
·
P over E
p
(
a
,
b
).


## 3. The Proposed Scheme

In this section, we will propose a two-factor user authentication with key agreement scheme based on elliptic curve cryptosystem. The notations used in proposed scheme are listed in notations. And the detailed information is described as follows and shown in Figure1. Our scheme includes five phases: system initializing phase, the registration phase, login phase, authentication phase, and password change phase. The details of these phases are as follows.Figure 1
The proposed scheme.


### 3.1. System Initializing Phase

Step 1.
The serverS chooses an elliptic curve equation E
p
(
a
,
b
) and a base point P with the order n over E
p
(
a
,
b
).Step 2.
The serverS selects the private key q
s
∈
[
1
,
n
-
1
] and computes the corresponding public key Q
s
=
q
s
·
P.Step 3.
The serverS chooses three one-way hash functions: H
1
:
{
0,1
}
*
→
G
p, H
2
:
G
p
×
G
p
→
Z
p
*, H
3
:
{
0,1
}
*
×
G
p
×
G
p
→
{
0,1
}
k.Step 4.
The serverS publishes {
E
p
(
a
,
b
)
,
P
,
Q
s
,
H
1
,
H
2
,
H
3
}.


### 3.2. Registration Phase

If the userU wants to become a legal user of the system, he has to submit the related information to the server S. The detail of the registration phase is described in the following steps.Step 1.
The userU generates his own identity ID
u and PW
u and a random number b
u
∈
[
1
,
n
-
1
]; then the user U submits ID
u and H
1
(
PW
u
∥
b
u
)
·
P to the server S over a secure communication channel.Step 2.
The serverS computes AID
u
=
(
q
s
+
1
)
·
H
1
(
PW
u
∥
b
u
)
·
P and BID
u
=
H
2
(
H
1
(
ID
u
)
∥
H
1
(
PW
u
∥
b
u
)
·
P
).Step 3.
The serverS stores {
AID
u
,
BID
u
} into a smart card and issues the smart card to the user U via a secure channel.Step 4.
On receiving the smart card, the userU enters the random b
u into the smart card, and the smart card contains {
AID
u
,
BID
u
,
b
u
}.


### 3.3. Login Phase

When the userU wants to login to the server S, he/she inserts his smart card into the card reader of a terminal and inputs ID
u and PW
u. Then, the smart card performs the following steps for login.Step 1.
The user computesBID
u
′
=
H
2
(
H
1
(
ID
u
)
∥
(
H
1
(
PW
u
∥
b
u
)
·
P
)
) and checks if BID
u
′
=
BID
u. If it holds, it means that the user U inputs the correct identity and password. Otherwise, the smart card terminates the session.Step 2.
The user selects a randomr
u
∈
[
1
,
n
-
1
] and computes TID
u
=
AID
u
-
H
1
(
PW
u
∥
b
u
)
·
P, M
=
r
u
·
Q
s, CID
u
=
ID
u
⊕
H
2
(
M
∥
TID
u
), DID
u
=
M
+
H
1
(
PW
u
∥
b
u
)
·
P, and EID
u
=
H
3
(
ID
u
∥
M
∥
R
), where R
=
r
u
·
P.Step 3.
The user submits the login request messageM
1
=
{
CID
u
,
DID
u
,
EID
u
,
R
} to the server S.


