# An Improved Biometrics-Based Remote User Authentication Scheme with User Anonymity

Authors: Muhammad Khurram Khan; Saru Kumari
Journal: BioMed Research International
 (2013)

---

## Abstract

The authors review the biometrics-based user authentication scheme proposed by An in 2012. The authors show that there exist loopholes in the scheme which are detrimental for its security. Therefore the authors propose an improved scheme eradicating the flaws of An’s scheme. Then a detailed security analysis of the proposed scheme is presented followed by its efficiency comparison. The proposed scheme not only withstands security problems found in An’s scheme but also provides some extra features with mere addition of only two hash operations. The proposed scheme allows user to freely change his password and also provides user anonymity with untraceability.


---

## Body

## 1. Introduction

In the last two decades, digital authentication has originated as a preferred method to authenticate remote users over insecure networks. After the first proposal of user authentication scheme by Lamport [1], considerable amount of research has been conducted in this field of which schemes [1–25] are few examples. In due course of time user authentication schemes underwent many changes. Initial schemes were based only on password [1–4], then schemes were based on smart card and password [5–13], and reliability of biometrics authentication over traditional password-based authentication gave rise to biometrics-based user authentication schemes [14–20].In 2010, Li and Hwang [19] proposed a biometrics-based user authentication scheme. In 2011, Das [26] examined Li-Hwang’s scheme and observed problems in login and authentication phase, in password change phase, and in biometrics verification mechanism of the scheme. Das depicted that user’s smart card does not validate the inputted password during login phase which leads to useless computations in login and authentication phase. Owing to the same reason, Das further showed that the scheme suffers from incorrect password updating problem. Thus, Das proposed an improvement [26] of Li-Hwang’s scheme and claimed their scheme to be free from problems observed in Li-Hwang’s scheme. According to Das, their scheme [26] also provides mutual authentication. In 2012, An [27] pointed out that Das’s scheme [26] deviates from the author’s claim since an adversary can mount impersonation attacks and password guessing attack once he gets a chance to extract values from the smart card of the legal user. Thereby An [27] proposed an enhanced scheme to eradicate the flaws of Das’s scheme.In this paper, we review An’s biometrics-based user authentication scheme. We show that An’s scheme is vulnerable to the security problems to which Das’s scheme is susceptible like online and offline password guessing attacks, user and server impersonation attacks, lack of mutual authentication, and lack of user anonymity. Besides, An’s scheme lacks password change facility which is an important part of password-based user authentication schemes. We remove drawbacks from An’s scheme by means of proposing an improved user authentication scheme. In addition, to resist various security threats, the proposed scheme incorporates features of password changing and user anonymity. The rest of this paper is arranged as follows. In Section2, we review An’s user authentication scheme. Section 3 is about cryptanalysis of An’s scheme. In Section 4, we present our improved scheme. Section 5 is about security analysis of the improved scheme. In Section 6, we compare the improved scheme with related schemes. Finally, the conclusion is presented in Section 7.


## 2. Review of An’s Scheme

The notations useful in this paper are summarized along with their description in Table1. In this section, we review An’s scheme [27] which is an enhanced version of Das’s scheme [26]. It has three phases: registration phase, login phase and authentication phase. Registration phase is carried over a secure channel whereas login phase, and authentication phase are carried over an insecure channel. There are three participants in the scheme, the user (Ci), the server (Si), and the registration centre (R), where R is assumed to be a trusted party. Details of each phase are given in the following subsections.Table 1
Notations with their description.
Notations
Description
R
Trusted registration centre
S
i
Server
C
i
User
ID
i
Identity ofCi
PW
i
Password ofCi
B
i
Biometric template ofCi
SC
i
Smart card ofCi
K
i
Random number chosen byCi
R
c
Random number generated bySCi  of  Ci
R
s
Random number generated bySi
U
a
Attacker
x
s  and ys
Secret keys maintained bySi
h(·)
One-way hash function
⊕
Bitwise XOR operator
∥
Concatenation operator


### 2.1. Registration Phase

In the beginning of scheme, the registration centreR and the user Ci carry out this phase involving the following steps. (1)
Ci submits his identity IDi and information (PWi⊕Ki) containing password to R via a secure channel. Ci also submits information (Bi⊕Ki) containing his biometrics via the specific device to R; here Ki is a random number chosen by Ci.(2)
Rcomputes fi=h(Bi⊕Ki), ri=h(PWi⊕Ki)⊕fi, and ei=h(IDi∥xs)⊕ri, where xs is a secret key generated and maintained by Si. Then R stores {IDi,fi,ei,h(·)} in a smart card SCi for user and provides it to Ci via a secure channel.(3)
On receivingSCi={IDi,fi,ei,h(·)}, the user stores the random number Ki into SCi issued by R so that now SCi={IDi,fi,ei,h(·)}.


### 2.2. Login Phase

When the userCi wishes to login the server Si, the user and his smart card SCi perform the following steps.(1)
Ci inserts his smart card into a card reader and inputs his biometrics information Bi on the specific device. SCi computes h(Bi⊕Ki)  and verifies if fi=h(Bi⊕Ki) or not. If this biometrics information matches, Ci passes the biometrics verification.(2)
Ci inputs his IDi and PWi; then SCi generates a random number Rc and computes the following equations:
(1)ri′=h(PWi⊕Ki)⊕fi,M1=ei⊕ri′,M2=M1⊕Rc,M3=h(M1∥Rc).(3)
Ci sends the login request = {IDi,M2,M3} to Si.


### 2.3.  Authentication Phase

On receiving the request login ={IDi,M2,M3} from Ci, the server Si and the user Ci perform the following steps to authenticate each other.(1)
Si first checks the format of IDi. If IDi is valid, Si computes M4=h(IDi∥xs) and          M5=M2⊕M4.(2)
Si checks if M3=h(M4∥M5) or not. If both are equal, it generates a random number Rs and computes the following equations:
(2)M6=M4⊕Rs,M7=h(M4∥Rs).
Then, Si sends the reply message ={M6,M7} for its authentication to Ci.(3)
On receiving{M6,M7} from Si, the user Ci computes M8=M6⊕M1 and checks if        M7=h(M1∥M8) or not. If both are equal, Ci computes M9=h(M1∥Rc∥M8) and sends the reply message {M9} for its authentication to Si.(4)
On receiving{M9} from Ci, the server checks if M9=h(M4∥M5∥Rs) or not. If both are equal, Si accepts the login request = {IDi,M2,M3} of Ci.


