# Security Analysis and Enhancements of an Effective Biometric-Based Remote User Authentication Scheme Using Smart Cards

Authors: Younghwa An
Journal: Journal of Biomedicine and Biotechnology
 (2012)

---

## Abstract

Recently, many biometrics-based user authentication schemes using smart cards have been proposed to improve the security weaknesses in user authentication system. In 2011, Das proposed an efficient biometric-based remote user authentication scheme using smart cards that can provide strong authentication and mutual authentication. In this paper, we analyze the security of Das’s authentication scheme, and we have shown that Das’s authentication scheme is still insecure against the various attacks. Also, we proposed the enhanced scheme to remove these security problems of Das’s authentication scheme, even if the secret information stored in the smart card is revealed to an attacker. As a result of security analysis, we can see that the enhanced scheme is secure against the user impersonation attack, the server masquerading attack, the password guessing attack, and the insider attack and provides mutual authentication between the user and the server.


---

## Body

## 1. Introduction

Recently, user authentication scheme in e-commerce and m-commerce has become one of important security issues. However, the security weaknesses in the remote user authentication scheme have been exposed seriously due to the careless password management and the sophisticated attack techniques. Several schemes [1–6] have been proposed to enhance the various security problems in user authentication schemes.In traditional identity-based remote user authentications, the security of the remote user authentication is based on the passwords, but simple passwords are easy to break by simple dictionary attacks. To resolve the single-password authentication problems, several biometrics-based remote user authentication schemes [7–13] have been designed. Generally, biometrics-based remote user authentication is inherently more secure and reliable than the traditional authentication scheme. There are some advantages of using biometrics keys as compared to traditional passwords. (i)
Biometric keys cannot be lost or forgotten.(ii)
Biometric keys are very difficult to copy or share.(iii)
Biometric keys are extremely hard to forge or distribute.(iv)
Biometric keys cannot be guessed easily.(v)
Someone’s biometrics is not easy to break than others.In 2010, Li and Hwang [12] proposed an efficient biometrics-based remote user authentication scheme using smart cards. They claimed that their scheme not only keeps good properties (e.g., without synchronized clock, freely changes password, mutual authentication) but also provides nonrepudiation. But Das [13], in 2011, pointed out that Li-Hwang’s scheme does not resolve security drawbacks in login and authentication, security drawbacks in password change phase, and security drawbacks in verification of biometrics. Then, Das proposed more efficient biometrics-based remote user authentication scheme using smart cards which is secure against the user impersonation attack, the server masquerading attack, the parallel session attack, and the stolen password attack, and provide mutual authentication.In this paper, we analyze the security of Das’s authentication scheme, and we have shown that Das’s authentication scheme is still vulnerable to the various attacks and does not provide mutual authentication between the user and the server. Also, we proposed the enhanced scheme to remove these security problems of Das’s authentication scheme, even if the secret information stored in the smart card is revealed to an attacker. To analyze the security analysis of Das’s authentication scheme, we assume that an attacker could obtain the secret values stored in the smart card by monitoring the power consumption [14, 15] and intercept messages communicating between the user and the server. Also, we assume that an attacker may possess the capabilities to thwart the security schemes.(a)
An attacker has total control over the communication channel between the user and the server in the login and authentication phase. That is, the attacker may intercept, insert, delete, or modify any message across the communication procedures.(b)
An attacker may (i) either steal a user’s smart card and then extract the secret values stored in the smart card, (ii) or steal a user’s password, but cannot commit both of (i) and (ii) at a time.Obviously, if both of the user’s smart card and password was stolen at the same time, then there is no way to prevent an attacker from impersonating as the user. Therefore, a remote user authentication scheme should be secure if only one case out of (i) and (ii) is happening.This paper is organized as follows. In Section2, we briefly review Das’s authentication scheme. In Section 3, we describe the security analysis of Das’s authentication scheme. The enhanced scheme is presented in Section 4, and security analysis of the enhanced scheme is given in Section 5. Finally, the conclusions are presented in Section 6.