### 3.4. Authentication and Key Agreement Phase

Upon receiving the login messageM
1
=
{
CID
u
,
DID
u
,
EID
u
,
R
} from the user U, the server S performs the following steps to mutual authentication.Step 1.
The serverS computes M
′
=
q
s
·
R, H
1
(
PW
u
∥
b
u
)
·
P
=
DID
u
-
M
′, TID
u
′
=
q
s
·
H
1
(
PW
u
∥
b
u
)
·
P, and ID
u
=
CID
u
⊕
H
2
(
M
′
∥
TID
u
′
) and then checks whether H
3
(
ID
u
∥
M
′
∥
R
)
=
?
EID
u. If they are equal, the validity of the user U is authenticated by the server S. Otherwise, the session is terminated by the server S.Step 2.
The serverS chooses a random number r
s
∈
[
1
,
n
-
1
] and computes S
=
r
s
·
P,  T
=
S
+
M
′, and H
s
=
H
2
(
S
∥
TID
u
′
).Step 3.
The serverS sends the authentication message M
2
=
{
T
,
H
s
} to the user U.Step 4.
After receivingM
2
=
{
T
,
H
s
}, the user U computes S
=
T
-
M,  H
s
′
=
H
2
(
S
∥
H
1
(
PW
u
∥
b
u
)
·
Q
s
) and checks if H
s
′
=
?
H
s holds. If the equation holds, the server S is authenticated by the user U. And the user U sends the message M
3
=
{
H
R
S
}, where H
R
S
=
H
2
(
R
∥
S
).Step 5.
On receiving the message{
H
R
S
}, the server S computes H
R
S
′
=
H
2
(
R
∥
S
) and compares it with received H
R
S. If it holds, the server and the user achieve mutual authentication. Otherwise, the smart card terminates the session.Step 6.
At last, the userU and the server S can compute the session key s
k
=
H
3
(
ID
u
∥
TID
u
∥
r
u
·
S
) and s
k
=
H
3
(
ID
u
∥
TID
u
′
∥
r
s
·
R
).


### 3.5. Password Change Phase

When the userU wants to change his/her password PW
u to a new one PW
u
new, the user U can update his/her password by performing the following steps without the help of the server S.Step 1.
The userU inserts his smart card into a card reader and inputs ID
u and PW
u. The smart card computes BID
u
′
=
H
2
(
H
1
(
ID
u
)
∥
(
H
1
(
PW
u
∥
b
u
)
·
P
)
) and checks if the BID
u
′ is the same as BID
u. If both values are the same, the user inputs a new password PW
u
new.Step 2.
The smart card computesAID
u
new
=
H
1
(
PW
u
∥
b
u
)
-
1
·
AID
u
·
H
1
(
PW
u
new
∥
b
u
), BID
u
new
=
H
2
(
H
1
(
ID
u
)
∥
H
1
(
PW
u
new
∥
b
u
)
·
P
).Step 3.
At last, the smart card replacesAID
U and BID
U with AID
U
new and BID
U
new, respectively.


## 3.1. System Initializing Phase

Step 1.
The serverS chooses an elliptic curve equation E
p
(
a
,
b
) and a base point P with the order n over E
p
(
a
,
b
).Step 2.
The serverS selects the private key q
s
∈
[
1
,
n
-
1
] and computes the corresponding public key Q
s
=
q
s
·
P.Step 3.
The serverS chooses three one-way hash functions: H
1
:
{
0,1
}
*
→
G
p, H
2
:
G
p
×
G
p
→
Z
p
*, H
3
:
{
0,1
}
*
×
G
p
×
G
p
→
{
0,1
}
k.Step 4.
The serverS publishes {
E
p
(
a
,
b
)
,
P
,
Q
s
,
H
1
,
H
2
,
H
3
}.


## 3.2. Registration Phase

If the userU wants to become a legal user of the system, he has to submit the related information to the server S. The detail of the registration phase is described in the following steps.Step 1.
The userU generates his own identity ID
u and PW
u and a random number b
u
∈
[
1
,
n
-
1
]; then the user U submits ID
u and H
1
(
PW
u
∥
b
u
)
·
P to the server S over a secure communication channel.Step 2.
The serverS computes AID
u
=
(
q
s
+
1
)
·
H
1
(
PW
u
∥
b
u
)
·
P and BID
u
=
H
2
(
H
1
(
ID
u
)
∥
H
1
(
PW
u
∥
b
u
)
·
P
).Step 3.
The serverS stores {
AID
u
,
BID
u
} into a smart card and issues the smart card to the user U via a secure channel.Step 4.
On receiving the smart card, the userU enters the random b
u into the smart card, and the smart card contains {
AID
u
,
BID
u
,
b
u
}.