## 2.1. Registration Phase

In the beginning of scheme, the registration centreR and the user Ci carry out this phase involving the following steps. (1)
Ci submits his identity IDi and information (PWi⊕Ki) containing password to R via a secure channel. Ci also submits information (Bi⊕Ki) containing his biometrics via the specific device to R; here Ki is a random number chosen by Ci.(2)
Rcomputes fi=h(Bi⊕Ki), ri=h(PWi⊕Ki)⊕fi, and ei=h(IDi∥xs)⊕ri, where xs is a secret key generated and maintained by Si. Then R stores {IDi,fi,ei,h(·)} in a smart card SCi for user and provides it to Ci via a secure channel.(3)
On receivingSCi={IDi,fi,ei,h(·)}, the user stores the random number Ki into SCi issued by R so that now SCi={IDi,fi,ei,h(·)}.


## 2.2. Login Phase

When the userCi wishes to login the server Si, the user and his smart card SCi perform the following steps.(1)
Ci inserts his smart card into a card reader and inputs his biometrics information Bi on the specific device. SCi computes h(Bi⊕Ki)  and verifies if fi=h(Bi⊕Ki) or not. If this biometrics information matches, Ci passes the biometrics verification.(2)
Ci inputs his IDi and PWi; then SCi generates a random number Rc and computes the following equations:
(1)ri′=h(PWi⊕Ki)⊕fi,M1=ei⊕ri′,M2=M1⊕Rc,M3=h(M1∥Rc).(3)
Ci sends the login request = {IDi,M2,M3} to Si.


## 2.3.  Authentication Phase

On receiving the request login ={IDi,M2,M3} from Ci, the server Si and the user Ci perform the following steps to authenticate each other.(1)
Si first checks the format of IDi. If IDi is valid, Si computes M4=h(IDi∥xs) and          M5=M2⊕M4.(2)
Si checks if M3=h(M4∥M5) or not. If both are equal, it generates a random number Rs and computes the following equations:
(2)M6=M4⊕Rs,M7=h(M4∥Rs).
Then, Si sends the reply message ={M6,M7} for its authentication to Ci.(3)
On receiving{M6,M7} from Si, the user Ci computes M8=M6⊕M1 and checks if        M7=h(M1∥M8) or not. If both are equal, Ci computes M9=h(M1∥Rc∥M8) and sends the reply message {M9} for its authentication to Si.(4)
On receiving{M9} from Ci, the server checks if M9=h(M4∥M5∥Rs) or not. If both are equal, Si accepts the login request = {IDi,M2,M3} of Ci.


## 3. Cryptanalysis of An’s Scheme

This section is about security problems in An’s scheme. Here we show that an attackerUa can mount different types of attacks on the scheme. Independent researches by Kocher and Messerges [28, 29] show that it is possible to extract the values stored inside a smart card. So we assume that Ua can extract out parameters stored inside a user’s smart card.


### 3.1. Online Password Guessing Attack

IfUa obtains the smart card SCi of user Ci and extracts [28, 29] the values {IDi,fi,ei,Ki,h(·)} stored inside it, then he can mount online password guessing attack as explained below.(1)
Ua computes
(3)ei⊕fi=[h(IDi∥xs)⊕ri]⊕fiei⊕fi=[h(IDi∥xs)⊕h(PWi⊕Ki)⊕fi]⊕fiei⊕fi=[h(IDi∥xs)⊕h(PWi⊕Ki)]toobtain[h(IDi∥xs)⊕h(PWi⊕Ki)].(2)
Ua guesses PWa as user’s possible password and computes M1a=[ei⊕fi]⊕h(PWa⊕Ki). Then Ua computes M2a=M1a⊕Rca and M3a=h(M1a∥Rca), where Rca is the random number generated by the system of Ua.  He sends {IDi,M2a,M3a} as login request to Si.(3)
IfUa does not receive any response from Si then he repeats step (2) with some other guess for user’s password. But if Ua receives response message from Si, then it implies that his guessed password PWa is correct.


### 3.2. Offline Password Guessing Attack

In the scheme,Ua can easily identify the login request corresponding to a smart card since both contain the identity of user. If Ua extracts [28, 29] the values {IDi,fi,ei,Ki,h(·)} from the smart card SCi of user Ci and intercepts the login request ={IDi,M2,M3} from open network, then he can mount offline password guessing attack as explained below.(1)
Ua computes
(4)ei⊕fi=[h(IDi∥xs)⊕ri]⊕fiei⊕fi=[h(IDi∥xs)⊕h(PWi⊕Ki)⊕fi]⊕fiei⊕fi=[h(IDi∥xs)⊕h(PWi⊕Ki)]toobtain[h(IDi∥xs)⊕h(PWi⊕Ki)].(2)
Ua guesses PWa as user’s possible password and computes M1a=[ei⊕fi]⊕h(PWa⊕Ki).(3)
Ua computes Rca=M2⊕M1a and M3a=h(M1a∥Rca), and finally compares M3a with M3. For M3a≠M3, he repeats from step (2) with some other guess for user’s password. But if M3a=M3, then it provides Ua with the exact password PWi of Ci.