## 2. Reviews of Das’s Scheme

In 2011, Das proposed an improved biometrics-based remote user authentication scheme using smart cards. This scheme is composed of three phases: registration phase, login phase, and authentication phase. The notations used in this paper are as follows shown in Table1.Table 1
Notations used in this paper.
Notation
Description
C
i
Useri
R
i
Trusted registration centrei
S
i
Serveri
A
i
Attackeri
P
W
i
Password of the useri
ID
i
Identity of the useri
B
i
Biometric template of the useri
h( )
A secure hash function
X
s
A secret information maintained by the server
x
∥
y
x concatenates with y
x
⊕
y
Exclusive-OR operation ofx and y


### 2.1. Registration Phase

Before logging in the remote serverSi, a user Ci initially has to register to the trusted registration centre Ri as the following steps.(R1)
Ci submits his identity IDi and password PWi to Ri through a secure channel. Also, the user submits his biometrics information Bi on the specific device to Ri.(R2)
Ri computes fi=h(Bi), ri=h(PWi)⊕fi and ei=h(IDi∥Xs)⊕ri, where Xs is a secret value generated by the server.(R3)
Ri stores (IDi,h(),fi,ei,ri) on the user’s smart card and sends it to the user via a secure channel.


### 2.2. Login Phase

When the userCi wants to log in the remote server Si, the user has to perform the following steps. (L1)
Ci inserts his smart card into a card reader and inputs the personal biometrics information Bi on the specific device to verify the user’s biometrics. If the biometrics information matches the template stored in the system, Ci passes the biometrics verification.(L2)
Ci inputs the IDi and PWi, and then the smart card computes ri′=h(PWi)⊕fi. If ri′ equals ri, the smart card computes the following equations, where Rc is a random number generated by the smart card:
(1)M1=ei⊕ri′M2=M1⊕RcM3=h(Rc)(L3)
Ci sends the login request message {IDi,M2,M3} to Si.


### 2.3. Authentication Phase

After receiving the request login message, the remote serverSi has to perform the following steps with the user Ci to authenticate each other.(A1)
Si checks the format of IDi.(A2)
If theIDi is valid, Si computes M4=h(IDi∥Xs) and M5=M2⊕M4.(A3)
Si verifies whether M3=h(M5) or not. If they are equal, Si computes the following equations, where Rs is a random number generated by the server:
(2)M6=M4⊕Rs,M7=h(M2‖M5),M8=h(Rs).(A4)
Then,Si sends the message {M6,M7,M8} to Ci.(A5)
After receiving the reply message,Ci verifies whether M7=h(M2∥Rc) or not. If they are equal, Ci computes M9=M6⊕M1.(A6)
Ci verifies whether M8=h(M9) or not. If they are equal, Ci computes M10=h(M6∥M9).(A7)
Then,Ci sends the message {M10} to Si.(A8)
After receiving the message,Si verifies whether M10=h(M6∥Rs) or not. If they are equal, Si accepts the user’s login request.


## 2.1. Registration Phase

Before logging in the remote serverSi, a user Ci initially has to register to the trusted registration centre Ri as the following steps.(R1)
Ci submits his identity IDi and password PWi to Ri through a secure channel. Also, the user submits his biometrics information Bi on the specific device to Ri.(R2)
Ri computes fi=h(Bi), ri=h(PWi)⊕fi and ei=h(IDi∥Xs)⊕ri, where Xs is a secret value generated by the server.(R3)
Ri stores (IDi,h(),fi,ei,ri) on the user’s smart card and sends it to the user via a secure channel.


## 2.2. Login Phase

When the userCi wants to log in the remote server Si, the user has to perform the following steps. (L1)
Ci inserts his smart card into a card reader and inputs the personal biometrics information Bi on the specific device to verify the user’s biometrics. If the biometrics information matches the template stored in the system, Ci passes the biometrics verification.(L2)
Ci inputs the IDi and PWi, and then the smart card computes ri′=h(PWi)⊕fi. If ri′ equals ri, the smart card computes the following equations, where Rc is a random number generated by the smart card:
(1)M1=ei⊕ri′M2=M1⊕RcM3=h(Rc)(L3)
Ci sends the login request message {IDi,M2,M3} to Si.