## 3.3. Login Phase

When the userU wants to login to the server S, he/she inserts his smart card into the card reader of a terminal and inputs ID
u and PW
u. Then, the smart card performs the following steps for login.Step 1.
The user computesBID
u
′
=
H
2
(
H
1
(
ID
u
)
∥
(
H
1
(
PW
u
∥
b
u
)
·
P
)
) and checks if BID
u
′
=
BID
u. If it holds, it means that the user U inputs the correct identity and password. Otherwise, the smart card terminates the session.Step 2.
The user selects a randomr
u
∈
[
1
,
n
-
1
] and computes TID
u
=
AID
u
-
H
1
(
PW
u
∥
b
u
)
·
P, M
=
r
u
·
Q
s, CID
u
=
ID
u
⊕
H
2
(
M
∥
TID
u
), DID
u
=
M
+
H
1
(
PW
u
∥
b
u
)
·
P, and EID
u
=
H
3
(
ID
u
∥
M
∥
R
), where R
=
r
u
·
P.Step 3.
The user submits the login request messageM
1
=
{
CID
u
,
DID
u
,
EID
u
,
R
} to the server S.


## 3.4. Authentication and Key Agreement Phase

Upon receiving the login messageM
1
=
{
CID
u
,
DID
u
,
EID
u
,
R
} from the user U, the server S performs the following steps to mutual authentication.Step 1.
The serverS computes M
′
=
q
s
·
R, H
1
(
PW
u
∥
b
u
)
·
P
=
DID
u
-
M
′, TID
u
′
=
q
s
·
H
1
(
PW
u
∥
b
u
)
·
P, and ID
u
=
CID
u
⊕
H
2
(
M
′
∥
TID
u
′
) and then checks whether H
3
(
ID
u
∥
M
′
∥
R
)
=
?
EID
u. If they are equal, the validity of the user U is authenticated by the server S. Otherwise, the session is terminated by the server S.Step 2.
The serverS chooses a random number r
s
∈
[
1
,
n
-
1
] and computes S
=
r
s
·
P,  T
=
S
+
M
′, and H
s
=
H
2
(
S
∥
TID
u
′
).Step 3.
The serverS sends the authentication message M
2
=
{
T
,
H
s
} to the user U.Step 4.
After receivingM
2
=
{
T
,
H
s
}, the user U computes S
=
T
-
M,  H
s
′
=
H
2
(
S
∥
H
1
(
PW
u
∥
b
u
)
·
Q
s
) and checks if H
s
′
=
?
H
s holds. If the equation holds, the server S is authenticated by the user U. And the user U sends the message M
3
=
{
H
R
S
}, where H
R
S
=
H
2
(
R
∥
S
).Step 5.
On receiving the message{
H
R
S
}, the server S computes H
R
S
′
=
H
2
(
R
∥
S
) and compares it with received H
R
S. If it holds, the server and the user achieve mutual authentication. Otherwise, the smart card terminates the session.Step 6.
At last, the userU and the server S can compute the session key s
k
=
H
3
(
ID
u
∥
TID
u
∥
r
u
·
S
) and s
k
=
H
3
(
ID
u
∥
TID
u
′
∥
r
s
·
R
).


## 3.5. Password Change Phase

When the userU wants to change his/her password PW
u to a new one PW
u
new, the user U can update his/her password by performing the following steps without the help of the server S.Step 1.
The userU inserts his smart card into a card reader and inputs ID
u and PW
u. The smart card computes BID
u
′
=
H
2
(
H
1
(
ID
u
)
∥
(
H
1
(
PW
u
∥
b
u
)
·
P
)
) and checks if the BID
u
′ is the same as BID
u. If both values are the same, the user inputs a new password PW
u
new.Step 2.
The smart card computesAID
u
new
=
H
1
(
PW
u
∥
b
u
)
-
1
·
AID
u
·
H
1
(
PW
u
new
∥
b
u
), BID
u
new
=
H
2
(
H
1
(
ID
u
)
∥
H
1
(
PW
u
new
∥
b
u
)
·
P
).Step 3.
At last, the smart card replacesAID
U and BID
U with AID
U
new and BID
U
new, respectively.


## 4. Security Analysis of Our Scheme

At first, we discuss the security features of the proposed authentication with key agreement scheme in this section. Then we evaluate the performance of the proposed scheme and make comparisons with some related works.


