Abstract:

In this paper, it was pointed out that a recent smartcard-based password authentication scheme with Perfect Forward Secrecy (PFS) cannot achieve the claimed security and its following flaws were reported: 1) It is vulnerable to offline password guessing attack and key compromise impersonation attack; 2) It has the problems of no poor reparability and time-synchronization. As our main contribution, an improved scheme was presented and analyzed. The analysis shows that our new scheme eliminates the defects of Hao et al.’s scheme while keeping the merit of high performance, and it is suitable for applications in distributed networks.

Key words: authentication; smart card; offline password guessing attack; perfect forward secrecy