## 2.3. Authentication Phase

After receiving the request login message, the remote serverSi has to perform the following steps with the user Ci to authenticate each other.(A1)
Si checks the format of IDi.(A2)
If theIDi is valid, Si computes M4=h(IDi∥Xs) and M5=M2⊕M4.(A3)
Si verifies whether M3=h(M5) or not. If they are equal, Si computes the following equations, where Rs is a random number generated by the server:
(2)M6=M4⊕Rs,M7=h(M2‖M5),M8=h(Rs).(A4)
Then,Si sends the message {M6,M7,M8} to Ci.(A5)
After receiving the reply message,Ci verifies whether M7=h(M2∥Rc) or not. If they are equal, Ci computes M9=M6⊕M1.(A6)
Ci verifies whether M8=h(M9) or not. If they are equal, Ci computes M10=h(M6∥M9).(A7)
Then,Ci sends the message {M10} to Si.(A8)
After receiving the message,Si verifies whether M10=h(M6∥Rs) or not. If they are equal, Si accepts the user’s login request.


## 3. Security Analysis of Das’s Scheme

In this section, we will analyze the security of Das’s scheme. To analyze the security weaknesses, we assume that an attacker could obtain the secret values stored in the smart card by monitoring the power consumption [14, 15] and intercepting messages communicating between the user and the server. Under this assumption, we will discuss the various attacks, such as the user impersonation attack, the server masquerading attack, the password guessing attack, the insider attack, and the mutual authentication between the user and the server.


### 3.1. User Impersonation Attack

If the attacker can obtain the secret values (ei, ri) from the user’s smart card illegally by some means and intercept the message {IDi,M2,M3} in the login phase, the attacker can perform the user impersonation attack as the following steps. The procedure of the user impersonation attack is illustrated in Figure 1.(UA1)
The attackerAi computes the following equations, where Rac is a random number chosen by the attacker:
(3)Ma1=ei⊕ri,Ma2=Ma1⊕Rac,Ma3=h(Rac).(UA2)
Then,Ai sends the forged message {IDi,Ma2,Ma3} to the remote server Si.(UA3)
Upon receiving the forged message,Si checks the format of IDi. If it holds, Si computes M4=h(IDi∥Xs) and M5=Ma2⊕M4.(UA4)
Si verifies whether Ma3=h(M5) or not. If they are equal, Si will be convinced the message {IDi,Ma2,Ma3} sent from the legal user.(UA5)
Then,Si makes the reply message {M6,M7,M8} by computing M6=M4⊕Rs, M7=h(Ma2∥M5) and M8=h(Rs) in the authentication phase.Figure 1
User impersonation attack and server masquerading attack.


### 3.2. Server Masquerading Attack

If the attacker can obtain the secret values(ei,ri) from the user’s smart card illegally by some means and intercept the message {M2} in the login phase and {M6,M7,M8} in the authentication phase, the attacker can perform the server masquerading attack as the following steps. The procedure of the server masquerading attack is illustrated in Figure 1.(SA1)
The attackerAi computes the following equations, where Ras is a random number chosen by the attacker:
(4)Ma4=ei⊕ri,Ma5=M2⊕Ma4,Ma6=Ma4⊕Ras,Ma7=h(M2‖Ma5),Ma8=h(Ras).(SA2)
Then,Ai sends the forged message {Ma6,Ma7,Ma8} to the user Ci.(SA3)
Upon receiving the forged message,Ci checks whether Ma7=h(M2∥Rc) or not. If they are equal, Ci computes M9=Ma6⊕M1.(SA4)
Ci verifies whether Ma8=h(M9) or not. If it holds, Ci will be convinced the message {Ma6,Ma7,Ma8} sent from the legal server.(SA5)
Then,Ci makes the reply massage {M10} by computing M10=h(Ma6∥M9) in the authentication phase.


### 3.3. Password Guessing Attack

If an attacker can extract the secret values (ri,fi) from the legal user’s smart card by some means, the attacker can easily find out PWi by performing the password guessing attack, in which each guess PWi* for PWi can be verified as the following steps.(PA1)
The attackerAi computes the secret parameter ri*=h(PWi*)⊕fi from the registration phase.(PA2)
Ai verifies the correctness of PWi* by checking ri=ri*.(PA3)
Ai repeats the above steps until a correct password PWi* is found.Thus, the attacker can perform the password guessing attack, and can successfully impersonate the legal user with the guessed user password.


### 3.4. Insider Attack

In the registration phase, if the user’s passwordPWi and biometrics information Bi are revealed to the server, the insider of the server may directly obtain the user’s password and biometrics information. Thus, the insider of the server as an attacker can impersonate as the legal user to access the user’s other accounts in other server if the user uses the same password for the other accounts.