### 4.1. Mutual Authentication with Session Key Agreement

In the proposed scheme, the user sends the login request messageM
1
=
{
CID
u
,
DID
u
,
EID
u
,
R
} to S; after receiving the message M
1, the server authenticates the user by checking if the equation H
3
(
ID
u
∥
M
′
∥
R
)
=
EID
u holds or not. If the computed value H
3
(
ID
u
∥
M
′
∥
R
) equals the received value EID
u, the server confirms that the user is valid. Then the server replies the message M
2
=
{
T
,
H
s
} to the user. When the user receives the message, he/she authenticates the server by comparing the computed value H
s
′
=
H
2
(
S
∥
TID
u
) with the received value H
s. If it is equal, the user confirms that the server is legitimate. At last, the server S authenticates the user U after checking if the equation H
2
(
R
∥
S
)
=
H
R
S holds or not. Only when all previous equations are satisfied, the session continues and the communication parties share a session key s
k
=
H
3
(
ID
u
∥
TID
u
∥
r
u
·
S
)
=
H
3
(
ID
u
∥
TID
u
∥
r
s
·
R
). During the aforementioned discussion, the proposed scheme can achieve mutual authentication with session key agreement.


### 4.2. Forward Secrecy

Forward secrecy means that if the long-term private keys related to participating entities (e.g., the server’s secret keyq
s and user’s password PW
u) are compromised, the secrecy of the previous session keys should not be affected. In the proposed scheme, the session key s
k
=
H
3
(
ID
u
∥
TID
u
∥
r
u
·
S
)
=
H
3
(
ID
u
∥
TID
u
′
∥
r
s
·
R
), where r
u
·
S
=
r
s
·
R
=
r
u
·
r
s
·
P, relies on the random values r
u and r
s. r
u and r
s are independently generated in each session and they have no relation with the server’s secret key q
s and user’s password PW
u. So, the attacker cannot compute any previous s
k without the random value r
u chosen by the user U and the random value r
s chosen by the server S. On the other hand, even if the attacker knows R
=
r
u
·
P and S
=
r
s
·
P from the public channel, he/she still cannot get the session key s
k because he/she will face solving the computational Diffie-Hellman problem. Thus, the proposed scheme provides forward secrecy.


### 4.3. User Anonymity

In the proposed scheme, user’s identity is not stored in smart card and is also not transmitted via plain text form. In fact, user’s identity is submitted withCID
u
=
ID
u
⊕
H
2
(
M
∥
TID
u
), which is changed for each login phase. Even if the attacker eavesdrops the login request message M
1
=
{
CID
u
,
DID
u
,
EID
u
,
R
} and the authentication messages M
2
=
{
T
,
H
s
} and M
3
=
{
H
R
S
}, the attacker has no way to know the user’s identity ID
u. This is because the attacker cannot procedure ID
u out of CID
u
=
ID
u
⊕
H
2
(
M
∥
TID
u
) without knowing the server’s secret key q
s and user’s password PW
u. Thus, the proposed scheme provides the user anonymity.


### 4.4. Resisting Server Spoofing Attack

In the proposed scheme, if the attacker wants to masquerade as the remote serverS to cheat the user U, he/she has to generate a valid message M
2
=
{
T
,
H
s
}, where T
=
S
+
M
′, H
s
=
H
2
(
S
∥
TID
u
′
). That is to say, the attacker must get the values M
′ and TID
u
′ to compute a valid message {
T
,
H
s
}. However, the attacker cannot compute the values M
′
=
q
s
·
R and TID
u
′
=
q
s
·
H
1
(
PW
u
∥
b
u
)
·
P without knowing the private key of the server S and user’s password PW
u. Therefore, our scheme is secure against the server spoofing attack.


### 4.5. Resisting Insider Attack

Insider attack means that the userU may register to more than one server with the same identity and password; then a privileged insider of the server can impersonate the user and access the other servers by making a valid login quest. In the registration of the proposed scheme, the user U freely chooses his/her identity ID
u and password PW
u and submits ID
u and H
1
(
PW
u
∥
b
u
)
·
P to the server S. The server S cannot obtain the password PW
u from H
1
(
PW
u
∥
b
u
)
·
P since he/she will face CDL (computational discrete logarithm) problem. Therefore, the proposed scheme can resist insider attack.