### 3.3. User Impersonation Attack

As just discussed in previous subsections,Ua can guess a user’s password if he obtains the smart card of user. It is noticeable that the successful process of password guessing (online or offline manner) also yields M1a=h(IDi∥xs). In fact, h(IDi∥xs) is the key value required to compute a valid login request or valid reply messages. Further, Ua has easy access to user’s identity IDi from SCi={IDi,fi,ei,Ki,h(·)} or from the login request = {IDi,M2,M3} of Ci. Having h(IDi∥xs) and IDi in hand, Ua can impersonate the user Ci as explained below. (1)
Ua generates a random number Rca in his system and computes
(5)M2a=M1a⊕Rca,M3a=h(M1a∥Rca).
Then Ua sends the login request = {IDi,M2a,M3a} to Si.(2)
On receiving{IDi,M2a,M3a}, the server Si first checks the format of IDi. Clearly, Si would proceed further because IDi is the identity of a legitimate registered user and hence it is in valid format.(3)
Si computes M4=h(IDi∥xs) and  M5=M2a⊕M4 and checks if M3a=h(M4∥M5); clearly it would hold. Therefore Si believes that the login request = {IDi,M2a,M3a} is from the legitimate user.(4)
Si generates a random number Rs and computes M6=M4⊕Rs and M7=h(M4∥Rs). Then Si transmits the reply message {M6,M7}.(5)
On receiving{M6,M7} from Si, the attacker Ua first obtains the random number Rs by computing M8a=M6⊕M1a. Next, it computes M9a=h(M1a∥Rca∥M8) and sends {M9a} to Si.(6)
On receiving{M9}, the server Si checks if M9=h(M4∥M5∥Rs) or not. Clearly, this would hold, so Si will accept the login request = {IDi,M2a,M3a}.


### 3.4. Server Impersonation Attack

U
a can easily impersonate the legal server Si to cheat the user Ci whose information {IDiandM1a=h(IDi∥xs)} he possesses as described in Section 3.3. To masquerade as Si the attacker proceeds in the following manner.(1)
Ua can easily recognize the login request = {IDi,M2,M3} of Ci transmitted over open channel as he possesses the identity IDi of Ci. So when Ci sends his login request = {IDi,M2,M3} to Si, the attacker Ua intercepts and blocks it from reaching Si.(2)
Ua first obtains the random number Rc by computing M5a=M2⊕M1a. Next, he generates a random number Rsa in his system and computes M6a=M1a⊕Rsa and M7a=h(M1a∥Rsa). Then Ua transmits the reply message {M6a,M7a} to Ci.(3)
On receiving{M6a,M7a}, the user Ci first obtains the random number Rsa by computing M8=M6a⊕M1, where M1=h(IDi∥xs). Next, he checks if M7a=h(M1∥M8) or not. Clearly, this equivalence will hold and hence Ci will believe that he is communicating with the intended server. However, it is the clever attacker Ua who is deceiving Ci.


### 3.5. Lack of Mutual Authentication

Like Das’s scheme [26], the enhanced scheme by An also fails to resist user impersonation attack and server impersonation attack as described in Sections 3.3 and 3.4. In fact, if  Ua extracts values {IDi,fi,ei,Ki,h(·)} from the smart card SCi of user Ci and successfully obtains the secret value h(IDi∥xs), then he can easily craft valid login request and reply messages so as to deceive the legal user or the legal server. Therefore, the scheme loses mutual authentication feature.


### 3.6. Lack of User Anonymity

In An’s scheme,Ci sends {IDi,M2,M3} as his login request to Si through an insecure channel. User’s identity IDi is openly available if an attacker Ua intercepts the login request of Ci from the open channel. Moreover, identity IDi is also stored inside user’s smart card SCi. Having IDi in hand, it is easy for Ua to craft threats against Ci. To the worst, Ua may be able to compromise user’s biometrics information which would result in serious consequences. Thus, the scheme does not provide user anonymity.


## 3.1. Online Password Guessing Attack

IfUa obtains the smart card SCi of user Ci and extracts [28, 29] the values {IDi,fi,ei,Ki,h(·)} stored inside it, then he can mount online password guessing attack as explained below.(1)
Ua computes
(3)ei⊕fi=[h(IDi∥xs)⊕ri]⊕fiei⊕fi=[h(IDi∥xs)⊕h(PWi⊕Ki)⊕fi]⊕fiei⊕fi=[h(IDi∥xs)⊕h(PWi⊕Ki)]toobtain[h(IDi∥xs)⊕h(PWi⊕Ki)].(2)
Ua guesses PWa as user’s possible password and computes M1a=[ei⊕fi]⊕h(PWa⊕Ki). Then Ua computes M2a=M1a⊕Rca and M3a=h(M1a∥Rca), where Rca is the random number generated by the system of Ua.  He sends {IDi,M2a,M3a} as login request to Si.(3)
IfUa does not receive any response from Si then he repeats step (2) with some other guess for user’s password. But if Ua receives response message from Si, then it implies that his guessed password PWa is correct.


## 3.2. Offline Password Guessing Attack

In the scheme,Ua can easily identify the login request corresponding to a smart card since both contain the identity of user. If Ua extracts [28, 29] the values {IDi,fi,ei,Ki,h(·)} from the smart card SCi of user Ci and intercepts the login request ={IDi,M2,M3} from open network, then he can mount offline password guessing attack as explained below.(1)
Ua computes
(4)ei⊕fi=[h(IDi∥xs)⊕ri]⊕fiei⊕fi=[h(IDi∥xs)⊕h(PWi⊕Ki)⊕fi]⊕fiei⊕fi=[h(IDi∥xs)⊕h(PWi⊕Ki)]toobtain[h(IDi∥xs)⊕h(PWi⊕Ki)].(2)
Ua guesses PWa as user’s possible password and computes M1a=[ei⊕fi]⊕h(PWa⊕Ki).(3)
Ua computes Rca=M2⊕M1a and M3a=h(M1a∥Rca), and finally compares M3a with M3. For M3a≠M3, he repeats from step (2) with some other guess for user’s password. But if M3a=M3, then it provides Ua with the exact password PWi of Ci.


