# A Secure and Efficient ECC-Based Anonymous Authentication Protocol

Authors: Feifei Wang; Guoai Xu; Lize Gu
Journal: Security and Communication Networks
 (2019)

---

## Abstract

Nowadays, remote user authentication protocol plays a great role in ensuring the security of data transmission and protecting the privacy of users for various network services. In this study, we discover two recently introduced anonymous authentication schemes are not as secure as they claimed, by demonstrating they suffer from offline password guessing attack, desynchronization attack, session key disclosure attack, failure to achieve user anonymity, or forward secrecy. Besides, we reveal two environment-specific authentication schemes have weaknesses like impersonation attack. To eliminate the security vulnerabilities of existing schemes, we propose an improved authentication scheme based on elliptic curve cryptosystem. We use BAN logic and heuristic analysis to prove our scheme provides perfect security attributes and is resistant to known attacks. In addition, the security and performance comparison show that our scheme is superior with better security and low computation and communication cost.


---

## Body

## 1. Introduction

With the dramatic increase of network attacks and privacy leakage, it is extremely important for various network services to identify the authenticity of communicating party and protect the privacy of users in insecure environment. As a basic defense strategy for numerous network services, the authentication protocol is aimed at solving these security issues. It has been used in various areas, such as e-banking, e-health, wireless sensor networks, and internet of things [1–3]. Authentication protocol generally provides three useful functionalities, that is, mutual authentication, user anonymity, and session key agreement.Recently, there have been a great number of authentication schemes introduced and some evaluation metrics developed [4–8]. In 2012, Wang et al. [9] presented a robust authentication protocol that is resistant to known attacks, but the protocol has low efficiency, as it requires a number of modular exponentiation operations. Besides, they presented a comprehensive evaluation criteria for smart card based password authentication protocols. Madhusudhan and Mittal [10] defined the security requirements and desirable properties an authentication protocol should fulfil and provide. Kim–Kim [11] introduced an efficient dynamic identity authentication scheme, in which a synchronization mechanism is adopted to achieve user anonymity. In 2014, Islam et al. [12] introduced an anonymous authentication scheme based on elliptic curve cryptosystem (ECC). Huang et al. [13] proposed an anonymous authentication protocol based on RSA cryptosystem. In 2015, Wang et al. [14] demonstrated Kim–Kim’s scheme and its similar schemes that employ the same synchronization mechanism cannot withstand desynchronization attack and introduced an ElGamal cryptosystem based scheme to overcome this threat. In 2016, Nikooghadam et al. [15] presented an efficient authentication protocol using symmetric key cryptosystem and claimed the protocol is resistant to various known attacks. Jung et al. [16] proposed a symmetric key cryptosystem based authentication and key agreement protocol for wireless sensor networks. In 2017, Luo et al. [17] proved that Islam et al.’s scheme is susceptible to insider attack and offline password guessing attack and introduced a new ECC-based scheme for improvement. But their scheme suffers from session key disclosure attack and offline guessing password attack. Xiong et al. [18] proved Jung et al.’s protocol fails to achieve forward secrecy and suffers from smart card loss attack and introduced an improved scheme based on hash chain technique. Xie et al. [19] proposed a provably secure authentication protocol using ECC. Unfortunately, the protocol is inefficient in detection of wrong identity and password. Amin et al. [20] demonstrated that Huang et al.’s scheme cannot resist offline password guessing attack and forgery attack and presented an anonymous RSA cryptosystem based scheme for improvement.Although a great number of research works have been done on authentication protocols [21–35], new authentication schemes still have various security weaknesses [22–29, 32–34]. Offline guessing password attack and forward secrecy attack are two of the most common security weaknesses.One prominent issue of authentication protocol is security against offline guessing password attack. In authentication scheme, the verification value is essential to check the validity of inputted password and implement local password updates. But the introduced verification value probably leads to offline password guessing attack, even server impersonation attack, user impersonation attack, and man-in-the-middle attack. To solve this problem, Wang et al. [35] introduced an effective solution by integrating “fuzzy-verifier” with “honeywords”.On the other hand, forward secrecy is a matter of concern to authentication protocol. Numerous authentication schemes proposed recently achieve many desirable features but fail to preserve forward secrecy. Forward secrecy attack is a security vulnerability that damages the whole server system. Halevi and Krawczyk [36] demonstrated that, for any key exchange scheme, perfect forward secrecy can be achieved through using Diffie-Hellman key exchange.


### 1.1. Our Contributions

We cryptanalyze several representative schemes in the paper. Firstly, we point out Amin et al.’s scheme [20] suffers from offline guessing attack, user impersonation attack and fails to provide forward secrecy. Next, we reveal Nikooghadam et al.’s protocol [15] suffers from offline guessing attack, man-in-the-middle attack, session key disclosure attack, server impersonation attack, desynchronization attack, user impersonation attack, and fails to preserve forward secrecy and user anonymity. Then we point out Mishra et al.’s session initiation protocol [33] fails to provide forward secrecy. In addition, we demonstrate Hsieh et al.’s authentication scheme for wireless communication [34] suffers from offline password guessing attack and impersonation attack.To eliminate these security vulnerabilities, we propose an improved authentication protocol based on elliptic curve cryptosystem. We use BAN logic and informal analysis to prove the completeness and security of our scheme. Furthermore, we give the performance and security comparison of related schemes. The results show that our scheme is more practical.


### 1.2. Structure of the Paper

Section2 gives the cryptanalysis of Amin et al.’s scheme. Section 3 is the cryptanalysis of Nikooghadam et al.’s scheme. Section 4 is the cryptanalysis of two environment-specific authentication schemes. Section 5 gives the proposed scheme. Section 6 is the security analysis of our scheme. And Section 7 gives the security and performance comparison of related schemes. Section 8 is a conclusion.We elaborate the notations of this paper in Table1.Table 1
Notations.
Symbol Description U i i t h user  S Remote server  A Malicious adversary  I D i Identity of userUi  P W i Password of userUi  x Master key ofS  P A generatorP of elliptic curve group Ep  T i, TS The current timestamp ofUi, S  T 1 , T 2 , T 3 The current timestamp  E K e y ( ) / D K e y ( ) Symmetric encryption/ decryption algorithm with keyKey  SK Session key betweenUi and S  h · Hash function  ∥ The string concatenation operation  ⊕ The bitwise XOR operation  → A public communication channel  ⇒ A secure communication channel  I D H A Identity of home agent  I D F A Identity of the foreign agent


## 1.1. Our Contributions

We cryptanalyze several representative schemes in the paper. Firstly, we point out Amin et al.’s scheme [20] suffers from offline guessing attack, user impersonation attack and fails to provide forward secrecy. Next, we reveal Nikooghadam et al.’s protocol [15] suffers from offline guessing attack, man-in-the-middle attack, session key disclosure attack, server impersonation attack, desynchronization attack, user impersonation attack, and fails to preserve forward secrecy and user anonymity. Then we point out Mishra et al.’s session initiation protocol [33] fails to provide forward secrecy. In addition, we demonstrate Hsieh et al.’s authentication scheme for wireless communication [34] suffers from offline password guessing attack and impersonation attack.To eliminate these security vulnerabilities, we propose an improved authentication protocol based on elliptic curve cryptosystem. We use BAN logic and informal analysis to prove the completeness and security of our scheme. Furthermore, we give the performance and security comparison of related schemes. The results show that our scheme is more practical.


## 1.2. Structure of the Paper

Section2 gives the cryptanalysis of Amin et al.’s scheme. Section 3 is the cryptanalysis of Nikooghadam et al.’s scheme. Section 4 is the cryptanalysis of two environment-specific authentication schemes. Section 5 gives the proposed scheme. Section 6 is the security analysis of our scheme. And Section 7 gives the security and performance comparison of related schemes. Section 8 is a conclusion.We elaborate the notations of this paper in Table1.Table 1
Notations.
Symbol Description U i i t h user  S Remote server  A Malicious adversary  I D i Identity of userUi  P W i Password of userUi  x Master key ofS  P A generatorP of elliptic curve group Ep  T i, TS The current timestamp ofUi, S  T 1 , T 2 , T 3 The current timestamp  E K e y ( ) / D K e y ( ) Symmetric encryption/ decryption algorithm with keyKey  SK Session key betweenUi and S  h · Hash function  ∥ The string concatenation operation  ⊕ The bitwise XOR operation  → A public communication channel  ⇒ A secure communication channel  I D H A Identity of home agent  I D F A Identity of the foreign agent


## 2. Cryptanalysis of Amin Et Al.’s Scheme

In this section, we describe Amin et al.’s scheme and reveal its security vulnerabilities.


### 2.1. Review of Amin Et Al.’s Scheme

Amin et al.’s scheme consists of the following three phases (see Figure1).Figure 1
Amin et al.’s scheme.


#### 2.1.1. Initialization Phase

S chooses two big prime numbersu,v and calculates m=u×v. Next,S selects another prime number e, where 1<e<(u-1)(v-1). Andd is calculated according to ed≡1mod(u-1)(v-1).S publishes public parameters {m,e} and keeps {d,u,v} as secret.


#### 2.1.2. Registration Phase

In this phase,Ui submits his identity information toS with the purpose of obtaining the access permission.Step 1.
U i picks IDi and PWi freely. Ui calculates PWRi=h(PWi∥ri), where ri is a nonce. Afterwards, {IDi,PWRi} is transmitted toS via a secure channel.Step 2.
Upon receiving{IDi,PWRi},S calculates Ai=h(d∥IDi), Bi=h(Ai∥PWRi∥IDi), Yi=Ai⊕h(PWRi∥IDi).S stores {Bi,Yi,m,e} in a smart card. The smart card is transmitted to Ui via a secure channel.Step 3.
U i stores ri in the smart card.


#### 2.1.3. Login and Authentication Phase

In this phase,Ui delivers a login request message to S. S verifies the legitimacy of the message and sends back a response.Step 1.
U i attaches the smart card to a terminal and inputs IDi∗ and PWi∗. The smart card calculates PWRi∗=h(PWi∗∥ri), Ai∗=Yi⊕h(PWRi∗∥IDi∗), Bi∗=h(Ai∗∥PWRi∗∥IDi∗), and checks whether Bi∗=Bi. If the equation holds, perform next step.Step 2.
The smart card computesDi=h(Ai∗∥h(PWRi∗∥IDi∗)∥Ti∥N1), Li=(IDi∗∥Di∥N1)emodm, where N1 is random number. {Li,Yi,Ti} is transmitted toS.Step 3.
After receiving{Li,Yi,Ti},S validates if Ti′-Ti<∆T, where Ti′ is the current time receives {Li,Yi,Ti} at server end, and ∆T is an accredited maximum transport delay. If it holds, it denotes that Ti is fresh.S computes Lidmodm to derive (IDi′∥Di′∥N1′). ThenS calculates Ai′=h(d∥IDi′), [hPWRi∗∥IDi∗]′=Yi⊕Ai′.Step 4.
S calculates Di′′=h(Ai′∥[hPWRi∗∥IDi∗]′∥Ti∥N1′) and checks Di′′≟Di′. If the equation holds,S regards Ui as a legitimate user. Otherwise, this protocol aborts.Step 5.
S computes Xi=h(N2∥Ai′), Zi=N2⊕N1′, SK=h(N1′∥Ai′∥N2), where N2 is a random number.S sends {Xi,Zi,Ts} to Ui.Step 6.
After receiving{Xi,Zi,Ts}, the smart card first checks if Ts is fresh. Next, the smart card calculates N2′=Zi⊕N1, Xi′=h(N2′∥Ai∗), and checks if Xi′≟Xi. If the equation holds,S is authenticated by Ui. Then, the smart card calculates SK=h(N1∥Ai∗∥N2′) as session key.


### 2.2. Cryptanalysis of Amin Et Al.’s Scheme

In this part, we elaborate Amin et al.’s scheme is susceptible to several security attacks.


#### 2.2.1. Offline Password Guessing Attack

The adversaryA extracts {Bi,Yi,m,e,ri} from the smart card. A performs offline password guessing attack in the following steps.Step 1.
Choose an identityIDi∗ from the identity dictionary space, and a password PW∗ from the password dictionary space.Step 2.
CalculatePWRi∗=h(PWi∗∥ri), Ai∗=Yi⊕h(PWRi∗∥IDi∗), Bi∗=h(Ai∗∥PWRi∗∥IDi∗). Compare Bi∗ with Bi. If they are equal, it shows that IDi∗ is Ui's real identity, and PW∗ is Ui's correct password.Step 3.
Repeat Steps 1-2, untilA finds the real IDi and PWi.


#### 2.2.2. User Impersonation Attack

OnceA extracts {Bi,Yi,m,e,ri} from the smart card and gets IDi, PWi via “offline password guessing attack”, A performs user impersonation attack in the following steps.Step 1.
CalculatePWRi∗=h(PWi∥ri), Ai∗=Yi⊕h(PWRi∗∥IDi), Bi∗=h(Ai∗∥PWRi∗∥IDi). Obviously, Bi∗ is equal to Bi.Step 2.
Select a nonceN1a. Calculate Da=h(Ai∗∥h(PWRi∗∥IDi)∥Ta∥N1a), where Ta is the current timestamp. Calculate La=(IDi∥Da∥N1a)emodm. Send {La,Yi,Ta} to S.Step 3.
Upon receiving{La,Yi,Ta}, as Ta is fresh,S computes Ladmodm to retrieve (IDi′∥Da′∥N1a′). ThenS computes Ai′=h(d∥IDi′), [hPWRi∗∥IDi]′=Yi⊕Ai′, Da′′=h(Ai′∥[hPWRi∗∥IDi]′∥Ta∥N1a′). As Da′′ is equal to Da′,S regards A as legitimate user Ui.The inherent reason for above attacks is that there is a verification valueBi in smart card for the adversary to check if the guessed IDi and PWi are correct.