### 4.6. Resisting Smart Card Loss Attack

Assume that the userU’s smart card is lost or stolen, and the attacker can extract the information {
AID
u
,
BID
u
,
b
u
} stored in the smart card, where AID
u
=
(
q
s
+
1
)
·
H
1
(
PW
u
∥
b
u
)
·
P, BID
u
=
H
2
(
H
1
(
ID
u
)
∥
(
H
1
(
PW
u
∥
b
u
)
·
P
)
). On the one hand, the attacker cannot guess user’s password PW
u from AID
u and BID
u since it is protected by one-way hash function. On the other hand, the attacker cannot fabricate a valid login request message or compute the session key using the stolen smart card. Besides, it is impossible for the attacker to update the user’s password. This is because the attacker must have the real identity ID
u and PW
u to pass the verification BID
u
′
=
?
BID
u. Therefore, the proposed scheme is secure against the stolen smart card attack.


### 4.7. Resisting Impersonation Attack

If the attacker wants to impersonate as a legitimate userU to pass the authentication of the server S, he/she has to forge a valid login request message M
1
=
{
CID
u
,
DID
u
,
EID
u
,
R
}. Assume that the attacker possesses the user’s smart card and intercepts the user’s previous login request message, the attacker attempts to impersonate the user U and sends the login message login message (
CID
u
′
,
DID
u
′
,
EID
u
′
,
R
′
). However, this impersonation attempt will fail in step 1 of the authentication phase, since he/she has no way to obtain the values of ID
u, q
s, and TID
u. Therefore, the proposed scheme is secure against impersonate attack.


### 4.8. No Key Control

In proposed scheme, the session key consists ofID
u, TID
u, and r
u
·
r
s
·
P, where r
u and r
s are, respectively, provided by the user and the server. Therefore, the fairness of the session key is guaranteed and either party is in vain attempting to preselect or control the session key.


### 4.9. Resisting Replay Attack

Replay attack means that the attacker may impersonate the legitimate user by reusing the information obtained from the previous run protocols. In the proposed scheme,r
u and r
s are the random numbers that are selected by the user U and the server S, respectively. And they are different for each session. So, the messages exposed in public channel are different in each session. Thus, the proposed scheme can prevent replay attack.


### 4.10. Known Session-Specific Temporary Information Attack

Known session-specific temporary information attack means that if the session ephemeral secrets are exposed to an adversary accidentally, this exposure should not compromise the generated session key. In the proposed scheme, if the session ephemeral secretsr
u and r
s are leaked, the adversary cannot obtain the session key s
k
=
H
3
(
ID
u
∥
TID
u
∥
r
u
·
r
s
·
P
). This is because the adversary has no way to know ID
u and TID
u. Hence, the proposed scheme can resist known session-specific temporary information attack.


## 4.1. Mutual Authentication with Session Key Agreement

In the proposed scheme, the user sends the login request messageM
1
=
{
CID
u
,
DID
u
,
EID
u
,
R
} to S; after receiving the message M
1, the server authenticates the user by checking if the equation H
3
(
ID
u
∥
M
′
∥
R
)
=
EID
u holds or not. If the computed value H
3
(
ID
u
∥
M
′
∥
R
) equals the received value EID
u, the server confirms that the user is valid. Then the server replies the message M
2
=
{
T
,
H
s
} to the user. When the user receives the message, he/she authenticates the server by comparing the computed value H
s
′
=
H
2
(
S
∥
TID
u
) with the received value H
s. If it is equal, the user confirms that the server is legitimate. At last, the server S authenticates the user U after checking if the equation H
2
(
R
∥
S
)
=
H
R
S holds or not. Only when all previous equations are satisfied, the session continues and the communication parties share a session key s
k
=
H
3
(
ID
u
∥
TID
u
∥
r
u
·
S
)
=
H
3
(
ID
u
∥
TID
u
∥
r
s
·
R
). During the aforementioned discussion, the proposed scheme can achieve mutual authentication with session key agreement.