## 3.3. User Impersonation Attack

As just discussed in previous subsections,Ua can guess a user’s password if he obtains the smart card of user. It is noticeable that the successful process of password guessing (online or offline manner) also yields M1a=h(IDi∥xs). In fact, h(IDi∥xs) is the key value required to compute a valid login request or valid reply messages. Further, Ua has easy access to user’s identity IDi from SCi={IDi,fi,ei,Ki,h(·)} or from the login request = {IDi,M2,M3} of Ci. Having h(IDi∥xs) and IDi in hand, Ua can impersonate the user Ci as explained below. (1)
Ua generates a random number Rca in his system and computes
(5)M2a=M1a⊕Rca,M3a=h(M1a∥Rca).
Then Ua sends the login request = {IDi,M2a,M3a} to Si.(2)
On receiving{IDi,M2a,M3a}, the server Si first checks the format of IDi. Clearly, Si would proceed further because IDi is the identity of a legitimate registered user and hence it is in valid format.(3)
Si computes M4=h(IDi∥xs) and  M5=M2a⊕M4 and checks if M3a=h(M4∥M5); clearly it would hold. Therefore Si believes that the login request = {IDi,M2a,M3a} is from the legitimate user.(4)
Si generates a random number Rs and computes M6=M4⊕Rs and M7=h(M4∥Rs). Then Si transmits the reply message {M6,M7}.(5)
On receiving{M6,M7} from Si, the attacker Ua first obtains the random number Rs by computing M8a=M6⊕M1a. Next, it computes M9a=h(M1a∥Rca∥M8) and sends {M9a} to Si.(6)
On receiving{M9}, the server Si checks if M9=h(M4∥M5∥Rs) or not. Clearly, this would hold, so Si will accept the login request = {IDi,M2a,M3a}.


## 3.4. Server Impersonation Attack

U
a can easily impersonate the legal server Si to cheat the user Ci whose information {IDiandM1a=h(IDi∥xs)} he possesses as described in Section 3.3. To masquerade as Si the attacker proceeds in the following manner.(1)
Ua can easily recognize the login request = {IDi,M2,M3} of Ci transmitted over open channel as he possesses the identity IDi of Ci. So when Ci sends his login request = {IDi,M2,M3} to Si, the attacker Ua intercepts and blocks it from reaching Si.(2)
Ua first obtains the random number Rc by computing M5a=M2⊕M1a. Next, he generates a random number Rsa in his system and computes M6a=M1a⊕Rsa and M7a=h(M1a∥Rsa). Then Ua transmits the reply message {M6a,M7a} to Ci.(3)
On receiving{M6a,M7a}, the user Ci first obtains the random number Rsa by computing M8=M6a⊕M1, where M1=h(IDi∥xs). Next, he checks if M7a=h(M1∥M8) or not. Clearly, this equivalence will hold and hence Ci will believe that he is communicating with the intended server. However, it is the clever attacker Ua who is deceiving Ci.


## 3.5. Lack of Mutual Authentication

Like Das’s scheme [26], the enhanced scheme by An also fails to resist user impersonation attack and server impersonation attack as described in Sections 3.3 and 3.4. In fact, if  Ua extracts values {IDi,fi,ei,Ki,h(·)} from the smart card SCi of user Ci and successfully obtains the secret value h(IDi∥xs), then he can easily craft valid login request and reply messages so as to deceive the legal user or the legal server. Therefore, the scheme loses mutual authentication feature.


## 3.6. Lack of User Anonymity

In An’s scheme,Ci sends {IDi,M2,M3} as his login request to Si through an insecure channel. User’s identity IDi is openly available if an attacker Ua intercepts the login request of Ci from the open channel. Moreover, identity IDi is also stored inside user’s smart card SCi. Having IDi in hand, it is easy for Ua to craft threats against Ci. To the worst, Ua may be able to compromise user’s biometrics information which would result in serious consequences. Thus, the scheme does not provide user anonymity.


## 4. The Proposed Scheme

In this section, we propose a new user authentication scheme which is an improvement of An’s scheme. In addition to resist the security problems found in An’s scheme, it also provides password change phase with which user can change his password at his will. It has four phases: registration phase, login phase, authentication phase and password change phase. Registration phase, and password change phase are carried over a secure channel whereas login phase and authentication phase are carried over an insecure channel. It also consists of three participants, the user (Ci), the server (Si), and the registration centre (R). In the proposed scheme, the server maintains two secret keys xs and ys. Details of each phase along with Figure 1 are given in the following.Figure 1
The proposed scheme.


### 4.1. Registration Phase

Before starting the scheme, the registration centreR and the user Ci carry out this phase involving the following steps. (1)
Ci submits his identity IDi and information (PWi⊕Ki) containing password to R via a secure channel. Ci also submits information (Bi⊕Ki) containing his biometrics via a specific device to R; here Ki is a random number chosen by Ci.(2)
R computes the following values:
(6)fi=h(Bi⊕Ki),ri=h(PWi⊕Ki)⊕fi,ci=h(xs∥ys)⊕fi,ei=h(IDi∥xs)⊕ri,
where R stores {ci,ei,h(·)} in a smart card SCi for user. Then R provides SCi={ci,ei,h(·)} and fi to the user Ci via a secure channel.(3)
On receiving[SCi={ci,ei,h(·)}&fi], the user computes the following values:
(7)gi=(IDi∥PWi)⊕fi,ji=(IDi∥PWi)⊕Ki,
where Ci inserts gi and ji into SCi issued by R so that now SCi={ci,ei,gi,ji,h(·)}.


### 4.2. Login Phase

When the userCi wishes to login the server Si, the user and his smart card SCi perform the following steps.(1)
Ci inserts his smart card into a card reader, keys in his identity IDi, and password PWi and inputs his biometrics information Bi on the specific device.(2)
SCi retrieves fi←(IDi∥PWi)⊕gi and Ki←(IDi∥PWi)⊕ji. It then checks if fi=h(Bi⊕Ki) or not. If this biometrics information matches, Ci passes the biometrics verification; otherwise SCi terminates the sesion. This process also verifies the correctness of inserted IDi and PWi.(3)
SCi generates a random number Rc and computes the following equations:
(8)ri=h(PWi⊕Ki)⊕fi,M1=ci⊕fi(whichisindeedh(xs∥ys)),M2=ei⊕ri(whichisindeedh(IDi∥xs)),M3=M1⊕Rc(whichisindeedh(xs∥ys)⊕Rc),M4=(M1∥Rc)⊕IDi(whichisindeed[(h(xs∥ys)∥Rc)⊕IDi]),M5=h(M2∥Rc),(whichisindeedh(h(IDi∥xs)∥Rc)).(4)
Ci sends the login request = {M3,M4,M5} to Si.