#### 2.2.3. Forward Secrecy

SupposeA gets the secret key {d,u,v} and intercepts message {Li,Yi,Tu} and {Xi,Zi,Ts} from public channel. Then A calculates the session key as follows.Step 1.
ComputeLidmodm to derive (IDi′∥Di′∥N1′).Step 2.
ComputeN2′=Zi⊕N1′.Step 3.
ComputeAi′=h(d∥IDi′), SK=h(N1′∥Ai′∥N2′).In Amin et al.’s scheme,Ui andS select random numbers N1,N2, respectively. The transmission of N1 uses RSA encryption under the public key ofS. The transmission of N2 uses bitwise XOR with N1. Hence, the confidentiality of random numbers is completely dependent on the private key ofS. Once the private key ofS is compromised, the attacker can easily get all session keys of the whole server system.


## 2.1. Review of Amin Et Al.’s Scheme

Amin et al.’s scheme consists of the following three phases (see Figure1).Figure 1
Amin et al.’s scheme.


### 2.1.1. Initialization Phase

S chooses two big prime numbersu,v and calculates m=u×v. Next,S selects another prime number e, where 1<e<(u-1)(v-1). Andd is calculated according to ed≡1mod(u-1)(v-1).S publishes public parameters {m,e} and keeps {d,u,v} as secret.


### 2.1.2. Registration Phase

In this phase,Ui submits his identity information toS with the purpose of obtaining the access permission.Step 1.
U i picks IDi and PWi freely. Ui calculates PWRi=h(PWi∥ri), where ri is a nonce. Afterwards, {IDi,PWRi} is transmitted toS via a secure channel.Step 2.
Upon receiving{IDi,PWRi},S calculates Ai=h(d∥IDi), Bi=h(Ai∥PWRi∥IDi), Yi=Ai⊕h(PWRi∥IDi).S stores {Bi,Yi,m,e} in a smart card. The smart card is transmitted to Ui via a secure channel.Step 3.
U i stores ri in the smart card.


### 2.1.3. Login and Authentication Phase

In this phase,Ui delivers a login request message to S. S verifies the legitimacy of the message and sends back a response.Step 1.
U i attaches the smart card to a terminal and inputs IDi∗ and PWi∗. The smart card calculates PWRi∗=h(PWi∗∥ri), Ai∗=Yi⊕h(PWRi∗∥IDi∗), Bi∗=h(Ai∗∥PWRi∗∥IDi∗), and checks whether Bi∗=Bi. If the equation holds, perform next step.Step 2.
The smart card computesDi=h(Ai∗∥h(PWRi∗∥IDi∗)∥Ti∥N1), Li=(IDi∗∥Di∥N1)emodm, where N1 is random number. {Li,Yi,Ti} is transmitted toS.Step 3.
After receiving{Li,Yi,Ti},S validates if Ti′-Ti<∆T, where Ti′ is the current time receives {Li,Yi,Ti} at server end, and ∆T is an accredited maximum transport delay. If it holds, it denotes that Ti is fresh.S computes Lidmodm to derive (IDi′∥Di′∥N1′). ThenS calculates Ai′=h(d∥IDi′), [hPWRi∗∥IDi∗]′=Yi⊕Ai′.Step 4.
S calculates Di′′=h(Ai′∥[hPWRi∗∥IDi∗]′∥Ti∥N1′) and checks Di′′≟Di′. If the equation holds,S regards Ui as a legitimate user. Otherwise, this protocol aborts.Step 5.
S computes Xi=h(N2∥Ai′), Zi=N2⊕N1′, SK=h(N1′∥Ai′∥N2), where N2 is a random number.S sends {Xi,Zi,Ts} to Ui.Step 6.
After receiving{Xi,Zi,Ts}, the smart card first checks if Ts is fresh. Next, the smart card calculates N2′=Zi⊕N1, Xi′=h(N2′∥Ai∗), and checks if Xi′≟Xi. If the equation holds,S is authenticated by Ui. Then, the smart card calculates SK=h(N1∥Ai∗∥N2′) as session key.


## 2.1.1. Initialization Phase

S chooses two big prime numbersu,v and calculates m=u×v. Next,S selects another prime number e, where 1<e<(u-1)(v-1). Andd is calculated according to ed≡1mod(u-1)(v-1).S publishes public parameters {m,e} and keeps {d,u,v} as secret.


## 2.1.2. Registration Phase

In this phase,Ui submits his identity information toS with the purpose of obtaining the access permission.Step 1.
U i picks IDi and PWi freely. Ui calculates PWRi=h(PWi∥ri), where ri is a nonce. Afterwards, {IDi,PWRi} is transmitted toS via a secure channel.Step 2.
Upon receiving{IDi,PWRi},S calculates Ai=h(d∥IDi), Bi=h(Ai∥PWRi∥IDi), Yi=Ai⊕h(PWRi∥IDi).S stores {Bi,Yi,m,e} in a smart card. The smart card is transmitted to Ui via a secure channel.Step 3.
U i stores ri in the smart card.


## 2.1.3. Login and Authentication Phase

In this phase,Ui delivers a login request message to S. S verifies the legitimacy of the message and sends back a response.Step 1.
U i attaches the smart card to a terminal and inputs IDi∗ and PWi∗. The smart card calculates PWRi∗=h(PWi∗∥ri), Ai∗=Yi⊕h(PWRi∗∥IDi∗), Bi∗=h(Ai∗∥PWRi∗∥IDi∗), and checks whether Bi∗=Bi. If the equation holds, perform next step.Step 2.
The smart card computesDi=h(Ai∗∥h(PWRi∗∥IDi∗)∥Ti∥N1), Li=(IDi∗∥Di∥N1)emodm, where N1 is random number. {Li,Yi,Ti} is transmitted toS.Step 3.
After receiving{Li,Yi,Ti},S validates if Ti′-Ti<∆T, where Ti′ is the current time receives {Li,Yi,Ti} at server end, and ∆T is an accredited maximum transport delay. If it holds, it denotes that Ti is fresh.S computes Lidmodm to derive (IDi′∥Di′∥N1′). ThenS calculates Ai′=h(d∥IDi′), [hPWRi∗∥IDi∗]′=Yi⊕Ai′.Step 4.
S calculates Di′′=h(Ai′∥[hPWRi∗∥IDi∗]′∥Ti∥N1′) and checks Di′′≟Di′. If the equation holds,S regards Ui as a legitimate user. Otherwise, this protocol aborts.Step 5.
S computes Xi=h(N2∥Ai′), Zi=N2⊕N1′, SK=h(N1′∥Ai′∥N2), where N2 is a random number.S sends {Xi,Zi,Ts} to Ui.Step 6.
After receiving{Xi,Zi,Ts}, the smart card first checks if Ts is fresh. Next, the smart card calculates N2′=Zi⊕N1, Xi′=h(N2′∥Ai∗), and checks if Xi′≟Xi. If the equation holds,S is authenticated by Ui. Then, the smart card calculates SK=h(N1∥Ai∗∥N2′) as session key.


## 2.2. Cryptanalysis of Amin Et Al.’s Scheme

In this part, we elaborate Amin et al.’s scheme is susceptible to several security attacks.


### 2.2.1. Offline Password Guessing Attack

The adversaryA extracts {Bi,Yi,m,e,ri} from the smart card. A performs offline password guessing attack in the following steps.Step 1.
Choose an identityIDi∗ from the identity dictionary space, and a password PW∗ from the password dictionary space.Step 2.
CalculatePWRi∗=h(PWi∗∥ri), Ai∗=Yi⊕h(PWRi∗∥IDi∗), Bi∗=h(Ai∗∥PWRi∗∥IDi∗). Compare Bi∗ with Bi. If they are equal, it shows that IDi∗ is Ui's real identity, and PW∗ is Ui's correct password.Step 3.
Repeat Steps 1-2, untilA finds the real IDi and PWi.


### 2.2.2. User Impersonation Attack

OnceA extracts {Bi,Yi,m,e,ri} from the smart card and gets IDi, PWi via “offline password guessing attack”, A performs user impersonation attack in the following steps.Step 1.
CalculatePWRi∗=h(PWi∥ri), Ai∗=Yi⊕h(PWRi∗∥IDi), Bi∗=h(Ai∗∥PWRi∗∥IDi). Obviously, Bi∗ is equal to Bi.Step 2.
Select a nonceN1a. Calculate Da=h(Ai∗∥h(PWRi∗∥IDi)∥Ta∥N1a), where Ta is the current timestamp. Calculate La=(IDi∥Da∥N1a)emodm. Send {La,Yi,Ta} to S.Step 3.
Upon receiving{La,Yi,Ta}, as Ta is fresh,S computes Ladmodm to retrieve (IDi′∥Da′∥N1a′). ThenS computes Ai′=h(d∥IDi′), [hPWRi∗∥IDi]′=Yi⊕Ai′, Da′′=h(Ai′∥[hPWRi∗∥IDi]′∥Ta∥N1a′). As Da′′ is equal to Da′,S regards A as legitimate user Ui.The inherent reason for above attacks is that there is a verification valueBi in smart card for the adversary to check if the guessed IDi and PWi are correct.


### 2.2.3. Forward Secrecy

SupposeA gets the secret key {d,u,v} and intercepts message {Li,Yi,Tu} and {Xi,Zi,Ts} from public channel. Then A calculates the session key as follows.Step 1.
ComputeLidmodm to derive (IDi′∥Di′∥N1′).Step 2.
ComputeN2′=Zi⊕N1′.Step 3.
ComputeAi′=h(d∥IDi′), SK=h(N1′∥Ai′∥N2′).In Amin et al.’s scheme,Ui andS select random numbers N1,N2, respectively. The transmission of N1 uses RSA encryption under the public key ofS. The transmission of N2 uses bitwise XOR with N1. Hence, the confidentiality of random numbers is completely dependent on the private key ofS. Once the private key ofS is compromised, the attacker can easily get all session keys of the whole server system.


## 2.2.1. Offline Password Guessing Attack

The adversaryA extracts {Bi,Yi,m,e,ri} from the smart card. A performs offline password guessing attack in the following steps.Step 1.
Choose an identityIDi∗ from the identity dictionary space, and a password PW∗ from the password dictionary space.Step 2.
CalculatePWRi∗=h(PWi∗∥ri), Ai∗=Yi⊕h(PWRi∗∥IDi∗), Bi∗=h(Ai∗∥PWRi∗∥IDi∗). Compare Bi∗ with Bi. If they are equal, it shows that IDi∗ is Ui's real identity, and PW∗ is Ui's correct password.Step 3.
Repeat Steps 1-2, untilA finds the real IDi and PWi.


## 2.2.2. User Impersonation Attack

OnceA extracts {Bi,Yi,m,e,ri} from the smart card and gets IDi, PWi via “offline password guessing attack”, A performs user impersonation attack in the following steps.Step 1.
CalculatePWRi∗=h(PWi∥ri), Ai∗=Yi⊕h(PWRi∗∥IDi), Bi∗=h(Ai∗∥PWRi∗∥IDi). Obviously, Bi∗ is equal to Bi.Step 2.
Select a nonceN1a. Calculate Da=h(Ai∗∥h(PWRi∗∥IDi)∥Ta∥N1a), where Ta is the current timestamp. Calculate La=(IDi∥Da∥N1a)emodm. Send {La,Yi,Ta} to S.Step 3.
Upon receiving{La,Yi,Ta}, as Ta is fresh,S computes Ladmodm to retrieve (IDi′∥Da′∥N1a′). ThenS computes Ai′=h(d∥IDi′), [hPWRi∗∥IDi]′=Yi⊕Ai′, Da′′=h(Ai′∥[hPWRi∗∥IDi]′∥Ta∥N1a′). As Da′′ is equal to Da′,S regards A as legitimate user Ui.The inherent reason for above attacks is that there is a verification valueBi in smart card for the adversary to check if the guessed IDi and PWi are correct.


## 2.2.3. Forward Secrecy

SupposeA gets the secret key {d,u,v} and intercepts message {Li,Yi,Tu} and {Xi,Zi,Ts} from public channel. Then A calculates the session key as follows.Step 1.
ComputeLidmodm to derive (IDi′∥Di′∥N1′).Step 2.
ComputeN2′=Zi⊕N1′.Step 3.
ComputeAi′=h(d∥IDi′), SK=h(N1′∥Ai′∥N2′).In Amin et al.’s scheme,Ui andS select random numbers N1,N2, respectively. The transmission of N1 uses RSA encryption under the public key ofS. The transmission of N2 uses bitwise XOR with N1. Hence, the confidentiality of random numbers is completely dependent on the private key ofS. Once the private key ofS is compromised, the attacker can easily get all session keys of the whole server system.