### 3.5. Mutual Authentication

Generally, if authentication scheme is insecure against user impersonation attack and server masquerading attack, the authentication schemes cannot provide mutual authentication between the user and the remote server. Therefore, Das’s scheme fails to provide mutual authentication as described in Sections3.1 and 3.2. Namely, if the attacker can obtain the secret values (ei, ri) from the legal user’s smart card by some means and intercept the messages communicating between the user and the server, the attacker can make the forged messages easily by computing Ma1=ei⊕ri, Ma2=Ma1⊕Rac, and Ma3=h(Rac) in the login phase. Also, the attacker can make the forged messages easily by computing Ma6=Ma4⊕Ras, Ma7=h(M2∥Ma5), and Ma8=h(Ras) in the authentication phase.


## 3.1. User Impersonation Attack

If the attacker can obtain the secret values (ei, ri) from the user’s smart card illegally by some means and intercept the message {IDi,M2,M3} in the login phase, the attacker can perform the user impersonation attack as the following steps. The procedure of the user impersonation attack is illustrated in Figure 1.(UA1)
The attackerAi computes the following equations, where Rac is a random number chosen by the attacker:
(3)Ma1=ei⊕ri,Ma2=Ma1⊕Rac,Ma3=h(Rac).(UA2)
Then,Ai sends the forged message {IDi,Ma2,Ma3} to the remote server Si.(UA3)
Upon receiving the forged message,Si checks the format of IDi. If it holds, Si computes M4=h(IDi∥Xs) and M5=Ma2⊕M4.(UA4)
Si verifies whether Ma3=h(M5) or not. If they are equal, Si will be convinced the message {IDi,Ma2,Ma3} sent from the legal user.(UA5)
Then,Si makes the reply message {M6,M7,M8} by computing M6=M4⊕Rs, M7=h(Ma2∥M5) and M8=h(Rs) in the authentication phase.Figure 1
User impersonation attack and server masquerading attack.


## 3.2. Server Masquerading Attack

If the attacker can obtain the secret values(ei,ri) from the user’s smart card illegally by some means and intercept the message {M2} in the login phase and {M6,M7,M8} in the authentication phase, the attacker can perform the server masquerading attack as the following steps. The procedure of the server masquerading attack is illustrated in Figure 1.(SA1)
The attackerAi computes the following equations, where Ras is a random number chosen by the attacker:
(4)Ma4=ei⊕ri,Ma5=M2⊕Ma4,Ma6=Ma4⊕Ras,Ma7=h(M2‖Ma5),Ma8=h(Ras).(SA2)
Then,Ai sends the forged message {Ma6,Ma7,Ma8} to the user Ci.(SA3)
Upon receiving the forged message,Ci checks whether Ma7=h(M2∥Rc) or not. If they are equal, Ci computes M9=Ma6⊕M1.(SA4)
Ci verifies whether Ma8=h(M9) or not. If it holds, Ci will be convinced the message {Ma6,Ma7,Ma8} sent from the legal server.(SA5)
Then,Ci makes the reply massage {M10} by computing M10=h(Ma6∥M9) in the authentication phase.


## 3.3. Password Guessing Attack

If an attacker can extract the secret values (ri,fi) from the legal user’s smart card by some means, the attacker can easily find out PWi by performing the password guessing attack, in which each guess PWi* for PWi can be verified as the following steps.(PA1)
The attackerAi computes the secret parameter ri*=h(PWi*)⊕fi from the registration phase.(PA2)
Ai verifies the correctness of PWi* by checking ri=ri*.(PA3)
Ai repeats the above steps until a correct password PWi* is found.Thus, the attacker can perform the password guessing attack, and can successfully impersonate the legal user with the guessed user password.


## 3.4. Insider Attack

In the registration phase, if the user’s passwordPWi and biometrics information Bi are revealed to the server, the insider of the server may directly obtain the user’s password and biometrics information. Thus, the insider of the server as an attacker can impersonate as the legal user to access the user’s other accounts in other server if the user uses the same password for the other accounts.