### 4.3. Authentication Phase

On receiving the request login={M3,M4,M5} from Ci, the server Si and the user Ci perform the following steps to authenticate each other.(1)
Si computes the following values:
(9)M6=h(xs∥ys),M7=M3⊕M6(whichisindeedRc),IDi=M4⊕(M6∥M7).(2)
Si checks the format of IDi. If IDi is valid, Si computes M8=h(IDi∥xs). It then checks if             M5=h(M8∥M7). If both are equal, Si generates a random number Rs and computes:
(10)M9=M8⊕Rs(whichisindeedh(IDi∥xs)⊕Rs)M10=h(M8∥Rs)(whichisindeedh(h(IDi∥xs)∥Rs)).
Then, Si sends the reply message ={M9,M10} for its authentication to Ci.(3)
On receiving{M9,M10} from Si, the user Ci computes M11=M9⊕M2 (which is indeed Rs). It then checks if M10=h(M2∥M11) or not. If both are equal, Ci computes M12=h(M2∥Rc∥M11) (which is indeed h[h(IDi∥xs)∥Rc∥Rs]). Then Ci sends the reply message {M12} for its authentication to Si.(4)
On receiving{M12} from Ci, the server checks if M12=h(M8∥M7∥Rs) or not. If both are equal, Si accepts the login request ={M3,M4,M5} of Ci.


### 4.4. Password Change Phase

When the user wishes to change his old passwordPWi, he invokes this phase. Details of the steps required to update the smart card SCi with new password (PWi)new are as follows.(1)
Ci inserts his smart card into a card reader, keys in his identity IDi, and password PWi and inputs his biometrics information Bi on the specific device.(2)
SCi retrieves fi←(IDi∥PWi)⊕gi and Ki←(IDi∥PWi)⊕ji. It then checks if  fi=h(Bi⊕Ki)  or not. If this biometrics information matches, Ci passes the biometrics verification, otherwise terminates the session. This process also verifies the correctness of inserted IDi and PWi. Then SCi allows the user to enter the new password (PWi)new.(3)
SCi computes the following equations:
(11)(gi)new=(IDi∥(PWi)new)⊕fi,(ji)new=(IDi∥(PWi)new)⊕Ki,(ei)new=ei⊕h(PWi⊕Ki)⊕h((PWi)new⊕Ki).(4)
SCi replaces  ei, gi, and ji with (ei)new, (gi)new and (ji)new, respectively.


## 4.1. Registration Phase

Before starting the scheme, the registration centreR and the user Ci carry out this phase involving the following steps. (1)
Ci submits his identity IDi and information (PWi⊕Ki) containing password to R via a secure channel. Ci also submits information (Bi⊕Ki) containing his biometrics via a specific device to R; here Ki is a random number chosen by Ci.(2)
R computes the following values:
(6)fi=h(Bi⊕Ki),ri=h(PWi⊕Ki)⊕fi,ci=h(xs∥ys)⊕fi,ei=h(IDi∥xs)⊕ri,
where R stores {ci,ei,h(·)} in a smart card SCi for user. Then R provides SCi={ci,ei,h(·)} and fi to the user Ci via a secure channel.(3)
On receiving[SCi={ci,ei,h(·)}&fi], the user computes the following values:
(7)gi=(IDi∥PWi)⊕fi,ji=(IDi∥PWi)⊕Ki,
where Ci inserts gi and ji into SCi issued by R so that now SCi={ci,ei,gi,ji,h(·)}.


## 4.2. Login Phase

When the userCi wishes to login the server Si, the user and his smart card SCi perform the following steps.(1)
Ci inserts his smart card into a card reader, keys in his identity IDi, and password PWi and inputs his biometrics information Bi on the specific device.(2)
SCi retrieves fi←(IDi∥PWi)⊕gi and Ki←(IDi∥PWi)⊕ji. It then checks if fi=h(Bi⊕Ki) or not. If this biometrics information matches, Ci passes the biometrics verification; otherwise SCi terminates the sesion. This process also verifies the correctness of inserted IDi and PWi.(3)
SCi generates a random number Rc and computes the following equations:
(8)ri=h(PWi⊕Ki)⊕fi,M1=ci⊕fi(whichisindeedh(xs∥ys)),M2=ei⊕ri(whichisindeedh(IDi∥xs)),M3=M1⊕Rc(whichisindeedh(xs∥ys)⊕Rc),M4=(M1∥Rc)⊕IDi(whichisindeed[(h(xs∥ys)∥Rc)⊕IDi]),M5=h(M2∥Rc),(whichisindeedh(h(IDi∥xs)∥Rc)).(4)
Ci sends the login request = {M3,M4,M5} to Si.


## 4.3. Authentication Phase

On receiving the request login={M3,M4,M5} from Ci, the server Si and the user Ci perform the following steps to authenticate each other.(1)
Si computes the following values:
(9)M6=h(xs∥ys),M7=M3⊕M6(whichisindeedRc),IDi=M4⊕(M6∥M7).(2)
Si checks the format of IDi. If IDi is valid, Si computes M8=h(IDi∥xs). It then checks if             M5=h(M8∥M7). If both are equal, Si generates a random number Rs and computes:
(10)M9=M8⊕Rs(whichisindeedh(IDi∥xs)⊕Rs)M10=h(M8∥Rs)(whichisindeedh(h(IDi∥xs)∥Rs)).
Then, Si sends the reply message ={M9,M10} for its authentication to Ci.(3)
On receiving{M9,M10} from Si, the user Ci computes M11=M9⊕M2 (which is indeed Rs). It then checks if M10=h(M2∥M11) or not. If both are equal, Ci computes M12=h(M2∥Rc∥M11) (which is indeed h[h(IDi∥xs)∥Rc∥Rs]). Then Ci sends the reply message {M12} for its authentication to Si.(4)
On receiving{M12} from Ci, the server checks if M12=h(M8∥M7∥Rs) or not. If both are equal, Si accepts the login request ={M3,M4,M5} of Ci.