## 3. Cryptanalysis of Nikooghadam Et Al.’s Scheme

In this section, we review Nikooghadam et al.’s scheme and reveal its security vulnerabilities.


### 3.1. Review of Nikooghadam Et Al.’s Scheme

Nikooghadam et al.’s scheme includes the following two phases (see Figure2).Figure 2
Nikooghadam et al.’s scheme.


#### 3.1.1. Registration Phase

In this phase, when receiving the enrollment request,S issues a smart card to Ui.Step 1.
U i picks IDi, PWi freely. Then Ui calculates PWRi=h(IDi∥ri∥PWi), where ri is a random number. {IDi,PWRi} is transmitted to S through a secure channel.Step 2.
After receiving{IDi,PWRi}, S calculates Ai=h(IDi∥x), Bi=Ai⊕PWRi. S computes Ui’s dynamic identity DIDi=Ex(IDi∥N), where N is a random number. S stores {Bi,DIDi,EKey(·)/DKey(·)} in a smart card and delivers it to Ui through a secure channel.Step 3.
U i stores ri in the smart card.


#### 3.1.2. Login and Authentication Phase

This phase verifies the legitimacy of communicating parties and negotiates a session key.Step 1.
U i inserts his smart card into a terminal and enters IDi∗,PWi∗. The smart card calculates Ai=Bi⊕h(IDi∗∥ri∥PWi∗), Mi=EAi(IDi∗∥RNi∥Ti∥DIDi), where RNi is a nonce. The smart card delivers {DIDi,Mi,Ti} toS.Step 2.
After receiving{DIDi,Mi,Ti},S checks the freshness of Ti. ThenScomputes (IDi∥N)=Dx(DIDi), Ai′=h(IDi∥x), (IDi′∥RNi′∥Ti′∥DIDi′)=DAi′(Mi), and checks DIDi′≟DIDi, Ti′≟Ti. If both the two equations hold, perform next step. Otherwise, this protocol aborts.Step 3.
S chooses two random numbers Nnew, RNS. ThenS computes DIDinew=Ex(IDi∥Nnew), Pi=EAi′(DIDinew∥RNS∥IDi∥RNi′), and returns {Pi} to Ui.Step 4.
Upon receiving{Pi}, the smart card calculates DIDinew∥RNS′∥IDi′′∥RNi′=DAi(Pi) and checks if RNi′=RNi,IDi′′=IDi. If the two equations hold, perform next step; otherwise, this protocol aborts.Step 5.
The smart card calculatesQi=h(RNS′∥DIDinew∥RNi), SK=h(RNS′∥Ai∥RNi). {Qi} is transmitted toS.Step 6.
Upon receiving{Qi},S calculates Qi′=h(RNS∥DIDinew∥RNi′) and checks Qi′≟Qi. If the equation holds,S computes SK=h(RNS∥Ai′∥RNi′).


### 3.2. Cryptanalysis of Nikooghadam Et Al.’s Scheme

In this part, we demonstrate Nikooghadam et al.’s scheme is susceptible to several security attacks.


#### 3.2.1. Inefficiency for Wrong Password Detection

In the login phase, the smart card never checks the validity of the entered password. IfUi inputs a wrong password by accident, the smart card cannot detect this fault, until a login request is sent toS, andS returns back a response to reject it. It wastes too much time of users.


#### 3.2.2. Offline Password Guessing Attack

The adversaryA extracts {Bi,DIDi,EKey(·)/DKey(·),ri} from Ui’s smart card and intercepts {DIDi,Mi,Ti} from public channel. Offline password guessing is launched in the following steps.Step 1.
Choose an identityIDi∗ from the identity dictionary space and a password PW∗ from the password dictionary space.Step 2.
CalculateAi∗=Bi⊕h(ID∗∥ri∥PW∗), (IDi∗∗∥RNi∗∥Ti∗∥DIDi∗)=DAi∗Mi. Check DIDi∗≟DIDi, Ti∗≟Ti. If both the two equations hold, it shows that IDi∗ is Ui's real identity, and PW∗ is Ui's correct password.Step 3.
Repeat Steps 1-2, untilA find real IDi and PWi.


#### 3.2.3. User Anonymity

For the message{DIDi,Mi,Ti}, IDi is compromised by performing offline password guessing attack; this is violation of user anonymity.Once the adversaryA gets {Bi,DIDi,EKey·/DKey(·),ri} and obtains IDi and PWi by performing offline password guessing attack and intercepts {DIDi,Mi,Ti}, {Pi}, and {Qi} from pubic channel, A performs user impersonation attack, server impersonation attack, man-in-the-middle attack, session key disclosure attack, and desynchronization attack as follows.


#### 3.2.4. User Impersonation Attack

Step 1.
A computes Ai=Bi⊕h(IDi∥ri∥PWi).Step 2.
A computes Ma=EAi(IDi∥RNia∥Ta∥DIDi), where RNia is a nonce, and Ta is current timestamp. A sends {DIDi,Ma,Ta} toS.Step 3.
AfterS receiving {DIDi,Ma,Ta}, as Ta is fresh, DIDi′=DIDi, Ta′=Ta,S regards A as the legitimate user Ui and returns {Pa} to A.Step 4.
Upon receiving{Pa}, A computes DIDinew∥RNS′∥IDi′′∥RNia′=DAi(Pa), Qa=h(RNS′∥DIDinew∥RNia), SK=h(RNS′∥Ai∥RNia) and sends {Qa} toS.Step 5.
AfterS receiving {Qa}, as Qa′=Qa,S computes SK=h(RNS∥Ai′∥RNia′).
A establishes a session key SK withS successfully.


#### 3.2.5. Server Impersonation Attack

Step 1.
ComputeAi=Bi⊕h(IDi∥ri∥PWi).Step 2.
Compute(IDi′∥RNi′∥Ti′∥DIDi′)=DAi(Mi).Step 3.
Intercept{Pi} from public channel. Generate a nonce RNSa and select a binary string DIDia whose length is the same as DIDi. Compute Pa=EAi(DIDia∥RNSa∥IDi∥RNi′) and return {Pa} to Ui.Step 4.
After receiving{Pa}, as RNi′=RNi,IDi′′=IDi, Ui regards A as the severS.


#### 3.2.6. Man-in-the-Middle Attack

Step 1.
Intercept{DIDi,Mi,Ti} from public channel and send {DIDi,Ma,Ta} toS.Step 2.
Intercept{Pi} from public channel and send {Pa} to Ui.Step 3.
Intercept{Qi} from public channel and send {Qa} toS.


#### 3.2.7. Session Key Disclosure Attack

Step 1.
CalculateAi=Bi⊕h(IDi∥ri∥PWi).Step 2.
CalculateDIDinew∥RNS′∥IDi′′∥RNi′=DAiPi.Step 3.
CalculateSK=h(RNS′∥Ai∥RNi′).


#### 3.2.8. Desynchronization Attack

Step 1.
CalculateAi=Bi⊕h(IDi∥ri∥PWi).Step 2.
Intercept{Pi} from pubic channel. Compute DIDiNew∥RNS′∥IDi′′∥RNi′=DAiPi. Select a binary string DIDia whose length is same as DIDiNew. Compute Pa=EAi(DIDia∥RNS′∥IDi∥RNi′). Sends {Pa} to Ui.Step 3.
Intercept{Qi} from pubic channel. Compute Qa=h(RNS′∥DIDinew∥RNi′). Send Qa toS.After that,Ui cannot login S anymore, unless Ui re-register toS.


#### 3.2.9. Forward Secrecy

SupposeA obtains the master key ofS and intercepts {DIDi,Mi,Ti} and {Pi} from public channel, and then A calculates the session key as follows.Step 1.
CalculateIDi=Dx(DIDi).Step 2.
CalculateAi=h(IDi∥x).Step 3.
CalculateDIDiNew∥RNS′∥IDi′′∥RNi′=DAiPi.Step 4.
CalculateSK=h(RNS′∥Ai∥RNi′).The transmission of random numbersRNi, RNs uses symmetric encryption under key Ai. The confidentiality of random numbers is dependent on the authentication value Ai. Once the master key ofS is leaked, the attacker is able to compute Ai=h(IDi∥x) and obtain RNi, RNs by decrypting message {Pi}. Consequently, the session keys of the whole sever system are compromised.In the authentication scheme, random numbers are essential to establish unique session key in each session. If the user or server cannot transmit random number to the other side securely, it certainly will compromise the session key.


## 3.1. Review of Nikooghadam Et Al.’s Scheme

Nikooghadam et al.’s scheme includes the following two phases (see Figure2).Figure 2
Nikooghadam et al.’s scheme.


### 3.1.1. Registration Phase

In this phase, when receiving the enrollment request,S issues a smart card to Ui.Step 1.
U i picks IDi, PWi freely. Then Ui calculates PWRi=h(IDi∥ri∥PWi), where ri is a random number. {IDi,PWRi} is transmitted to S through a secure channel.Step 2.
After receiving{IDi,PWRi}, S calculates Ai=h(IDi∥x), Bi=Ai⊕PWRi. S computes Ui’s dynamic identity DIDi=Ex(IDi∥N), where N is a random number. S stores {Bi,DIDi,EKey(·)/DKey(·)} in a smart card and delivers it to Ui through a secure channel.Step 3.
U i stores ri in the smart card.


### 3.1.2. Login and Authentication Phase

This phase verifies the legitimacy of communicating parties and negotiates a session key.Step 1.
U i inserts his smart card into a terminal and enters IDi∗,PWi∗. The smart card calculates Ai=Bi⊕h(IDi∗∥ri∥PWi∗), Mi=EAi(IDi∗∥RNi∥Ti∥DIDi), where RNi is a nonce. The smart card delivers {DIDi,Mi,Ti} toS.Step 2.
After receiving{DIDi,Mi,Ti},S checks the freshness of Ti. ThenScomputes (IDi∥N)=Dx(DIDi), Ai′=h(IDi∥x), (IDi′∥RNi′∥Ti′∥DIDi′)=DAi′(Mi), and checks DIDi′≟DIDi, Ti′≟Ti. If both the two equations hold, perform next step. Otherwise, this protocol aborts.Step 3.
S chooses two random numbers Nnew, RNS. ThenS computes DIDinew=Ex(IDi∥Nnew), Pi=EAi′(DIDinew∥RNS∥IDi∥RNi′), and returns {Pi} to Ui.Step 4.
Upon receiving{Pi}, the smart card calculates DIDinew∥RNS′∥IDi′′∥RNi′=DAi(Pi) and checks if RNi′=RNi,IDi′′=IDi. If the two equations hold, perform next step; otherwise, this protocol aborts.Step 5.
The smart card calculatesQi=h(RNS′∥DIDinew∥RNi), SK=h(RNS′∥Ai∥RNi). {Qi} is transmitted toS.Step 6.
Upon receiving{Qi},S calculates Qi′=h(RNS∥DIDinew∥RNi′) and checks Qi′≟Qi. If the equation holds,S computes SK=h(RNS∥Ai′∥RNi′).


## 3.1.1. Registration Phase

In this phase, when receiving the enrollment request,S issues a smart card to Ui.Step 1.
U i picks IDi, PWi freely. Then Ui calculates PWRi=h(IDi∥ri∥PWi), where ri is a random number. {IDi,PWRi} is transmitted to S through a secure channel.Step 2.
After receiving{IDi,PWRi}, S calculates Ai=h(IDi∥x), Bi=Ai⊕PWRi. S computes Ui’s dynamic identity DIDi=Ex(IDi∥N), where N is a random number. S stores {Bi,DIDi,EKey(·)/DKey(·)} in a smart card and delivers it to Ui through a secure channel.Step 3.
U i stores ri in the smart card.


## 3.1.2. Login and Authentication Phase

This phase verifies the legitimacy of communicating parties and negotiates a session key.Step 1.
U i inserts his smart card into a terminal and enters IDi∗,PWi∗. The smart card calculates Ai=Bi⊕h(IDi∗∥ri∥PWi∗), Mi=EAi(IDi∗∥RNi∥Ti∥DIDi), where RNi is a nonce. The smart card delivers {DIDi,Mi,Ti} toS.Step 2.
After receiving{DIDi,Mi,Ti},S checks the freshness of Ti. ThenScomputes (IDi∥N)=Dx(DIDi), Ai′=h(IDi∥x), (IDi′∥RNi′∥Ti′∥DIDi′)=DAi′(Mi), and checks DIDi′≟DIDi, Ti′≟Ti. If both the two equations hold, perform next step. Otherwise, this protocol aborts.Step 3.
S chooses two random numbers Nnew, RNS. ThenS computes DIDinew=Ex(IDi∥Nnew), Pi=EAi′(DIDinew∥RNS∥IDi∥RNi′), and returns {Pi} to Ui.Step 4.
Upon receiving{Pi}, the smart card calculates DIDinew∥RNS′∥IDi′′∥RNi′=DAi(Pi) and checks if RNi′=RNi,IDi′′=IDi. If the two equations hold, perform next step; otherwise, this protocol aborts.Step 5.
The smart card calculatesQi=h(RNS′∥DIDinew∥RNi), SK=h(RNS′∥Ai∥RNi). {Qi} is transmitted toS.Step 6.
Upon receiving{Qi},S calculates Qi′=h(RNS∥DIDinew∥RNi′) and checks Qi′≟Qi. If the equation holds,S computes SK=h(RNS∥Ai′∥RNi′).