## 3.5. Mutual Authentication

Generally, if authentication scheme is insecure against user impersonation attack and server masquerading attack, the authentication schemes cannot provide mutual authentication between the user and the remote server. Therefore, Das’s scheme fails to provide mutual authentication as described in Sections3.1 and 3.2. Namely, if the attacker can obtain the secret values (ei, ri) from the legal user’s smart card by some means and intercept the messages communicating between the user and the server, the attacker can make the forged messages easily by computing Ma1=ei⊕ri, Ma2=Ma1⊕Rac, and Ma3=h(Rac) in the login phase. Also, the attacker can make the forged messages easily by computing Ma6=Ma4⊕Ras, Ma7=h(M2∥Ma5), and Ma8=h(Ras) in the authentication phase.


## 4. The Enhanced Scheme

In this section, we propose an enhanced Das’s scheme which not only can withstand the various attacks, but also provide mutual authentication between the user and the server. The enhanced scheme is divided into three phases: registration phase, login phase, and authentication phase.


### 4.1. Registration Phase

Before logging to the remote serverSi, a user Ci initially has to register to the trusted registration centre Ri as the following steps. The registration phase is illustrated in Figure 2.(R1)
Ci submits his identity IDi and password information (PWi⊕K) to Ri through a secure channel. Also the user submits his biometrics information (Bi⊕K) via the specific device to Ri, where K is a random number generated by Ci.(R2)
Ri computes fi=h(Bi⊕K), ri=h(PWi⊕K)⊕fi and ei=h(IDi∥Xs)⊕ri, where Xs is a secret value generated by the server.(R3)
Ri stores (IDi,h(),fi,ei) on the user’s smart card and sends it to the user via a secure channel. And Ci stores random number K into the smart card issued by Ri.Figure 2
Registration phase of the enhanced scheme.


### 4.2. Login Phase

When the userCi wants to login the remote server Si, the user has to perform the following steps. The login phase and authentication phase are illustrated in Figure 3.(L1)
Ci inserts his smart card into a card reader and inputs the biometrics information Bi on the specific device to verify user’s biometrics. If the biometrics information h(Bi⊕K) matches fi stored in the system, Ci passes the biometrics verification.(L2)
Ci inputs the IDi and PWi, and then the smart card computes the following equations, where Rc is a random number generated by the user:
(5)ri′=h(PWi⊕K)⊕fi,M1=ei⊕ri′,M2=M1⊕Rc,M3=h(M1‖Rc).(L3)
Ci sends the login request message {IDi,M2,M3} to Si.Figure 3
Login phase and authentication phase of the enhanced scheme.


### 4.3. Authentication Phase

After receiving the request login message, the remote serverSi has to perform the following steps with the user Ci to authenticate each other.(A1)
Si checks the format of IDi.(A2)
If theIDi is valid, Si computes M4=h(IDi∥Xs) and M5=M2⊕M4.(A3)
Si verifies whether M3=h(M4∥M5) or not. If they are equal, Si computes the following equations, where Rs is a random number generated by the server:
(6)M6=M4⊕Rs,M7=h(M4‖Rs).(A4)
Then,Si sends the message {M6,M7} to Ci.(A5)
After receiving the reply message,Ci computes M8=M6⊕M1 and verifies whether M7=h(M1∥M8) or not. If they are equal, Ci computes M9=h(M1∥Rc∥M8).(A6)
Then,Ci sends the message {M9} for authentication to Si.(A7)
After receiving the message,Si verifies whether M9=h(M4∥M5∥Rs) or not. If they are equal, Si accepts the user’s login request.


## 4.1. Registration Phase

Before logging to the remote serverSi, a user Ci initially has to register to the trusted registration centre Ri as the following steps. The registration phase is illustrated in Figure 2.(R1)
Ci submits his identity IDi and password information (PWi⊕K) to Ri through a secure channel. Also the user submits his biometrics information (Bi⊕K) via the specific device to Ri, where K is a random number generated by Ci.(R2)
Ri computes fi=h(Bi⊕K), ri=h(PWi⊕K)⊕fi and ei=h(IDi∥Xs)⊕ri, where Xs is a secret value generated by the server.(R3)
Ri stores (IDi,h(),fi,ei) on the user’s smart card and sends it to the user via a secure channel. And Ci stores random number K into the smart card issued by Ri.Figure 2
Registration phase of the enhanced scheme.