## 4.4. Password Change Phase

When the user wishes to change his old passwordPWi, he invokes this phase. Details of the steps required to update the smart card SCi with new password (PWi)new are as follows.(1)
Ci inserts his smart card into a card reader, keys in his identity IDi, and password PWi and inputs his biometrics information Bi on the specific device.(2)
SCi retrieves fi←(IDi∥PWi)⊕gi and Ki←(IDi∥PWi)⊕ji. It then checks if  fi=h(Bi⊕Ki)  or not. If this biometrics information matches, Ci passes the biometrics verification, otherwise terminates the session. This process also verifies the correctness of inserted IDi and PWi. Then SCi allows the user to enter the new password (PWi)new.(3)
SCi computes the following equations:
(11)(gi)new=(IDi∥(PWi)new)⊕fi,(ji)new=(IDi∥(PWi)new)⊕Ki,(ei)new=ei⊕h(PWi⊕Ki)⊕h((PWi)new⊕Ki).(4)
SCi replaces  ei, gi, and ji with (ei)new, (gi)new and (ji)new, respectively.


## 5. Security Analysis of the Proposed Scheme

In this section, we analyze security of the proposed scheme. We show that the scheme remains unaffected even if an attackerUa extracts [28, 29] all the values stored inside a user’s smart card.


### 5.1. Online Password Guessing Attack

On having access to user’s smart cardSCi an attacker Ua can extract [28, 29] all values {ci,ei,gi,ji,h(·)} from it. In order to compute ei⊕fi and obtain [h(IDi∥xs)⊕h(PWi⊕Ki)], he requires fi. But Ua cannot obtain fi from gi=(IDi∥PWi)⊕fi as he does not know about user’s identity IDi and password PWi. The attacker Ua can obtain fi⊕Ki by performing  gi⊕ji=[(IDi∥PWi)⊕fi]⊕[(IDi∥PWi)⊕Ki]. Next, he can compute
(12)ei⊕(fi⊕Ki)=[h(IDi∥xs)⊕ri]⊕(fi⊕Ki)=[h(IDi∥xs)⊕h(PWi⊕Ki)⊕fi]⊕(fi⊕Ki)=h(IDi∥xs)⊕h(PWi⊕Ki)⊕Ki.
But Ua cannot compute forged M2a(=h(IDi∥xs))=[ei⊕fi⊕Ki]⊕h(PWa⊕Ki) using a guessed password PWa because it requires knowledge of  Ki. It is troublesome for Ua to obtain Ki because Ki is not stored in plaintext inside user’s smart card but is stored securely in ji=(IDi∥PWi)⊕Ki. Further Ua cannot obtain Ki from ji without knowing IDi and password PWi. Besides, Ua cannot compute M1a(=h(xs∥ys))=(ci⊕fi) as he does not have access to fi. Moreover, Ua does not have IDi of Ci as IDi is not stored in plaintext inside user’s smart card. Thus, Ua cannot compute a login request {M3a,M4a,M5a} in a way so as to guess user’s password in an online manner. Hence, the proposed scheme withstands online password guessing attack.


### 5.2. Offline Password Guessing Attack

SupposeUa obtains the smart card of some user. Though  Ua can intercept login message of any user from open channel, he cannot relate a user’s smart card with its corresponding login request. This is due to the fact that, unlike An’s scheme, in the proposed scheme user’s identity in plaintext is neither stored inside user’s smart card nor transmitted in login request. As a result, Ua cannot combine values extracted from a user’s smart card with values of corresponding login request to guess user’s password in an offline manner. If we consider the situation that Ua somehow happens to get the correct combination of user’s smart card and login request, we show that still Ua cannot mount offline password guessing attack. To guess password of Ci  and then verify the guess, Ua can use M5=h(M2∥Rc) provided that he  possesses the values {[h(IDi∥xs)⊕h(PWi⊕Ki)⊕Ki],KiandRc} in hand. As explained in Section 5.1,  Ua  can obtain [h(IDi∥xs)⊕h(PWi⊕Ki)⊕Ki] using {gi,jiandei} extracted [28, 29] from SCi, but he cannot obtain the random number Ki. Besides,  Ua cannot obtain the random number  Rc using M3=M1⊕Rc without having M1(=h(xs∥ys)) and Ua fails to obtain M1(=h(xs∥ys)) as discussed in Section 5.1. Thus an attacker Ua cannot guess user’s password in an offline manner.


### 5.3. User Impersonation and Server Impersonation Attack

To impersonate a legal user,Ua should possess  M1=h(xs∥ys) and M2=h(IDi∥xs); otherwise he cannot compute a valid login request {M3a,M4a,M5a} or a valid reply message {M12a}. The value h(IDi∥xs) is equally important if Ua wishes to masquerade as legal server. Unlike An’s scheme, in the proposed scheme Ua is not able to obtain M2(=M8)=h(IDi∥xs)  while making attempts of guessing user’s password. This is due to the fact that password guessing is not feasible as explained in Sections 5.1 and 5.2. Moreover,  Ua cannot obtain M1=h(xs∥ys) (i) from M3=M1⊕Rc obtained by intercepting the login request of Ci because of not having random number Rc and (ii) from ci=h(xs∥ys)⊕fi extracted from user’s smart card without knowing fi. Thus, the proposed scheme resists impersonation attacks.