## 3.2. Cryptanalysis of Nikooghadam Et Al.’s Scheme

In this part, we demonstrate Nikooghadam et al.’s scheme is susceptible to several security attacks.


### 3.2.1. Inefficiency for Wrong Password Detection

In the login phase, the smart card never checks the validity of the entered password. IfUi inputs a wrong password by accident, the smart card cannot detect this fault, until a login request is sent toS, andS returns back a response to reject it. It wastes too much time of users.


### 3.2.2. Offline Password Guessing Attack

The adversaryA extracts {Bi,DIDi,EKey(·)/DKey(·),ri} from Ui’s smart card and intercepts {DIDi,Mi,Ti} from public channel. Offline password guessing is launched in the following steps.Step 1.
Choose an identityIDi∗ from the identity dictionary space and a password PW∗ from the password dictionary space.Step 2.
CalculateAi∗=Bi⊕h(ID∗∥ri∥PW∗), (IDi∗∗∥RNi∗∥Ti∗∥DIDi∗)=DAi∗Mi. Check DIDi∗≟DIDi, Ti∗≟Ti. If both the two equations hold, it shows that IDi∗ is Ui's real identity, and PW∗ is Ui's correct password.Step 3.
Repeat Steps 1-2, untilA find real IDi and PWi.


### 3.2.3. User Anonymity

For the message{DIDi,Mi,Ti}, IDi is compromised by performing offline password guessing attack; this is violation of user anonymity.Once the adversaryA gets {Bi,DIDi,EKey·/DKey(·),ri} and obtains IDi and PWi by performing offline password guessing attack and intercepts {DIDi,Mi,Ti}, {Pi}, and {Qi} from pubic channel, A performs user impersonation attack, server impersonation attack, man-in-the-middle attack, session key disclosure attack, and desynchronization attack as follows.


### 3.2.4. User Impersonation Attack

Step 1.
A computes Ai=Bi⊕h(IDi∥ri∥PWi).Step 2.
A computes Ma=EAi(IDi∥RNia∥Ta∥DIDi), where RNia is a nonce, and Ta is current timestamp. A sends {DIDi,Ma,Ta} toS.Step 3.
AfterS receiving {DIDi,Ma,Ta}, as Ta is fresh, DIDi′=DIDi, Ta′=Ta,S regards A as the legitimate user Ui and returns {Pa} to A.Step 4.
Upon receiving{Pa}, A computes DIDinew∥RNS′∥IDi′′∥RNia′=DAi(Pa), Qa=h(RNS′∥DIDinew∥RNia), SK=h(RNS′∥Ai∥RNia) and sends {Qa} toS.Step 5.
AfterS receiving {Qa}, as Qa′=Qa,S computes SK=h(RNS∥Ai′∥RNia′).
A establishes a session key SK withS successfully.


### 3.2.5. Server Impersonation Attack

Step 1.
ComputeAi=Bi⊕h(IDi∥ri∥PWi).Step 2.
Compute(IDi′∥RNi′∥Ti′∥DIDi′)=DAi(Mi).Step 3.
Intercept{Pi} from public channel. Generate a nonce RNSa and select a binary string DIDia whose length is the same as DIDi. Compute Pa=EAi(DIDia∥RNSa∥IDi∥RNi′) and return {Pa} to Ui.Step 4.
After receiving{Pa}, as RNi′=RNi,IDi′′=IDi, Ui regards A as the severS.


### 3.2.6. Man-in-the-Middle Attack

Step 1.
Intercept{DIDi,Mi,Ti} from public channel and send {DIDi,Ma,Ta} toS.Step 2.
Intercept{Pi} from public channel and send {Pa} to Ui.Step 3.
Intercept{Qi} from public channel and send {Qa} toS.


### 3.2.7. Session Key Disclosure Attack

Step 1.
CalculateAi=Bi⊕h(IDi∥ri∥PWi).Step 2.
CalculateDIDinew∥RNS′∥IDi′′∥RNi′=DAiPi.Step 3.
CalculateSK=h(RNS′∥Ai∥RNi′).


### 3.2.8. Desynchronization Attack

Step 1.
CalculateAi=Bi⊕h(IDi∥ri∥PWi).Step 2.
Intercept{Pi} from pubic channel. Compute DIDiNew∥RNS′∥IDi′′∥RNi′=DAiPi. Select a binary string DIDia whose length is same as DIDiNew. Compute Pa=EAi(DIDia∥RNS′∥IDi∥RNi′). Sends {Pa} to Ui.Step 3.
Intercept{Qi} from pubic channel. Compute Qa=h(RNS′∥DIDinew∥RNi′). Send Qa toS.After that,Ui cannot login S anymore, unless Ui re-register toS.


### 3.2.9. Forward Secrecy

SupposeA obtains the master key ofS and intercepts {DIDi,Mi,Ti} and {Pi} from public channel, and then A calculates the session key as follows.Step 1.
CalculateIDi=Dx(DIDi).Step 2.
CalculateAi=h(IDi∥x).Step 3.
CalculateDIDiNew∥RNS′∥IDi′′∥RNi′=DAiPi.Step 4.
CalculateSK=h(RNS′∥Ai∥RNi′).The transmission of random numbersRNi, RNs uses symmetric encryption under key Ai. The confidentiality of random numbers is dependent on the authentication value Ai. Once the master key ofS is leaked, the attacker is able to compute Ai=h(IDi∥x) and obtain RNi, RNs by decrypting message {Pi}. Consequently, the session keys of the whole sever system are compromised.In the authentication scheme, random numbers are essential to establish unique session key in each session. If the user or server cannot transmit random number to the other side securely, it certainly will compromise the session key.


## 3.2.1. Inefficiency for Wrong Password Detection

In the login phase, the smart card never checks the validity of the entered password. IfUi inputs a wrong password by accident, the smart card cannot detect this fault, until a login request is sent toS, andS returns back a response to reject it. It wastes too much time of users.


## 3.2.2. Offline Password Guessing Attack

The adversaryA extracts {Bi,DIDi,EKey(·)/DKey(·),ri} from Ui’s smart card and intercepts {DIDi,Mi,Ti} from public channel. Offline password guessing is launched in the following steps.Step 1.
Choose an identityIDi∗ from the identity dictionary space and a password PW∗ from the password dictionary space.Step 2.
CalculateAi∗=Bi⊕h(ID∗∥ri∥PW∗), (IDi∗∗∥RNi∗∥Ti∗∥DIDi∗)=DAi∗Mi. Check DIDi∗≟DIDi, Ti∗≟Ti. If both the two equations hold, it shows that IDi∗ is Ui's real identity, and PW∗ is Ui's correct password.Step 3.
Repeat Steps 1-2, untilA find real IDi and PWi.


## 3.2.3. User Anonymity

For the message{DIDi,Mi,Ti}, IDi is compromised by performing offline password guessing attack; this is violation of user anonymity.Once the adversaryA gets {Bi,DIDi,EKey·/DKey(·),ri} and obtains IDi and PWi by performing offline password guessing attack and intercepts {DIDi,Mi,Ti}, {Pi}, and {Qi} from pubic channel, A performs user impersonation attack, server impersonation attack, man-in-the-middle attack, session key disclosure attack, and desynchronization attack as follows.


## 3.2.4. User Impersonation Attack

Step 1.
A computes Ai=Bi⊕h(IDi∥ri∥PWi).Step 2.
A computes Ma=EAi(IDi∥RNia∥Ta∥DIDi), where RNia is a nonce, and Ta is current timestamp. A sends {DIDi,Ma,Ta} toS.Step 3.
AfterS receiving {DIDi,Ma,Ta}, as Ta is fresh, DIDi′=DIDi, Ta′=Ta,S regards A as the legitimate user Ui and returns {Pa} to A.Step 4.
Upon receiving{Pa}, A computes DIDinew∥RNS′∥IDi′′∥RNia′=DAi(Pa), Qa=h(RNS′∥DIDinew∥RNia), SK=h(RNS′∥Ai∥RNia) and sends {Qa} toS.Step 5.
AfterS receiving {Qa}, as Qa′=Qa,S computes SK=h(RNS∥Ai′∥RNia′).
A establishes a session key SK withS successfully.


## 3.2.5. Server Impersonation Attack

Step 1.
ComputeAi=Bi⊕h(IDi∥ri∥PWi).Step 2.
Compute(IDi′∥RNi′∥Ti′∥DIDi′)=DAi(Mi).Step 3.
Intercept{Pi} from public channel. Generate a nonce RNSa and select a binary string DIDia whose length is the same as DIDi. Compute Pa=EAi(DIDia∥RNSa∥IDi∥RNi′) and return {Pa} to Ui.Step 4.
After receiving{Pa}, as RNi′=RNi,IDi′′=IDi, Ui regards A as the severS.


## 3.2.6. Man-in-the-Middle Attack

Step 1.
Intercept{DIDi,Mi,Ti} from public channel and send {DIDi,Ma,Ta} toS.Step 2.
Intercept{Pi} from public channel and send {Pa} to Ui.Step 3.
Intercept{Qi} from public channel and send {Qa} toS.


## 3.2.7. Session Key Disclosure Attack

Step 1.
CalculateAi=Bi⊕h(IDi∥ri∥PWi).Step 2.
CalculateDIDinew∥RNS′∥IDi′′∥RNi′=DAiPi.Step 3.
CalculateSK=h(RNS′∥Ai∥RNi′).


## 3.2.8. Desynchronization Attack

Step 1.
CalculateAi=Bi⊕h(IDi∥ri∥PWi).Step 2.
Intercept{Pi} from pubic channel. Compute DIDiNew∥RNS′∥IDi′′∥RNi′=DAiPi. Select a binary string DIDia whose length is same as DIDiNew. Compute Pa=EAi(DIDia∥RNS′∥IDi∥RNi′). Sends {Pa} to Ui.Step 3.
Intercept{Qi} from pubic channel. Compute Qa=h(RNS′∥DIDinew∥RNi′). Send Qa toS.After that,Ui cannot login S anymore, unless Ui re-register toS.


## 3.2.9. Forward Secrecy

SupposeA obtains the master key ofS and intercepts {DIDi,Mi,Ti} and {Pi} from public channel, and then A calculates the session key as follows.Step 1.
CalculateIDi=Dx(DIDi).Step 2.
CalculateAi=h(IDi∥x).Step 3.
CalculateDIDiNew∥RNS′∥IDi′′∥RNi′=DAiPi.Step 4.
CalculateSK=h(RNS′∥Ai∥RNi′).The transmission of random numbersRNi, RNs uses symmetric encryption under key Ai. The confidentiality of random numbers is dependent on the authentication value Ai. Once the master key ofS is leaked, the attacker is able to compute Ai=h(IDi∥x) and obtain RNi, RNs by decrypting message {Pi}. Consequently, the session keys of the whole sever system are compromised.In the authentication scheme, random numbers are essential to establish unique session key in each session. If the user or server cannot transmit random number to the other side securely, it certainly will compromise the session key.


## 4. Cryptanalysis of Two Authentication Schemes for Specific Environment

Recently, Mishra et al. presented an efficient authentication scheme for session initiation protocol. In addition, Hsieh et al. introduced an authentication scheme for wireless communication. However, after a rigorous analysis, we discover both the two schemes have vulnerabilities. We reveal the weaknesses of the two schemes in this section.


### 4.1. Review of Mishra Et Al.’s Scheme

We briefly review Mishra et al.’s scheme in this subsection. As the password and biometric update phase is irrelevant to our cryptanalysis, we omit it.


#### 4.1.1. Registration Phase

Step 1.
U i picks IDi, PWi at will and computes RPWi=h(IDi∥PWi∥r), where r is a nonce. Ui delivers {IDi,RPWi} to the serverS securely.Step 2.
Upon receiving{IDi,RPWi}, S computes Xi=h(mk∥IDi∥N), Yi=Xi⊕RPWi, where mk is the secret key ofS, and N is the number of times the user once registered withS.S sends a smart card storing {Yi,mkP} to Ui.Step 3.
U i imprints his biometric Bi. The smart card computes V=h(IDi∥PWi∥h(Bi)), R=h(Bi)⊕r, and stores V,R in its memory.


#### 4.1.2. Login and Authentication Phase

Step 1.
U i enters IDi∗,PWi∗ and imprints Bi∗. The smart card checks if V=h(IDi∗∥PWi∗∥h(Bi∗)). If it holds, the smart card calculates r=h(Bi∗)⊕R,RPWi=h(IDi∗∥PWi∗∥r),Xi=Yi⊕RPWi,D1=h(IDi∗∥Xi∥h(u∙mkPx)∥uPx∥T1),DIDi=h(u∙mkPx)⊕IDi∗,whereuis a nonce. The smart card delivers {DIDi,D1,uP,T1} toS.Step 2.
After receiving the message,S computes IDi=h(mk∙uPx)⊕DIDi, Xi=h(mk∥IDi∥N), D1′=h(IDi∥Xi∥h(mk∙uPx∥uPx∥T1) and checks if D1′=D1. If it holds,S calculates sk=h(IDi∥Xi∥mk∙uPx)∥T1∥T3), D2=h(sk∥T1∥T3∥mk∙uPx) and sends {D2,T3} to Ui.Step 3.
After receiving{D2,T3}, the smart card calculates sk=h(IDi∥Xi∥u∙mkPx∥T1∥T3), D2′=h(sk∥T1∥T3∥u∙mkPx). If D2′=D2, Ui regards he establishes a valid session key withS.