## 4.2. Forward Secrecy

Forward secrecy means that if the long-term private keys related to participating entities (e.g., the server’s secret keyq
s and user’s password PW
u) are compromised, the secrecy of the previous session keys should not be affected. In the proposed scheme, the session key s
k
=
H
3
(
ID
u
∥
TID
u
∥
r
u
·
S
)
=
H
3
(
ID
u
∥
TID
u
′
∥
r
s
·
R
), where r
u
·
S
=
r
s
·
R
=
r
u
·
r
s
·
P, relies on the random values r
u and r
s. r
u and r
s are independently generated in each session and they have no relation with the server’s secret key q
s and user’s password PW
u. So, the attacker cannot compute any previous s
k without the random value r
u chosen by the user U and the random value r
s chosen by the server S. On the other hand, even if the attacker knows R
=
r
u
·
P and S
=
r
s
·
P from the public channel, he/she still cannot get the session key s
k because he/she will face solving the computational Diffie-Hellman problem. Thus, the proposed scheme provides forward secrecy.


## 4.3. User Anonymity

In the proposed scheme, user’s identity is not stored in smart card and is also not transmitted via plain text form. In fact, user’s identity is submitted withCID
u
=
ID
u
⊕
H
2
(
M
∥
TID
u
), which is changed for each login phase. Even if the attacker eavesdrops the login request message M
1
=
{
CID
u
,
DID
u
,
EID
u
,
R
} and the authentication messages M
2
=
{
T
,
H
s
} and M
3
=
{
H
R
S
}, the attacker has no way to know the user’s identity ID
u. This is because the attacker cannot procedure ID
u out of CID
u
=
ID
u
⊕
H
2
(
M
∥
TID
u
) without knowing the server’s secret key q
s and user’s password PW
u. Thus, the proposed scheme provides the user anonymity.


## 4.4. Resisting Server Spoofing Attack

In the proposed scheme, if the attacker wants to masquerade as the remote serverS to cheat the user U, he/she has to generate a valid message M
2
=
{
T
,
H
s
}, where T
=
S
+
M
′, H
s
=
H
2
(
S
∥
TID
u
′
). That is to say, the attacker must get the values M
′ and TID
u
′ to compute a valid message {
T
,
H
s
}. However, the attacker cannot compute the values M
′
=
q
s
·
R and TID
u
′
=
q
s
·
H
1
(
PW
u
∥
b
u
)
·
P without knowing the private key of the server S and user’s password PW
u. Therefore, our scheme is secure against the server spoofing attack.


## 4.5. Resisting Insider Attack

Insider attack means that the userU may register to more than one server with the same identity and password; then a privileged insider of the server can impersonate the user and access the other servers by making a valid login quest. In the registration of the proposed scheme, the user U freely chooses his/her identity ID
u and password PW
u and submits ID
u and H
1
(
PW
u
∥
b
u
)
·
P to the server S. The server S cannot obtain the password PW
u from H
1
(
PW
u
∥
b
u
)
·
P since he/she will face CDL (computational discrete logarithm) problem. Therefore, the proposed scheme can resist insider attack.


## 4.6. Resisting Smart Card Loss Attack

Assume that the userU’s smart card is lost or stolen, and the attacker can extract the information {
AID
u
,
BID
u
,
b
u
} stored in the smart card, where AID
u
=
(
q
s
+
1
)
·
H
1
(
PW
u
∥
b
u
)
·
P, BID
u
=
H
2
(
H
1
(
ID
u
)
∥
(
H
1
(
PW
u
∥
b
u
)
·
P
)
). On the one hand, the attacker cannot guess user’s password PW
u from AID
u and BID
u since it is protected by one-way hash function. On the other hand, the attacker cannot fabricate a valid login request message or compute the session key using the stolen smart card. Besides, it is impossible for the attacker to update the user’s password. This is because the attacker must have the real identity ID
u and PW
u to pass the verification BID
u
′
=
?
BID
u. Therefore, the proposed scheme is secure against the stolen smart card attack.