### 5.4. Supporting Mutual Authentication

The success of mutual authentication in the proposed scheme follows directly from resistance against user impersonation attack and server impersonation attack as described in Section5.3. In fact, Ua has many hurdles before him to act as a legal user or a legal server: (i) the secret keys xs and ys maintained by the server are unknown for Ua and (ii) Ua has no access to the identity IDi of user Ci. As a result, Ua cannot compute h(xs∥ys) and h(IDi∥xs) required to mount impersonation attacks. Besides, Ua has no method to retrieve these values either from the parameters extracted out of user’s smart card or from the login request or using both. Therefore, the proposed scheme provides proper mutual authentication.


### 5.5. Providing User Anonymity and User Untraceability

In the proposed scheme, user’s plaintext identityIDi is completely out of scene; it is neither stored in user’s smart card SCi nor sent in any of the login-authentication messages transmitted over insecure network. If Ua extracts [28, 29] the values {ci,ei,gi,ji,h(·)} from SCi, we explain in the following that he cannot obtain IDi of Ci. To guess IDi from gi=(IDi∥PWi)⊕fi and from ji=(IDi∥PWi)⊕Ki, the attacker must have the knowledge of {PWi,fi} and {PWi,Ki}, respectively. Ua cannot guess out IDi from ei=h(IDi∥xs)⊕ri without knowing ri and xs. If Ua intercepts a login request {M3,M4,M5} or the reply message {M9,M10}/{M12}, he cannot guess out IDi using {M5,M10,M12} without the knowledge of {xs,RcandRs}. Besides, it is not feasible for Ua  to retrieve IDi out of {ei,M5,M10,M12} due to one-way property of hash function. Moreover, each value {M3,M4,M5,M9,M10,M12} transmitted over insecure network is dynamic in nature by virtue of random numbers Rc and Rs which are different for each session. Thus, Ua can neither obtain user’s identity IDi nor can he trace the legal user by means of observing and analyzing some fixed parameter in the login request or the reply messages. Hence, the scheme provides user anonymity as well as user untraceability.


### 5.6. Providing Password Change Facility

In An’s scheme, once user chooses his password during registration phase, it is fixed forever as user cannot change his password at his will. Probably the author might have opined that in the presence of biometrics verification procedure there is no need of password change facility. Undoubtedly, it is very difficult to forge copy or compromise biometrics, but once compromised then biometrics cannot be changed like passwords. So we opine that if password is employed in user authentication scheme then there should be the provision to facilitate the user to freely change his password. The proposed scheme provides password changing facility with which a user can freely (without interacting with server) change his old password to a new one whenever he feels to do so. Before updating stored values with the new password(PWi)new, the smart card verifies the correctness of identity IDi old password PWi along with verifying the biometrics information fi=h(Bi⊕Ki). Thus the proposed scheme provides secure and easy password changing facility.


## 5.1. Online Password Guessing Attack

On having access to user’s smart cardSCi an attacker Ua can extract [28, 29] all values {ci,ei,gi,ji,h(·)} from it. In order to compute ei⊕fi and obtain [h(IDi∥xs)⊕h(PWi⊕Ki)], he requires fi. But Ua cannot obtain fi from gi=(IDi∥PWi)⊕fi as he does not know about user’s identity IDi and password PWi. The attacker Ua can obtain fi⊕Ki by performing  gi⊕ji=[(IDi∥PWi)⊕fi]⊕[(IDi∥PWi)⊕Ki]. Next, he can compute
(12)ei⊕(fi⊕Ki)=[h(IDi∥xs)⊕ri]⊕(fi⊕Ki)=[h(IDi∥xs)⊕h(PWi⊕Ki)⊕fi]⊕(fi⊕Ki)=h(IDi∥xs)⊕h(PWi⊕Ki)⊕Ki.
But Ua cannot compute forged M2a(=h(IDi∥xs))=[ei⊕fi⊕Ki]⊕h(PWa⊕Ki) using a guessed password PWa because it requires knowledge of  Ki. It is troublesome for Ua to obtain Ki because Ki is not stored in plaintext inside user’s smart card but is stored securely in ji=(IDi∥PWi)⊕Ki. Further Ua cannot obtain Ki from ji without knowing IDi and password PWi. Besides, Ua cannot compute M1a(=h(xs∥ys))=(ci⊕fi) as he does not have access to fi. Moreover, Ua does not have IDi of Ci as IDi is not stored in plaintext inside user’s smart card. Thus, Ua cannot compute a login request {M3a,M4a,M5a} in a way so as to guess user’s password in an online manner. Hence, the proposed scheme withstands online password guessing attack.


## 5.2. Offline Password Guessing Attack

SupposeUa obtains the smart card of some user. Though  Ua can intercept login message of any user from open channel, he cannot relate a user’s smart card with its corresponding login request. This is due to the fact that, unlike An’s scheme, in the proposed scheme user’s identity in plaintext is neither stored inside user’s smart card nor transmitted in login request. As a result, Ua cannot combine values extracted from a user’s smart card with values of corresponding login request to guess user’s password in an offline manner. If we consider the situation that Ua somehow happens to get the correct combination of user’s smart card and login request, we show that still Ua cannot mount offline password guessing attack. To guess password of Ci  and then verify the guess, Ua can use M5=h(M2∥Rc) provided that he  possesses the values {[h(IDi∥xs)⊕h(PWi⊕Ki)⊕Ki],KiandRc} in hand. As explained in Section 5.1,  Ua  can obtain [h(IDi∥xs)⊕h(PWi⊕Ki)⊕Ki] using {gi,jiandei} extracted [28, 29] from SCi, but he cannot obtain the random number Ki. Besides,  Ua cannot obtain the random number  Rc using M3=M1⊕Rc without having M1(=h(xs∥ys)) and Ua fails to obtain M1(=h(xs∥ys)) as discussed in Section 5.1. Thus an attacker Ua cannot guess user’s password in an offline manner.