### 4.2. Weaknesses of Mishra Et Al.’s Scheme

#### 4.2.1. Forward Secrecy

In the case that the adversaryA obtains the secret key mk and intercepts the messages {DIDi,D1,uP,T1} and {D2,T3} from public channel, then A is able to breach the session key in the following steps.Step 1.
ComputeIDi=DIDi⊕h(mk∙uPx).Step 2.
LetN=0.Step 3.
ComputeXi=h(mk∥IDi∥N), D1′=h(IDi∥Xi∥h(mk∙uPx))∥uPx∥T1).Step 4.
Check ifD1′=D1. If they are equal, proceed next step. Otherwise, let N=N+1, and go to Step 3.Step 5.
Compute the session keysk=h(IDi∥Xi∥mk∙uPx)∥T1∥T3).


### 4.3. Review of Hsieh Et Al.’s Scheme

We briefly review Hsieh et al.’s scheme in this subsection. As the ticket authentication phase is irrelevant to our cryptanalysis, we omit it.


#### 4.3.1. Registration Phase

Step 1.
The mobile stationMS delivers {IDi,PWi} to the home agentHA securely.Step 2.
After receiving the registration request,HA computes z3=z1⊕y, A=h(IDi∥x)⊕y⊕z2, Di=IDi⊕h(IDHA∥x)⊕z1, z4=PWi⊕y⊕z2, where x,y are the secret values ofHA, and z1,z2 are two random numbers.HA issues a smart card storing {IDHA,z3,A,Di,z4} toMS.


#### 4.3.2. Ticket-Issuing Phase

Step 1.
MS computes R1=aP, z5=z3⊕N1, hIDi∥x=PWi⊕z4⊕A, B=hIDi∥x⊕R1, DIDi=Di⊕N1, where a,N1 are random numbers.MS sends {IDHA,z5,B,DIDi} to the foreign agentFA.Step 2.
After receiving the message,FA computes R2=bP, C=EkIDFA,T1,R2, wherek is a secret key shared byFA andHA.FA delivers {IDFA,z5,B,DIDi,C} toHA.Step 3.
After receiving the message,HA computes N1=z5⊕z1⊕y, IDi=h(IDHA∥x)⊕z1⊕N1, R1=h(IDi∥x)⊕B, (IDFA,T1,R2)=DkC, R3=cR1, R4=cR2, M1=h(h(IDi∥x)∥R1)⊕R4, M2=h(h(IDi∥x)∥R1∥R4), M3=h(h(IDi∥x)∥R1+1∥R4+1), F=EkT3,R3,M3.HA delivers {M1,M2,F} toFA.Step 4.
Upon receiving{M1,M2,F}, FA computes (T3,R3,M3)=DkF, SK=bR3, t=ESKticket. FA sends {M1,M2,t} to MS.Step 5.
Upon receiving{M1,M2,t},MS computes R4=h(h(IDi∥x)∥R1)⊕M1, M2′=h(h(IDi∥x)∥R1∥R4) and checks if M2′=M2. If it holds,MS calculates SK=aR4, ticket=DSKt, M3′=h(h(IDi∥x)∥R1+1∥R4+1), and sends {M3′} toFA.Step 6.
Upon receiving{M3′},FA checks if M3′=M3. If the equation holds,FA andMS authenticate each other and establish a session key successfully.


### 4.4. Weaknesses of Hsieh Et Al.’s Scheme

#### 4.4.1. Offline Password Guessing Attack

Suppose the adversaryA extracts {IDHA,z3,A,Di,z4} from the smart card and intercepts the messages {IDHA,z5,B,DIDi} and {M1,M2,t} from public channel. Then A performs the following steps.Step 1.
A picks a password PW∗ from the password dictionary space.Step 2.
A computes hIDi∥x∗=PW∗⊕z4⊕A, R1∗=hIDi∥x∗⊕B, R4∗=h(hIDi∥x∗∥R1∗)⊕M1, M2∗=h(hIDi∥x∗∥R1∗∥R4∗) and checks if M2∗=M2. If it holds, it shows that PW∗ is the correct password.Step 3.
Repeat Steps 1-2, untilA finds PWi.


#### 4.4.2. MS Impersonation Attack

In the case that smart card is compromised, the adversary is able to obtain the password via offline password guessing attack; that is to say, the adversary has acquired all the authentication information thatMS has. The capability of adversary has no differences with the legitimateMS. Hence, the adversary is able to impersonate MS and defraud FA and HA successfully.


#### 4.4.3. HA Impersonation Attack

A intercepts the message {IDHA,z5,B,DIDi} from public channel. With the smart card and PWi, A is able to perform HA impersonation attack in the following steps.Step 1.
A computes hIDi∥x=PWi⊕z4⊕A, R1=hIDi∥x⊕B, R4=dP, M1=h(h(IDi∥x)∥R1)⊕R4, M2=h(h(IDi∥x)∥R1∥R4), SK=dR1, t=ESKticket, where d is a random number. A sends {M1,M2,t} to MS.Step 2.
After receiving{M1,M2,t},MS computes R4=h(h(IDi∥x)∥R1)⊕M1, M2′=h(h(IDi∥x)∥R1∥R4). As M2′=M2,MS computes SK=aR4, ticket=DSKt.MS believes that it establishes a session key withHA.


## 4.1. Review of Mishra Et Al.’s Scheme

We briefly review Mishra et al.’s scheme in this subsection. As the password and biometric update phase is irrelevant to our cryptanalysis, we omit it.


### 4.1.1. Registration Phase

Step 1.
U i picks IDi, PWi at will and computes RPWi=h(IDi∥PWi∥r), where r is a nonce. Ui delivers {IDi,RPWi} to the serverS securely.Step 2.
Upon receiving{IDi,RPWi}, S computes Xi=h(mk∥IDi∥N), Yi=Xi⊕RPWi, where mk is the secret key ofS, and N is the number of times the user once registered withS.S sends a smart card storing {Yi,mkP} to Ui.Step 3.
U i imprints his biometric Bi. The smart card computes V=h(IDi∥PWi∥h(Bi)), R=h(Bi)⊕r, and stores V,R in its memory.


### 4.1.2. Login and Authentication Phase

Step 1.
U i enters IDi∗,PWi∗ and imprints Bi∗. The smart card checks if V=h(IDi∗∥PWi∗∥h(Bi∗)). If it holds, the smart card calculates r=h(Bi∗)⊕R,RPWi=h(IDi∗∥PWi∗∥r),Xi=Yi⊕RPWi,D1=h(IDi∗∥Xi∥h(u∙mkPx)∥uPx∥T1),DIDi=h(u∙mkPx)⊕IDi∗,whereuis a nonce. The smart card delivers {DIDi,D1,uP,T1} toS.Step 2.
After receiving the message,S computes IDi=h(mk∙uPx)⊕DIDi, Xi=h(mk∥IDi∥N), D1′=h(IDi∥Xi∥h(mk∙uPx∥uPx∥T1) and checks if D1′=D1. If it holds,S calculates sk=h(IDi∥Xi∥mk∙uPx)∥T1∥T3), D2=h(sk∥T1∥T3∥mk∙uPx) and sends {D2,T3} to Ui.Step 3.
After receiving{D2,T3}, the smart card calculates sk=h(IDi∥Xi∥u∙mkPx∥T1∥T3), D2′=h(sk∥T1∥T3∥u∙mkPx). If D2′=D2, Ui regards he establishes a valid session key withS.


## 4.1.1. Registration Phase

Step 1.
U i picks IDi, PWi at will and computes RPWi=h(IDi∥PWi∥r), where r is a nonce. Ui delivers {IDi,RPWi} to the serverS securely.Step 2.
Upon receiving{IDi,RPWi}, S computes Xi=h(mk∥IDi∥N), Yi=Xi⊕RPWi, where mk is the secret key ofS, and N is the number of times the user once registered withS.S sends a smart card storing {Yi,mkP} to Ui.Step 3.
U i imprints his biometric Bi. The smart card computes V=h(IDi∥PWi∥h(Bi)), R=h(Bi)⊕r, and stores V,R in its memory.


## 4.1.2. Login and Authentication Phase

Step 1.
U i enters IDi∗,PWi∗ and imprints Bi∗. The smart card checks if V=h(IDi∗∥PWi∗∥h(Bi∗)). If it holds, the smart card calculates r=h(Bi∗)⊕R,RPWi=h(IDi∗∥PWi∗∥r),Xi=Yi⊕RPWi,D1=h(IDi∗∥Xi∥h(u∙mkPx)∥uPx∥T1),DIDi=h(u∙mkPx)⊕IDi∗,whereuis a nonce. The smart card delivers {DIDi,D1,uP,T1} toS.Step 2.
After receiving the message,S computes IDi=h(mk∙uPx)⊕DIDi, Xi=h(mk∥IDi∥N), D1′=h(IDi∥Xi∥h(mk∙uPx∥uPx∥T1) and checks if D1′=D1. If it holds,S calculates sk=h(IDi∥Xi∥mk∙uPx)∥T1∥T3), D2=h(sk∥T1∥T3∥mk∙uPx) and sends {D2,T3} to Ui.Step 3.
After receiving{D2,T3}, the smart card calculates sk=h(IDi∥Xi∥u∙mkPx∥T1∥T3), D2′=h(sk∥T1∥T3∥u∙mkPx). If D2′=D2, Ui regards he establishes a valid session key withS.


## 4.2. Weaknesses of Mishra Et Al.’s Scheme

### 4.2.1. Forward Secrecy

In the case that the adversaryA obtains the secret key mk and intercepts the messages {DIDi,D1,uP,T1} and {D2,T3} from public channel, then A is able to breach the session key in the following steps.Step 1.
ComputeIDi=DIDi⊕h(mk∙uPx).Step 2.
LetN=0.Step 3.
ComputeXi=h(mk∥IDi∥N), D1′=h(IDi∥Xi∥h(mk∙uPx))∥uPx∥T1).Step 4.
Check ifD1′=D1. If they are equal, proceed next step. Otherwise, let N=N+1, and go to Step 3.Step 5.
Compute the session keysk=h(IDi∥Xi∥mk∙uPx)∥T1∥T3).


## 4.2.1. Forward Secrecy

In the case that the adversaryA obtains the secret key mk and intercepts the messages {DIDi,D1,uP,T1} and {D2,T3} from public channel, then A is able to breach the session key in the following steps.Step 1.
ComputeIDi=DIDi⊕h(mk∙uPx).Step 2.
LetN=0.Step 3.
ComputeXi=h(mk∥IDi∥N), D1′=h(IDi∥Xi∥h(mk∙uPx))∥uPx∥T1).Step 4.
Check ifD1′=D1. If they are equal, proceed next step. Otherwise, let N=N+1, and go to Step 3.Step 5.
Compute the session keysk=h(IDi∥Xi∥mk∙uPx)∥T1∥T3).


## 4.3. Review of Hsieh Et Al.’s Scheme

We briefly review Hsieh et al.’s scheme in this subsection. As the ticket authentication phase is irrelevant to our cryptanalysis, we omit it.


### 4.3.1. Registration Phase

Step 1.
The mobile stationMS delivers {IDi,PWi} to the home agentHA securely.Step 2.
After receiving the registration request,HA computes z3=z1⊕y, A=h(IDi∥x)⊕y⊕z2, Di=IDi⊕h(IDHA∥x)⊕z1, z4=PWi⊕y⊕z2, where x,y are the secret values ofHA, and z1,z2 are two random numbers.HA issues a smart card storing {IDHA,z3,A,Di,z4} toMS.


### 4.3.2. Ticket-Issuing Phase

Step 1.
MS computes R1=aP, z5=z3⊕N1, hIDi∥x=PWi⊕z4⊕A, B=hIDi∥x⊕R1, DIDi=Di⊕N1, where a,N1 are random numbers.MS sends {IDHA,z5,B,DIDi} to the foreign agentFA.Step 2.
After receiving the message,FA computes R2=bP, C=EkIDFA,T1,R2, wherek is a secret key shared byFA andHA.FA delivers {IDFA,z5,B,DIDi,C} toHA.Step 3.
After receiving the message,HA computes N1=z5⊕z1⊕y, IDi=h(IDHA∥x)⊕z1⊕N1, R1=h(IDi∥x)⊕B, (IDFA,T1,R2)=DkC, R3=cR1, R4=cR2, M1=h(h(IDi∥x)∥R1)⊕R4, M2=h(h(IDi∥x)∥R1∥R4), M3=h(h(IDi∥x)∥R1+1∥R4+1), F=EkT3,R3,M3.HA delivers {M1,M2,F} toFA.Step 4.
Upon receiving{M1,M2,F}, FA computes (T3,R3,M3)=DkF, SK=bR3, t=ESKticket. FA sends {M1,M2,t} to MS.Step 5.
Upon receiving{M1,M2,t},MS computes R4=h(h(IDi∥x)∥R1)⊕M1, M2′=h(h(IDi∥x)∥R1∥R4) and checks if M2′=M2. If it holds,MS calculates SK=aR4, ticket=DSKt, M3′=h(h(IDi∥x)∥R1+1∥R4+1), and sends {M3′} toFA.Step 6.
Upon receiving{M3′},FA checks if M3′=M3. If the equation holds,FA andMS authenticate each other and establish a session key successfully.