## 4.7. Resisting Impersonation Attack

If the attacker wants to impersonate as a legitimate userU to pass the authentication of the server S, he/she has to forge a valid login request message M
1
=
{
CID
u
,
DID
u
,
EID
u
,
R
}. Assume that the attacker possesses the user’s smart card and intercepts the user’s previous login request message, the attacker attempts to impersonate the user U and sends the login message login message (
CID
u
′
,
DID
u
′
,
EID
u
′
,
R
′
). However, this impersonation attempt will fail in step 1 of the authentication phase, since he/she has no way to obtain the values of ID
u, q
s, and TID
u. Therefore, the proposed scheme is secure against impersonate attack.


## 4.8. No Key Control

In proposed scheme, the session key consists ofID
u, TID
u, and r
u
·
r
s
·
P, where r
u and r
s are, respectively, provided by the user and the server. Therefore, the fairness of the session key is guaranteed and either party is in vain attempting to preselect or control the session key.


## 4.9. Resisting Replay Attack

Replay attack means that the attacker may impersonate the legitimate user by reusing the information obtained from the previous run protocols. In the proposed scheme,r
u and r
s are the random numbers that are selected by the user U and the server S, respectively. And they are different for each session. So, the messages exposed in public channel are different in each session. Thus, the proposed scheme can prevent replay attack.


## 4.10. Known Session-Specific Temporary Information Attack

Known session-specific temporary information attack means that if the session ephemeral secrets are exposed to an adversary accidentally, this exposure should not compromise the generated session key. In the proposed scheme, if the session ephemeral secretsr
u and r
s are leaked, the adversary cannot obtain the session key s
k
=
H
3
(
ID
u
∥
TID
u
∥
r
u
·
r
s
·
P
). This is because the adversary has no way to know ID
u and TID
u. Hence, the proposed scheme can resist known session-specific temporary information attack.


## 5. Performance and Functionality Analysis

In this section, we compare the efficiency and security properties of the proposed scheme with related schemes proposed by Yang and Chang [15] and Islam and Biswas [16].Table1 is about the computation cost comparison between our proposed scheme and other related schemes. We only consider ECC multiplication operation, ECC addition/subtraction operation, and hash operation. And the computation cost of XOR operation can be ignored when compared to these operations. According to Table 1, the cost of our proposed scheme is slightly higher than other schemes. However, our proposed scheme can achieve all security properties as mentioned in Table 2. We summarize security properties comparisons between the proposed scheme and two previous schemes in Table 2. It is easy to draw that our proposed scheme can achieve all security requirements. So, the proposed scheme has stronger security.Table 1
Computation cost comparison among our scheme and others.
Yang and Chang [15]
Islam and Biswas [16]
Our scheme
Registration phase
1
T
m
+
1
T
h
1
T
m
+
1
T
h
2
T
m
+
1
T
a
+
3
T
h
Authentication phase
8
T
m
+
5
T
a
+
8
T
h
7
T
m
+
4
T
a
+
6
T
h
9
T
m
+
5
T
a
+
13
T
h
Total computation cost
9
T
m
+
5
T
a
+
9
T
h
8
T
m
+
4
T
a
+
7
T
h
11
T
m
+
8
T
a
+
14
T
h
T
m: the time complexity of ECC multiplication operation; T
a: the time complexity of ECC addition/subtraction operation; T
h: the time complexity of hashing function operation.Table 2
Security properties comparison.
Our scheme
Yang and Chang’s scheme [15]
Islam and Biswas’s scheme [16]
Mutual authentication
Yes
Yes
Yes
Key agreement
Yes
Yes
Yes
Forward secrecy
Yes
No
Yes
User anonymity
Yes
No
Yes
Server spoofing attack
Yes
Yes
Yes
Insider attack
Yes
Yes
Yes
Impersonation attack
Yes
Yes
Yes
Stolen smart card attack
Yes
N/A
N/A
No key control
Yes
Yes
Yes
Replay attack
Yes
No
Yes
No key control
Yes
No
No


## 6. Conclusion

In this paper, we have proposed a two-factor user authentication with key agreement scheme based on elliptic curve cryptosystem. The analysis shows that the computation costs of our proposed scheme are slightly higher than other schemes; however, our scheme can accomplish most desired security goals compared with some related schemes. As a result, our scheme is more secure and practical for real-life use.



---

*Source: 423930-2014-05-19.xml*