## 5.3. User Impersonation and Server Impersonation Attack

To impersonate a legal user,Ua should possess  M1=h(xs∥ys) and M2=h(IDi∥xs); otherwise he cannot compute a valid login request {M3a,M4a,M5a} or a valid reply message {M12a}. The value h(IDi∥xs) is equally important if Ua wishes to masquerade as legal server. Unlike An’s scheme, in the proposed scheme Ua is not able to obtain M2(=M8)=h(IDi∥xs)  while making attempts of guessing user’s password. This is due to the fact that password guessing is not feasible as explained in Sections 5.1 and 5.2. Moreover,  Ua cannot obtain M1=h(xs∥ys) (i) from M3=M1⊕Rc obtained by intercepting the login request of Ci because of not having random number Rc and (ii) from ci=h(xs∥ys)⊕fi extracted from user’s smart card without knowing fi. Thus, the proposed scheme resists impersonation attacks.


## 5.4. Supporting Mutual Authentication

The success of mutual authentication in the proposed scheme follows directly from resistance against user impersonation attack and server impersonation attack as described in Section5.3. In fact, Ua has many hurdles before him to act as a legal user or a legal server: (i) the secret keys xs and ys maintained by the server are unknown for Ua and (ii) Ua has no access to the identity IDi of user Ci. As a result, Ua cannot compute h(xs∥ys) and h(IDi∥xs) required to mount impersonation attacks. Besides, Ua has no method to retrieve these values either from the parameters extracted out of user’s smart card or from the login request or using both. Therefore, the proposed scheme provides proper mutual authentication.


## 5.5. Providing User Anonymity and User Untraceability

In the proposed scheme, user’s plaintext identityIDi is completely out of scene; it is neither stored in user’s smart card SCi nor sent in any of the login-authentication messages transmitted over insecure network. If Ua extracts [28, 29] the values {ci,ei,gi,ji,h(·)} from SCi, we explain in the following that he cannot obtain IDi of Ci. To guess IDi from gi=(IDi∥PWi)⊕fi and from ji=(IDi∥PWi)⊕Ki, the attacker must have the knowledge of {PWi,fi} and {PWi,Ki}, respectively. Ua cannot guess out IDi from ei=h(IDi∥xs)⊕ri without knowing ri and xs. If Ua intercepts a login request {M3,M4,M5} or the reply message {M9,M10}/{M12}, he cannot guess out IDi using {M5,M10,M12} without the knowledge of {xs,RcandRs}. Besides, it is not feasible for Ua  to retrieve IDi out of {ei,M5,M10,M12} due to one-way property of hash function. Moreover, each value {M3,M4,M5,M9,M10,M12} transmitted over insecure network is dynamic in nature by virtue of random numbers Rc and Rs which are different for each session. Thus, Ua can neither obtain user’s identity IDi nor can he trace the legal user by means of observing and analyzing some fixed parameter in the login request or the reply messages. Hence, the scheme provides user anonymity as well as user untraceability.


## 5.6. Providing Password Change Facility

In An’s scheme, once user chooses his password during registration phase, it is fixed forever as user cannot change his password at his will. Probably the author might have opined that in the presence of biometrics verification procedure there is no need of password change facility. Undoubtedly, it is very difficult to forge copy or compromise biometrics, but once compromised then biometrics cannot be changed like passwords. So we opine that if password is employed in user authentication scheme then there should be the provision to facilitate the user to freely change his password. The proposed scheme provides password changing facility with which a user can freely (without interacting with server) change his old password to a new one whenever he feels to do so. Before updating stored values with the new password(PWi)new, the smart card verifies the correctness of identity IDi old password PWi along with verifying the biometrics information fi=h(Bi⊕Ki). Thus the proposed scheme provides secure and easy password changing facility.


## 6. Comparison

In this section, we examine the proposed scheme by means of comparing its efficiency with Li-Hwang’s scheme [19], Das’s scheme [26], and An’s scheme [27]. Table 2 displays comparison of security attributes and Table 3 displays comparison of computational load in terms of hash functions. Comparison in Table 2 shows that the proposed scheme resists various attacks possible on schemes [19, 26, 27] and provides additional feature of user anonymity with untraceability. Besides, it also restores password change facility which is provided by original versions [19, 26] but is missing in An’s scheme [27]. As Table 3 shows, the proposed scheme carries only two additional hash operations over its immediate predecessor scheme [27]. The important aspect about the proposed scheme is minor increase of two hash functions in computational load to achieve higher efficiency as compared to other schemes [19, 26, 27].Table 2
Comparison of security attributes.
Security attributes
Schemes
Li-Hwang’s [19]
Das’s [26]
An’s [27]
Ours
Resist onlinePWi  guessing attack
No
No
No
Yes
Resist offlinePWi  guessing attack
No
No
No
Yes
Resist user impersonation attack
No
No
No
Yes
Resist server impersonation attack
No
No
No
Yes
Provides mutual authentication
No
No
No
Yes
ProvidesPWi change facility
Yes
Yes
No
Yes
Provides user anonymity
No
No
No
YesTable 3
Comparison of computational load in terms of hash functions.
Phases
Schemes
Li-Hwang’s [19]
Das’s [26]
An’s [27]
Ours
Registration phase
3h(·)
3h(·)
3h(·)
4h(·)
Login phase
2h(·)
2h(·)
3h(·)
3h(·)
Authentication phase
5h(·)
8h(·)
6h(·)
7h(·)
Total
10h(·)
13h(·)
12h(·)
14h(·)


## 7. Conclusion

This paper shows that the recently proposed biometrics-based user authentication scheme by An is susceptible to many threats. Once an attacker obtains the smart card of a legal user, he can guess user’s password and impersonate the user. Further, the attacker can also cheat the user by masquerading as the legal server. Consequently, the scheme fails to provide mutual authentication. Besides, the scheme also suffers from the restriction of static password. We have proposed a new scheme based on the design of An’s scheme so as to fix the problems identified in An’s scheme. In the proposed scheme an attacker cannot figure out the identity of user either from the smart card or by intercepting all login-authentication messages transmitted over insecure network. Analysis and comparison show improved performance of the proposed scheme.



---

*Source: 491289-2013-11-21.xml*