## 4.3.1. Registration Phase

Step 1.
The mobile stationMS delivers {IDi,PWi} to the home agentHA securely.Step 2.
After receiving the registration request,HA computes z3=z1⊕y, A=h(IDi∥x)⊕y⊕z2, Di=IDi⊕h(IDHA∥x)⊕z1, z4=PWi⊕y⊕z2, where x,y are the secret values ofHA, and z1,z2 are two random numbers.HA issues a smart card storing {IDHA,z3,A,Di,z4} toMS.


## 4.3.2. Ticket-Issuing Phase

Step 1.
MS computes R1=aP, z5=z3⊕N1, hIDi∥x=PWi⊕z4⊕A, B=hIDi∥x⊕R1, DIDi=Di⊕N1, where a,N1 are random numbers.MS sends {IDHA,z5,B,DIDi} to the foreign agentFA.Step 2.
After receiving the message,FA computes R2=bP, C=EkIDFA,T1,R2, wherek is a secret key shared byFA andHA.FA delivers {IDFA,z5,B,DIDi,C} toHA.Step 3.
After receiving the message,HA computes N1=z5⊕z1⊕y, IDi=h(IDHA∥x)⊕z1⊕N1, R1=h(IDi∥x)⊕B, (IDFA,T1,R2)=DkC, R3=cR1, R4=cR2, M1=h(h(IDi∥x)∥R1)⊕R4, M2=h(h(IDi∥x)∥R1∥R4), M3=h(h(IDi∥x)∥R1+1∥R4+1), F=EkT3,R3,M3.HA delivers {M1,M2,F} toFA.Step 4.
Upon receiving{M1,M2,F}, FA computes (T3,R3,M3)=DkF, SK=bR3, t=ESKticket. FA sends {M1,M2,t} to MS.Step 5.
Upon receiving{M1,M2,t},MS computes R4=h(h(IDi∥x)∥R1)⊕M1, M2′=h(h(IDi∥x)∥R1∥R4) and checks if M2′=M2. If it holds,MS calculates SK=aR4, ticket=DSKt, M3′=h(h(IDi∥x)∥R1+1∥R4+1), and sends {M3′} toFA.Step 6.
Upon receiving{M3′},FA checks if M3′=M3. If the equation holds,FA andMS authenticate each other and establish a session key successfully.


## 4.4. Weaknesses of Hsieh Et Al.’s Scheme

### 4.4.1. Offline Password Guessing Attack

Suppose the adversaryA extracts {IDHA,z3,A,Di,z4} from the smart card and intercepts the messages {IDHA,z5,B,DIDi} and {M1,M2,t} from public channel. Then A performs the following steps.Step 1.
A picks a password PW∗ from the password dictionary space.Step 2.
A computes hIDi∥x∗=PW∗⊕z4⊕A, R1∗=hIDi∥x∗⊕B, R4∗=h(hIDi∥x∗∥R1∗)⊕M1, M2∗=h(hIDi∥x∗∥R1∗∥R4∗) and checks if M2∗=M2. If it holds, it shows that PW∗ is the correct password.Step 3.
Repeat Steps 1-2, untilA finds PWi.


### 4.4.2. MS Impersonation Attack

In the case that smart card is compromised, the adversary is able to obtain the password via offline password guessing attack; that is to say, the adversary has acquired all the authentication information thatMS has. The capability of adversary has no differences with the legitimateMS. Hence, the adversary is able to impersonate MS and defraud FA and HA successfully.


### 4.4.3. HA Impersonation Attack

A intercepts the message {IDHA,z5,B,DIDi} from public channel. With the smart card and PWi, A is able to perform HA impersonation attack in the following steps.Step 1.
A computes hIDi∥x=PWi⊕z4⊕A, R1=hIDi∥x⊕B, R4=dP, M1=h(h(IDi∥x)∥R1)⊕R4, M2=h(h(IDi∥x)∥R1∥R4), SK=dR1, t=ESKticket, where d is a random number. A sends {M1,M2,t} to MS.Step 2.
After receiving{M1,M2,t},MS computes R4=h(h(IDi∥x)∥R1)⊕M1, M2′=h(h(IDi∥x)∥R1∥R4). As M2′=M2,MS computes SK=aR4, ticket=DSKt.MS believes that it establishes a session key withHA.


## 4.4.1. Offline Password Guessing Attack

Suppose the adversaryA extracts {IDHA,z3,A,Di,z4} from the smart card and intercepts the messages {IDHA,z5,B,DIDi} and {M1,M2,t} from public channel. Then A performs the following steps.Step 1.
A picks a password PW∗ from the password dictionary space.Step 2.
A computes hIDi∥x∗=PW∗⊕z4⊕A, R1∗=hIDi∥x∗⊕B, R4∗=h(hIDi∥x∗∥R1∗)⊕M1, M2∗=h(hIDi∥x∗∥R1∗∥R4∗) and checks if M2∗=M2. If it holds, it shows that PW∗ is the correct password.Step 3.
Repeat Steps 1-2, untilA finds PWi.


## 4.4.2. MS Impersonation Attack

In the case that smart card is compromised, the adversary is able to obtain the password via offline password guessing attack; that is to say, the adversary has acquired all the authentication information thatMS has. The capability of adversary has no differences with the legitimateMS. Hence, the adversary is able to impersonate MS and defraud FA and HA successfully.


## 4.4.3. HA Impersonation Attack

A intercepts the message {IDHA,z5,B,DIDi} from public channel. With the smart card and PWi, A is able to perform HA impersonation attack in the following steps.Step 1.
A computes hIDi∥x=PWi⊕z4⊕A, R1=hIDi∥x⊕B, R4=dP, M1=h(h(IDi∥x)∥R1)⊕R4, M2=h(h(IDi∥x)∥R1∥R4), SK=dR1, t=ESKticket, where d is a random number. A sends {M1,M2,t} to MS.Step 2.
After receiving{M1,M2,t},MS computes R4=h(h(IDi∥x)∥R1)⊕M1, M2′=h(h(IDi∥x)∥R1∥R4). As M2′=M2,MS computes SK=aR4, ticket=DSKt.MS believes that it establishes a session key withHA.


## 5. Proposed Scheme

To overcome the weaknesses of Amin et al.’s scheme and Nikooghadam et al.’s scheme, we propose an improved anonymous authentication protocol using ECC. The proposed scheme establishes secure session key based on Diffie-Hellman key exchange. Our scheme consists of the following four phases (see Figure3).Figure 3
The proposed scheme.


### 5.1. Initialization Phase

S chooses an elliptic curve group Ep. P is a generator of Ep. Then,S chooses a random numberx as its private key and calculates Ppub=xP as its public key.S publishes {Ep,P,Ppub} and keepsx as secret.


### 5.2. Registration Phase

In this phase, when receiving a registration request,S issues a smart card containing the parameters for user authentication to Ui.Step 1.
U i picks IDi and PWi freely. Ui calculates Pi=h(PWi⊕ri), where ri is a random number. Afterwards, {IDi,Pi} is transmitted toS via a secure channel.Step 2.
After receiving{IDi,Pi}, S calculates Ai=h(x∥IDi), Bi=Ai⊕Pi, Vi=hPi∥IDimodn, where 24≤n≪28. S stores {Bi,Vi,EKey·,Ep,P,Ppub,n} in a smart card and transmits it to Ui through a secure communication channel.Step 3.
U i stores ri in the smart card.


### 5.3. Login and Authentication Phase

This phase verifies the authenticity of communicating parties and generates a session key.Step 1.
U i attaches his smart card to a terminal and inputs IDi∗ and PWi∗. Then the smart card calculates Pi∗=h(PWi∗⊕ri), Vi∗=hPi∗∥IDi∗modn, and checks Vi∗≟Vi. If the equation holds, the smart card computes Ri=N1P, Ci=h(N1PPUB), Ai∗=Bi⊕Pi∗, Di=hAi∗⊕Ri, Li=ECi(IDi∗∥Di), where N1 is a random number. {Li,Ri} is transmitted toS.Step 2.
After receiving{Li,Ri},S computes Ci′=h(xRi), IDi′∥Di′=DCi′(Li), Ai′=h(x∥IDi′), Di′′=h(Ai′)⊕Ri, and checks Di′′≟Di′. If the equation holds,S generates a random number N2 and computes Zi=N2P, Ki=N2∙Ri, SK=h(Ki∥Ai′), Xi=h(Zi∥Di′′∥SK). {Zi,Xi} is transmitted to Ui.Step 3.
After receiving{Zi,Xi}, Ui computes Ki′=N1∙Zi,SK=hKi′∥Ai∗, Xi′=h(Zi∥Di∥SK), and checks Xi′≟Xi. If the equation holds,S computes Ei=h(Di∥Ki′∥SK). {Ei} is transmitted toS.Step 4.
After receiving{Ei},Scomputes Ei′=h(Di′′∥Ki∥SK) and checks Ei′≟Ei. If the equation holds,S establishes a session key with Ui successfully.


### 5.4. Password Updates Phase

U i updates his original password to a new one as follows.Step 1.
U i attaches his smart card to a terminal and inputs IDi∗ and PWi∗. The smart card calculates Pi∗=h(PWi∗⊕ri), Vi∗=hPi∗∥IDi∗modn, and checks Vi∗≟Vi. If it holds, the smart card asks the user to input a new password.Step 2.
U i enters his new password PWinew. Then the smart card calculates Binew=Bi⊕Pi∗⊕h(PWinew⊕ri), Vinew=h(h(PWinew⊕ri)∥IDi∗)modn. The smart card deletes Bi,Vi and stores Binew,Vinew in its memory.


## 5.1. Initialization Phase

S chooses an elliptic curve group Ep. P is a generator of Ep. Then,S chooses a random numberx as its private key and calculates Ppub=xP as its public key.S publishes {Ep,P,Ppub} and keepsx as secret.


## 5.2. Registration Phase

In this phase, when receiving a registration request,S issues a smart card containing the parameters for user authentication to Ui.Step 1.
U i picks IDi and PWi freely. Ui calculates Pi=h(PWi⊕ri), where ri is a random number. Afterwards, {IDi,Pi} is transmitted toS via a secure channel.Step 2.
After receiving{IDi,Pi}, S calculates Ai=h(x∥IDi), Bi=Ai⊕Pi, Vi=hPi∥IDimodn, where 24≤n≪28. S stores {Bi,Vi,EKey·,Ep,P,Ppub,n} in a smart card and transmits it to Ui through a secure communication channel.Step 3.
U i stores ri in the smart card.


## 5.3. Login and Authentication Phase

This phase verifies the authenticity of communicating parties and generates a session key.Step 1.
U i attaches his smart card to a terminal and inputs IDi∗ and PWi∗. Then the smart card calculates Pi∗=h(PWi∗⊕ri), Vi∗=hPi∗∥IDi∗modn, and checks Vi∗≟Vi. If the equation holds, the smart card computes Ri=N1P, Ci=h(N1PPUB), Ai∗=Bi⊕Pi∗, Di=hAi∗⊕Ri, Li=ECi(IDi∗∥Di), where N1 is a random number. {Li,Ri} is transmitted toS.Step 2.
After receiving{Li,Ri},S computes Ci′=h(xRi), IDi′∥Di′=DCi′(Li), Ai′=h(x∥IDi′), Di′′=h(Ai′)⊕Ri, and checks Di′′≟Di′. If the equation holds,S generates a random number N2 and computes Zi=N2P, Ki=N2∙Ri, SK=h(Ki∥Ai′), Xi=h(Zi∥Di′′∥SK). {Zi,Xi} is transmitted to Ui.Step 3.
After receiving{Zi,Xi}, Ui computes Ki′=N1∙Zi,SK=hKi′∥Ai∗, Xi′=h(Zi∥Di∥SK), and checks Xi′≟Xi. If the equation holds,S computes Ei=h(Di∥Ki′∥SK). {Ei} is transmitted toS.Step 4.
After receiving{Ei},Scomputes Ei′=h(Di′′∥Ki∥SK) and checks Ei′≟Ei. If the equation holds,S establishes a session key with Ui successfully.


## 5.4. Password Updates Phase

U i updates his original password to a new one as follows.Step 1.
U i attaches his smart card to a terminal and inputs IDi∗ and PWi∗. The smart card calculates Pi∗=h(PWi∗⊕ri), Vi∗=hPi∗∥IDi∗modn, and checks Vi∗≟Vi. If it holds, the smart card asks the user to input a new password.Step 2.
U i enters his new password PWinew. Then the smart card calculates Binew=Bi⊕Pi∗⊕h(PWinew⊕ri), Vinew=h(h(PWinew⊕ri)∥IDi∗)modn. The smart card deletes Bi,Vi and stores Binew,Vinew in its memory.


## 6. Security Analysis

### 6.1. Informal Analysis

The heuristic analysis shows that our scheme can withstand various known attacks.