## 4.2. Login Phase

When the userCi wants to login the remote server Si, the user has to perform the following steps. The login phase and authentication phase are illustrated in Figure 3.(L1)
Ci inserts his smart card into a card reader and inputs the biometrics information Bi on the specific device to verify user’s biometrics. If the biometrics information h(Bi⊕K) matches fi stored in the system, Ci passes the biometrics verification.(L2)
Ci inputs the IDi and PWi, and then the smart card computes the following equations, where Rc is a random number generated by the user:
(5)ri′=h(PWi⊕K)⊕fi,M1=ei⊕ri′,M2=M1⊕Rc,M3=h(M1‖Rc).(L3)
Ci sends the login request message {IDi,M2,M3} to Si.Figure 3
Login phase and authentication phase of the enhanced scheme.


## 4.3. Authentication Phase

After receiving the request login message, the remote serverSi has to perform the following steps with the user Ci to authenticate each other.(A1)
Si checks the format of IDi.(A2)
If theIDi is valid, Si computes M4=h(IDi∥Xs) and M5=M2⊕M4.(A3)
Si verifies whether M3=h(M4∥M5) or not. If they are equal, Si computes the following equations, where Rs is a random number generated by the server:
(6)M6=M4⊕Rs,M7=h(M4‖Rs).(A4)
Then,Si sends the message {M6,M7} to Ci.(A5)
After receiving the reply message,Ci computes M8=M6⊕M1 and verifies whether M7=h(M1∥M8) or not. If they are equal, Ci computes M9=h(M1∥Rc∥M8).(A6)
Then,Ci sends the message {M9} for authentication to Si.(A7)
After receiving the message,Si verifies whether M9=h(M4∥M5∥Rs) or not. If they are equal, Si accepts the user’s login request.


## 5. Security Analysis of the Enhanced Scheme

In this scheme, we will provide the security analysis of the enhanced scheme based on the password and biometrics information. To analyze the security of the enhanced scheme, we assume that an attacker can access a user’s smart card and extract the secret values stored in the smart card by some means [14, 15], and intercept the messages communicating between the user and the server.


### 5.1. User Impersonation Attack

To impersonate as the legitimate user, an attacker attempts to make a forged login request message which can be authenticated to the server. However, the attacker cannot impersonate as the legitimate user by forging the login request message even if the attacker can extract the secret values(fi,ei) stored in the user’s smart card, because the attacker cannot compute the login request message (M2,M3) without knowing the secret value Xs kept by the server. Hence, the attacker has no chance to login to the enhanced scheme by launching the user impersonation attack.


### 5.2. Server Masquerading Attack

To masquerade as the legitimate server, an attacker attempts to make the forged reply message which can be masqueraded to the user when receiving the user’s login request message. However, the attacker cannot masquerade as the server by forging the reply message, because the attacker cannot compute(M6,M7) sending to the user without knowing the secret value Xs kept by the server. Hence, the attacker cannot masquerade as the legitimate server to the user by launching the server masquerading attack.


### 5.3. Password Guessing Attack

After the attacker extracts the secret values(fi,ei,K) stored in the user’s smart card under the described assumption, the attacker attempts to derive the user’s password PWi using ri=h(PWi⊕K)⊕fi in the registration phase. However, the attacker cannot guess the user’s password PWi using the secret values extracted from the legitimate user’s smart card, because the attacker cannot compute the secret value ri without knowing the secret value Xs kept by the server.


### 5.4. Insider Attack

In the registration phase, if the user’s passwordPWi and the biometrics information Bi are revealed to the server, the insider of the server may directly obtain PWi and Bi and impersonate as the user to access user’s other accounts in other server. But, the enhanced scheme is secure against the insider attack, because the user submits h(PWi⊕K) instead of PWi and h(Bi⊕K) instead of Bi.


### 5.5. Mutual Authentication

As described in Sections5.1 and 5.2, the enhanced scheme can withstand the user impersonation attack and the server masquerading attack, consequently the proposed scheme provides mutual authentication between the user and the remote server. Namely, even if the attacker can extract the secret values (fi,ei) stored in the user’s smart card, the user can be authenticated to the server and the server can be authenticated to the user. Because the attacker cannot make the login request message {IDi,M2,M3} and the reply message {M6,M7} without knowing the secret value Xs kept by the server.