#### 6.1.1. Offline Password Guessing Attack

Suppose that the adversaryA steals the smart card of Ui and extracts {Bi,Vi,EKey·,Ep,P,Ppub,n,ri} from it; then A executes the following steps.Step 1.
Choose an identityIDi∗ from identity dictionary space and a password PWi∗ from password dictionary space.Step 2.
ComputePi∗=h(PWi∗⊕ri), Vi∗=h(Pi∗∥IDi∗)modn.Step 3.
CheckVi∗≟Vi.In our scheme, we employ the verification valueVi∗=h(Pi∗∥IDi∗)modn. When n=28 and the identity and password are 64 bits, there are (264∗264)/28 pairs of <IDi∗,PWi∗> conforming to Vi∗=Vi. Even if A finds a pair of <IDi∗,PWi∗> that conforms to Vi∗=Vi, the probability they are equal to the identity and password of Ui is 28/(264∗264).Our scheme overcomes the offline password guessing attack at a cost of false acceptance rate of1/28. But it does not compromise the security. When the server receives a login request message generated with erroneous <IDi∗,PWi∗>, as Di′′≠Di′, the server rejects the login request.


#### 6.1.2. Replay Attack

Suppose that the adversaryA tries to launch replay attack in the following cases.In the case that the adversaryA intercepts {Li,Ri} from public channel and replays the message toS,S handles the message and returns {Zi,Xi} to A. However, without N1 and Ai, A is unable to generate a valid {Ei}. The protocol finally aborts.In the case thatA replays message {Zi,Xi} or {Ei}. Both the two messages are generated based on the random numbers N1 and N2. The random numbers are only valid for the current session. If A replays {Zi,Xi}, the smart card will find that the received Xi is not equal with Xi′ computed based on its secret. Similarly, if A replays {Ei},S will find that Ei≠Ei′. The protocol finally aborts.


#### 6.1.3. Desynchronization Attack

Desynchronization attack denotes that the adversary modifies the parameters of a message or simply blocks the message causing that the legitimate user cannot access the server anymore.In our scheme, all the messages are generated based on the authentication valueAi and the random number N1 or N2. The user and the server check the validity of each message they receive. If the adversary A modifies the parameters of a message, the receiver will detect the message is tampered with and reject it. Besides, if A blocks a message, it just leads to the single authentication failure for the current session, but it does not alter the parameters that the user and the server have. The user is able to continue to access the server.


#### 6.1.4. User Anonymity

In our scheme,IDi is protected by symmetric encryption under the key Ci. The adversary A cannot retrieve IDi, unless he gets the private key ofS.Furthermore, the cipher text of IDi changes with random number N1 in each session. Our scheme also achieves user identity untraceability.


#### 6.1.5. User Impersonation Attack

A extracts {Bi,Vi,EKey·,Ep,P,Ppub,n,ri} from the stolen smart card and intercepts the transmitted messages between Ui andSfrom public channel. Then A tries to forge a login request {Li,Ri} to defraudS. A generates a random number Na and computes Ri=N1P, Ci=N1PPUB. To compute Li, Ai is required. However, Ai is protected by hash function. The only way to obtain Ai is to retrieve Ai from Bi. As Ai∗=Bi⊕Pi∗, Pi∗=h(PWi∗⊕ri), the adversary needs to get PWi firstly. But as analyzed in “offline password guessing attack”, the adversary is unable to get PWi in the case that smart card is compromised. Eventually, the adversary cannot forge a valid login request. Our scheme is immune to user impersonation attack.


#### 6.1.6. Server Impersonation Attack

Provided thatA gets {Bi,Vi,EKey·,Ep,P,Ppub,n,ri} and the transmitted messages between Ui andS,A tries to impersonate the server by forging a valid message {Zi,Xi}, where Zi=N2P, Xi=h(Zi∥Di∥SK), Di=h(Ai)⊕Ri, SK=h(Ki∥Ai). In order to compute Xi, the adversary has to know Ai. As analyzed in “user impersonation attack”, the adversary is unable to obtain Ai, even if he compromises the smart card. Without Ai, the adversary is unable to perform server impersonation attack successfully.


#### 6.1.7. Forward Secrecy

Assuming the adversaryA obtains the private key ofS and intercepts {Li,Ri,Ti}, {Xi,Zi}, {Ei} from public channel. Then A tries to compute the session key. As SK=h(Ki∥Ai), Ki and Ai are required to compute SK. With the private keyx, the adversary computes Ci′=xRi, IDi′∥Di′=DCi′(Li), Ai=h(IDi∥x). Ai is known. Next, to obtain Ki, A needs to derive Ki(N1N2P) from Ri(N1P), Zi(N2P). That is to say, A needs to solve the elliptic curve Diffie–Hellman problem (CDHP). Otherwise, the adversary A is unable to revealSK. Hence, our scheme achieves forward secrecy.


#### 6.1.8. Session Key Disclosure Attack

A intercepts the transmitted messages between Ui andSfrom public channel. Then A attempts to compromiseSK. Ai and Ki are required to computeSK. To get Ai, A needs to break the smart card and password of user at the same time.To get Ki, A needs to solve the elliptic curve CDHP. Both are beyond the ability of A. Our scheme is secure against session key disclosure attack.In our scheme, the session key includes a long-term authentication value and a temporary secret key generated by Diffie-Hellman key exchange. The long-term authentication value denotes the shared secret authentication information betweenSand Ui. The temporary secret key ensures that our scheme is resistant to known key attack and achieves forward secrecy.


### 6.2. Formal Analysis

We use BAN logic [38] to prove our scheme achieves mutual authentication and session key establishment. Table 2 gives the symbols and rules used in BAN logic.Table 2
The notations and rules of BAN logic.
P , Q A principal  X A statement  P | ≡ X P believes X is true  P ⊲ X P see X, P receives a message that includes X  P | ∼ X P said X, P once sent a message containing X  P ⇒ X P has jurisdiction overX  # ( X ) Xis fresh  P ↔ K Q PandQhave a shared keyK  < X > K Xis combined with a secretK  Message meaning rule P | ≡ P ↔ K Q , P ⊲ < X > K P | ≡ Q | ∼ X  nonce-verification rule P | ≡ # ( X ) , P | ≡ Q | ∼ X P | ≡ Q | ≡ X  jurisdiction rule P | ≡ Q ⇒ X , P | ≡ Q | ≡ X P | ≡ XThe goals that our scheme should achieve are as follows.Goal 1:Ui|≡S|≡(S↔SKUi)Goal 2:Ui|≡(S↔SKUi)Goal 3:S|≡Ui|≡(S↔SKUi)Goal 4:S|≡(S↔SKUi)The idealized form of our scheme is given as follows.M1:Ui→S<N1P,S↔CiUi>AiM2:S→Ui<N2P,S↔SKUi>AiM3:Ui→S<N2∙Ri,S↔SKUi>AiThe assumptions about the initial belief of our scheme are given as follows.S1:S|≡(S↔AiUi)S2:S|≡#(N1)S3:S|≡Ui⇒(S↔CiUi)S4:Ui|≡(S↔AiUi)S5:Ui|≡#(N1)S6:Ui|≡S⇒(S↔SKUi)S7:S|≡#(N2)S8:S|≡Ui⇒(S↔SKUi)The BAN logic proof of our scheme is performed in the following steps.According to M1, we have(1)
S⊲<N1P,S↔CiUi>AiApplying the message-meaning rule on S1, (1), we obtain(2)
S|≡Ui|~(N1P,S↔CiUi)Applying the nonce-verification rule on S2, (2), we obtain(3)
S|≡Ui|≡(S↔CiUi)Applying the jurisdiction rule on S3, (3), we obtain(4)
S|≡(S↔CiUi)According to M2, we have(5)
Ui⊲<N2P,S↔SKUi>AiApplying the message-meaning rule on S4, (5), we obtain(6)
Ui|≡S|~<N2P,S↔SKUi>AiApplying the nonce-verification rule on S5, (6), we obtain(7)
Ui|≡S|≡(S↔SKUi))Goal 1Applying the jurisdiction rule to S6, (7), we obtain(8)
Ui|≡(S↔SKUi)Goal 2According to M3, we have(9)
S⊲<N2∙Ri,S↔SKUi>AiApplying the message-meaning rule on S1, (9), we obtain(10)
S|≡Ui|~(N2∙Ri,S↔SKUi)Applying the nonce-verification rule on S7, (10), we obtain(11)
S|≡Ui|≡(S↔SKUi)Goal 3Applying the jurisdiction rule to S8, (11), we obtain(12)
S|≡(S↔SKUi)Goal 4


## 6.1. Informal Analysis

The heuristic analysis shows that our scheme can withstand various known attacks.


### 6.1.1. Offline Password Guessing Attack

Suppose that the adversaryA steals the smart card of Ui and extracts {Bi,Vi,EKey·,Ep,P,Ppub,n,ri} from it; then A executes the following steps.Step 1.
Choose an identityIDi∗ from identity dictionary space and a password PWi∗ from password dictionary space.Step 2.
ComputePi∗=h(PWi∗⊕ri), Vi∗=h(Pi∗∥IDi∗)modn.Step 3.
CheckVi∗≟Vi.In our scheme, we employ the verification valueVi∗=h(Pi∗∥IDi∗)modn. When n=28 and the identity and password are 64 bits, there are (264∗264)/28 pairs of <IDi∗,PWi∗> conforming to Vi∗=Vi. Even if A finds a pair of <IDi∗,PWi∗> that conforms to Vi∗=Vi, the probability they are equal to the identity and password of Ui is 28/(264∗264).Our scheme overcomes the offline password guessing attack at a cost of false acceptance rate of1/28. But it does not compromise the security. When the server receives a login request message generated with erroneous <IDi∗,PWi∗>, as Di′′≠Di′, the server rejects the login request.


### 6.1.2. Replay Attack

Suppose that the adversaryA tries to launch replay attack in the following cases.In the case that the adversaryA intercepts {Li,Ri} from public channel and replays the message toS,S handles the message and returns {Zi,Xi} to A. However, without N1 and Ai, A is unable to generate a valid {Ei}. The protocol finally aborts.In the case thatA replays message {Zi,Xi} or {Ei}. Both the two messages are generated based on the random numbers N1 and N2. The random numbers are only valid for the current session. If A replays {Zi,Xi}, the smart card will find that the received Xi is not equal with Xi′ computed based on its secret. Similarly, if A replays {Ei},S will find that Ei≠Ei′. The protocol finally aborts.


### 6.1.3. Desynchronization Attack

Desynchronization attack denotes that the adversary modifies the parameters of a message or simply blocks the message causing that the legitimate user cannot access the server anymore.In our scheme, all the messages are generated based on the authentication valueAi and the random number N1 or N2. The user and the server check the validity of each message they receive. If the adversary A modifies the parameters of a message, the receiver will detect the message is tampered with and reject it. Besides, if A blocks a message, it just leads to the single authentication failure for the current session, but it does not alter the parameters that the user and the server have. The user is able to continue to access the server.


### 6.1.4. User Anonymity

In our scheme,IDi is protected by symmetric encryption under the key Ci. The adversary A cannot retrieve IDi, unless he gets the private key ofS.Furthermore, the cipher text of IDi changes with random number N1 in each session. Our scheme also achieves user identity untraceability.


### 6.1.5. User Impersonation Attack

A extracts {Bi,Vi,EKey·,Ep,P,Ppub,n,ri} from the stolen smart card and intercepts the transmitted messages between Ui andSfrom public channel. Then A tries to forge a login request {Li,Ri} to defraudS. A generates a random number Na and computes Ri=N1P, Ci=N1PPUB. To compute Li, Ai is required. However, Ai is protected by hash function. The only way to obtain Ai is to retrieve Ai from Bi. As Ai∗=Bi⊕Pi∗, Pi∗=h(PWi∗⊕ri), the adversary needs to get PWi firstly. But as analyzed in “offline password guessing attack”, the adversary is unable to get PWi in the case that smart card is compromised. Eventually, the adversary cannot forge a valid login request. Our scheme is immune to user impersonation attack.


### 6.1.6. Server Impersonation Attack

Provided thatA gets {Bi,Vi,EKey·,Ep,P,Ppub,n,ri} and the transmitted messages between Ui andS,A tries to impersonate the server by forging a valid message {Zi,Xi}, where Zi=N2P, Xi=h(Zi∥Di∥SK), Di=h(Ai)⊕Ri, SK=h(Ki∥Ai). In order to compute Xi, the adversary has to know Ai. As analyzed in “user impersonation attack”, the adversary is unable to obtain Ai, even if he compromises the smart card. Without Ai, the adversary is unable to perform server impersonation attack successfully.


### 6.1.7. Forward Secrecy

Assuming the adversaryA obtains the private key ofS and intercepts {Li,Ri,Ti}, {Xi,Zi}, {Ei} from public channel. Then A tries to compute the session key. As SK=h(Ki∥Ai), Ki and Ai are required to compute SK. With the private keyx, the adversary computes Ci′=xRi, IDi′∥Di′=DCi′(Li), Ai=h(IDi∥x). Ai is known. Next, to obtain Ki, A needs to derive Ki(N1N2P) from Ri(N1P), Zi(N2P). That is to say, A needs to solve the elliptic curve Diffie–Hellman problem (CDHP). Otherwise, the adversary A is unable to revealSK. Hence, our scheme achieves forward secrecy.


### 6.1.8. Session Key Disclosure Attack

A intercepts the transmitted messages between Ui andSfrom public channel. Then A attempts to compromiseSK. Ai and Ki are required to computeSK. To get Ai, A needs to break the smart card and password of user at the same time.To get Ki, A needs to solve the elliptic curve CDHP. Both are beyond the ability of A. Our scheme is secure against session key disclosure attack.In our scheme, the session key includes a long-term authentication value and a temporary secret key generated by Diffie-Hellman key exchange. The long-term authentication value denotes the shared secret authentication information betweenSand Ui. The temporary secret key ensures that our scheme is resistant to known key attack and achieves forward secrecy.


## 6.1.1. Offline Password Guessing Attack

Suppose that the adversaryA steals the smart card of Ui and extracts {Bi,Vi,EKey·,Ep,P,Ppub,n,ri} from it; then A executes the following steps.Step 1.
Choose an identityIDi∗ from identity dictionary space and a password PWi∗ from password dictionary space.Step 2.
ComputePi∗=h(PWi∗⊕ri), Vi∗=h(Pi∗∥IDi∗)modn.Step 3.
CheckVi∗≟Vi.In our scheme, we employ the verification valueVi∗=h(Pi∗∥IDi∗)modn. When n=28 and the identity and password are 64 bits, there are (264∗264)/28 pairs of <IDi∗,PWi∗> conforming to Vi∗=Vi. Even if A finds a pair of <IDi∗,PWi∗> that conforms to Vi∗=Vi, the probability they are equal to the identity and password of Ui is 28/(264∗264).Our scheme overcomes the offline password guessing attack at a cost of false acceptance rate of1/28. But it does not compromise the security. When the server receives a login request message generated with erroneous <IDi∗,PWi∗>, as Di′′≠Di′, the server rejects the login request.


## 6.1.2. Replay Attack

Suppose that the adversaryA tries to launch replay attack in the following cases.In the case that the adversaryA intercepts {Li,Ri} from public channel and replays the message toS,S handles the message and returns {Zi,Xi} to A. However, without N1 and Ai, A is unable to generate a valid {Ei}. The protocol finally aborts.In the case thatA replays message {Zi,Xi} or {Ei}. Both the two messages are generated based on the random numbers N1 and N2. The random numbers are only valid for the current session. If A replays {Zi,Xi}, the smart card will find that the received Xi is not equal with Xi′ computed based on its secret. Similarly, if A replays {Ei},S will find that Ei≠Ei′. The protocol finally aborts.


## 6.1.3. Desynchronization Attack

Desynchronization attack denotes that the adversary modifies the parameters of a message or simply blocks the message causing that the legitimate user cannot access the server anymore.In our scheme, all the messages are generated based on the authentication valueAi and the random number N1 or N2. The user and the server check the validity of each message they receive. If the adversary A modifies the parameters of a message, the receiver will detect the message is tampered with and reject it. Besides, if A blocks a message, it just leads to the single authentication failure for the current session, but it does not alter the parameters that the user and the server have. The user is able to continue to access the server.


## 6.1.4. User Anonymity

In our scheme,IDi is protected by symmetric encryption under the key Ci. The adversary A cannot retrieve IDi, unless he gets the private key ofS.Furthermore, the cipher text of IDi changes with random number N1 in each session. Our scheme also achieves user identity untraceability.


## 6.1.5. User Impersonation Attack

A extracts {Bi,Vi,EKey·,Ep,P,Ppub,n,ri} from the stolen smart card and intercepts the transmitted messages between Ui andSfrom public channel. Then A tries to forge a login request {Li,Ri} to defraudS. A generates a random number Na and computes Ri=N1P, Ci=N1PPUB. To compute Li, Ai is required. However, Ai is protected by hash function. The only way to obtain Ai is to retrieve Ai from Bi. As Ai∗=Bi⊕Pi∗, Pi∗=h(PWi∗⊕ri), the adversary needs to get PWi firstly. But as analyzed in “offline password guessing attack”, the adversary is unable to get PWi in the case that smart card is compromised. Eventually, the adversary cannot forge a valid login request. Our scheme is immune to user impersonation attack.


## 6.1.6. Server Impersonation Attack

Provided thatA gets {Bi,Vi,EKey·,Ep,P,Ppub,n,ri} and the transmitted messages between Ui andS,A tries to impersonate the server by forging a valid message {Zi,Xi}, where Zi=N2P, Xi=h(Zi∥Di∥SK), Di=h(Ai)⊕Ri, SK=h(Ki∥Ai). In order to compute Xi, the adversary has to know Ai. As analyzed in “user impersonation attack”, the adversary is unable to obtain Ai, even if he compromises the smart card. Without Ai, the adversary is unable to perform server impersonation attack successfully.


## 6.1.7. Forward Secrecy

Assuming the adversaryA obtains the private key ofS and intercepts {Li,Ri,Ti}, {Xi,Zi}, {Ei} from public channel. Then A tries to compute the session key. As SK=h(Ki∥Ai), Ki and Ai are required to compute SK. With the private keyx, the adversary computes Ci′=xRi, IDi′∥Di′=DCi′(Li), Ai=h(IDi∥x). Ai is known. Next, to obtain Ki, A needs to derive Ki(N1N2P) from Ri(N1P), Zi(N2P). That is to say, A needs to solve the elliptic curve Diffie–Hellman problem (CDHP). Otherwise, the adversary A is unable to revealSK. Hence, our scheme achieves forward secrecy.


## 6.1.8. Session Key Disclosure Attack

A intercepts the transmitted messages between Ui andSfrom public channel. Then A attempts to compromiseSK. Ai and Ki are required to computeSK. To get Ai, A needs to break the smart card and password of user at the same time.To get Ki, A needs to solve the elliptic curve CDHP. Both are beyond the ability of A. Our scheme is secure against session key disclosure attack.In our scheme, the session key includes a long-term authentication value and a temporary secret key generated by Diffie-Hellman key exchange. The long-term authentication value denotes the shared secret authentication information betweenSand Ui. The temporary secret key ensures that our scheme is resistant to known key attack and achieves forward secrecy.


## 6.2. Formal Analysis

We use BAN logic [38] to prove our scheme achieves mutual authentication and session key establishment. Table 2 gives the symbols and rules used in BAN logic.Table 2
The notations and rules of BAN logic.
P , Q A principal  X A statement  P | ≡ X P believes X is true  P ⊲ X P see X, P receives a message that includes X  P | ∼ X P said X, P once sent a message containing X  P ⇒ X P has jurisdiction overX  # ( X ) Xis fresh  P ↔ K Q PandQhave a shared keyK  < X > K Xis combined with a secretK  Message meaning rule P | ≡ P ↔ K Q , P ⊲ < X > K P | ≡ Q | ∼ X  nonce-verification rule P | ≡ # ( X ) , P | ≡ Q | ∼ X P | ≡ Q | ≡ X  jurisdiction rule P | ≡ Q ⇒ X , P | ≡ Q | ≡ X P | ≡ XThe goals that our scheme should achieve are as follows.Goal 1:Ui|≡S|≡(S↔SKUi)Goal 2:Ui|≡(S↔SKUi)Goal 3:S|≡Ui|≡(S↔SKUi)Goal 4:S|≡(S↔SKUi)The idealized form of our scheme is given as follows.M1:Ui→S<N1P,S↔CiUi>AiM2:S→Ui<N2P,S↔SKUi>AiM3:Ui→S<N2∙Ri,S↔SKUi>AiThe assumptions about the initial belief of our scheme are given as follows.S1:S|≡(S↔AiUi)S2:S|≡#(N1)S3:S|≡Ui⇒(S↔CiUi)S4:Ui|≡(S↔AiUi)S5:Ui|≡#(N1)S6:Ui|≡S⇒(S↔SKUi)S7:S|≡#(N2)S8:S|≡Ui⇒(S↔SKUi)The BAN logic proof of our scheme is performed in the following steps.According to M1, we have(1)
S⊲<N1P,S↔CiUi>AiApplying the message-meaning rule on S1, (1), we obtain(2)
S|≡Ui|~(N1P,S↔CiUi)Applying the nonce-verification rule on S2, (2), we obtain(3)
S|≡Ui|≡(S↔CiUi)Applying the jurisdiction rule on S3, (3), we obtain(4)
S|≡(S↔CiUi)According to M2, we have(5)
Ui⊲<N2P,S↔SKUi>AiApplying the message-meaning rule on S4, (5), we obtain(6)
Ui|≡S|~<N2P,S↔SKUi>AiApplying the nonce-verification rule on S5, (6), we obtain(7)
Ui|≡S|≡(S↔SKUi))Goal 1Applying the jurisdiction rule to S6, (7), we obtain(8)
Ui|≡(S↔SKUi)Goal 2According to M3, we have(9)
S⊲<N2∙Ri,S↔SKUi>AiApplying the message-meaning rule on S1, (9), we obtain(10)
S|≡Ui|~(N2∙Ri,S↔SKUi)Applying the nonce-verification rule on S7, (10), we obtain(11)
S|≡Ui|≡(S↔SKUi)Goal 3Applying the jurisdiction rule to S8, (11), we obtain(12)
S|≡(S↔SKUi)Goal 4


## 7. Security and Performance Comparison

We compare the proposed scheme with other recently introduced schemes [15, 17, 19, 20, 22–24] in this section. Table 3 shows the results of security analysis. Only our scheme is resistant to various known attacks and achieves forward secrecy and user anonymity and detects the wrong password promptly, while other schemes have security loopholes more or less.Table 3
Results of security analysis.
Schemes Nikooghadam [15] Luo [17] Xie [19] Amin [20] Maitra [22] Maitra [23] Islam [24] Our protocol S1 × × √ × × × × √ S2 × √ √ √ √ √ × √ S3 × × √ × × × √ √ S4 × × √ √ × × √ √ S5 × × √ √ × × √ √ S6 × √ √ √ √ √ √ √ S7 × √ √ × × √ √ √ S8 × × √ √ √ √ √ √ S9 × × × √ √ √ √ √ S10 √ √ √ √ × √ √ √ S1: Resist offline password guessing attack. S2: User anonymity. S3: Resist user impersonation attack. S4: Resist server impersonation attack. S5: Resist man-in-the-middle attack. S6: Resist desynchronization attack. S7: Forward secrecy. S8: Resist session key disclosure attack. S9: Efficient wrong password detection. S10: Resist insider attack.We estimate the computation overheads and communication costs of related schemes concerning login and authentication phase in Table4. In accordance with Table 4, the total computation overhead of our scheme is inferior to Amin et al.’s scheme and Nikooghadam et al.’s scheme, but it is pretty better than other schemes [17, 19, 22–24]. Furthermore, we have demonstrated that the schemes of Amin et al. and Nikooghadam et al. suffer from various vulnerabilities. In addition, our scheme has the lowest communication overhead among these schemes.Table 4
Performance comparison of our protocol with other schemes.
Schemes↓ User computation cost Server computation cost Estimated total computation time Communication overhead Nikooghadam et al. [15] 2 T S E + 3 T H 4 T S E + 3 T H 0.0414 ms 1152 bits Luo et al. [17] 4 T P M + 4 T H 4 T P M + 5 T H 17.8287 ms 960 bits Xie et al.[19] 3 T P M + 6 T H 3 T P M + 2 T S E + 5 T H 13.3905 ms 1088 bits Amin et al. [20] 1 T M E + 6 T H 1 T M E + 4 T H 7.723 ms 1664 bits Maitra et al. [22] 6 T M E + 8 T H 4 T M E + 12 T H 38.546 ms 4480 bits Maitra et al. [23] 3 T P M + 5 T H 4 T P M + 3 T H 15.6004 ms 1248 bits Islam [24] 5 T M E + 5 T H 2 T M E + 4 T H 26.9707 ms 2688 bits Our protocol 2 T P M + 1 T S E + 7 T H 3 T P M + 1 T S E + 6 T H 11.1691 ms 704 bits T M E denotes one modular exponentiation. TPM denotes one point multiplication on elliptic curve group. TSE denotes one symmetric encryption/decryption. TH denotes performing a hash function. According to [37], the computing times of TH, TSE, TPM, TME are 0.0023 ms, 0.0046 ms, 2.226 ms, and 3.85 ms respectively. The computing time of lightweight operation “XOR” is negligible. To compute the communication overhead, we suppose that IDi and random number and timestamp are 64 bits, the output of hash function and symmetric encryption are 128 bits, large-prime numbers m, p are 1024 bits, one point on the elliptic curve Ep is 160 bits.In summary, our scheme has obvious advantages in terms of security. As for computation overhead, our scheme is superior to most schemes. Besides, our scheme is ahead of other schemes in aspect of communication cost. Hence, our scheme is more practical than other schemes.


## 8. Conclusion

In this paper, we cryptanalyze two anonymous authentication schemes and pointed out they suffer from a variety of security attacks like offline password guessing attack and user impersonation attack. In addition, we reveal the security weaknesses of two environment-specific authentication schemes. To overcome the security loopholes, we present an efficient authentication scheme using elliptic curve cryptosystem. In our scheme, the security of session key is fully guaranteed. It prevents all the possible session key exposure, forward secrecy attack included. We give both formal analysis and informal analysis to prove the completeness and security of the proposed scheme. Furthermore, the outcomes of security and performance comparison show that the proposed scheme is superior with better security and low computation and communication cost. Besides, the proposed scheme has good expansibility. In the future, we plan to design an efficient biometrics-based remote user authentication scheme for multiserver environment based on our current work.



---

*Source: 4656281-2019-08-20.xml*