### 5.6. Security Comparison of the Related Scheme and the Enhanced Scheme

The security analysis of the related scheme and the enhanced scheme is summarized in Table2. The enhanced scheme is relatively more secure than Li-Hwang’s and Das’s scheme. In addition, the enhanced scheme provides mutual authentication between the user and the server.Table 2
Security comparison of the related scheme and the enhanced scheme.
Security features
Li-Hwang’s scheme [12]
Das’s scheme [13]
Enhanced scheme
User impersonation attack
Possible
Possible
Impossible
Sever masquerading attack
Possible
Possible
Impossible
Password guessing attack
Possible
Possible
Impossible
Insider attack
Possible
Possible
Impossible
Mutual authentication
Not provided
Not provided
Provided


## 5.1. User Impersonation Attack

To impersonate as the legitimate user, an attacker attempts to make a forged login request message which can be authenticated to the server. However, the attacker cannot impersonate as the legitimate user by forging the login request message even if the attacker can extract the secret values(fi,ei) stored in the user’s smart card, because the attacker cannot compute the login request message (M2,M3) without knowing the secret value Xs kept by the server. Hence, the attacker has no chance to login to the enhanced scheme by launching the user impersonation attack.


## 5.2. Server Masquerading Attack

To masquerade as the legitimate server, an attacker attempts to make the forged reply message which can be masqueraded to the user when receiving the user’s login request message. However, the attacker cannot masquerade as the server by forging the reply message, because the attacker cannot compute(M6,M7) sending to the user without knowing the secret value Xs kept by the server. Hence, the attacker cannot masquerade as the legitimate server to the user by launching the server masquerading attack.


## 5.3. Password Guessing Attack

After the attacker extracts the secret values(fi,ei,K) stored in the user’s smart card under the described assumption, the attacker attempts to derive the user’s password PWi using ri=h(PWi⊕K)⊕fi in the registration phase. However, the attacker cannot guess the user’s password PWi using the secret values extracted from the legitimate user’s smart card, because the attacker cannot compute the secret value ri without knowing the secret value Xs kept by the server.


## 5.4. Insider Attack

In the registration phase, if the user’s passwordPWi and the biometrics information Bi are revealed to the server, the insider of the server may directly obtain PWi and Bi and impersonate as the user to access user’s other accounts in other server. But, the enhanced scheme is secure against the insider attack, because the user submits h(PWi⊕K) instead of PWi and h(Bi⊕K) instead of Bi.


## 5.5. Mutual Authentication

As described in Sections5.1 and 5.2, the enhanced scheme can withstand the user impersonation attack and the server masquerading attack, consequently the proposed scheme provides mutual authentication between the user and the remote server. Namely, even if the attacker can extract the secret values (fi,ei) stored in the user’s smart card, the user can be authenticated to the server and the server can be authenticated to the user. Because the attacker cannot make the login request message {IDi,M2,M3} and the reply message {M6,M7} without knowing the secret value Xs kept by the server.


## 5.6. Security Comparison of the Related Scheme and the Enhanced Scheme

The security analysis of the related scheme and the enhanced scheme is summarized in Table2. The enhanced scheme is relatively more secure than Li-Hwang’s and Das’s scheme. In addition, the enhanced scheme provides mutual authentication between the user and the server.Table 2
Security comparison of the related scheme and the enhanced scheme.
Security features
Li-Hwang’s scheme [12]
Das’s scheme [13]
Enhanced scheme
User impersonation attack
Possible
Possible
Impossible
Sever masquerading attack
Possible
Possible
Impossible
Password guessing attack
Possible
Possible
Impossible
Insider attack
Possible
Possible
Impossible
Mutual authentication
Not provided
Not provided
Provided


## 6. Conclusions

In this paper, we analyzed the security of Das’s scheme. And we have shown that Das’s scheme is not secure against the various attacks and fails to provide mutual authentication between the user and the server. Also, we proposed the enhanced scheme to overcome these security weaknesses, while preserving all their merits, even if the secret information stored in the smart card is revealed. As a result of security analysis, the enhanced scheme is secure against the user impersonation attack, the server masquerading attack, and the password guessing attack, the insider attack and provides mutual authentication between the user and the server.



---

*Source: 519723-2012-07-31.xml*