Cryptology ePrint Archive: Report 2009/490

Cryptanalysis of Multiple-Server Password-Authenticated Key

Sang-Gon Lee

Abstract: Password-based user-authentication schemes have been widely used when users access a server to avail internet services. Multiserver password-authentication schemes enable remote users to obtain service from multiple servers without separately registering with each server. In 2008, Jia-Lun Tsai proposed an improved and efficient password-authenticated key agreement scheme for a multiserver architecture based on Chang-Lee’s scheme proposed in 2004. However, we found that Tsai’s scheme does not provide forward secrecy and is weak to insider impersonation and denial of service attacks. In this article, we describe the drawbacks of Tsai’s scheme and provide a countermeasure to satisfy the forward secrecy property.

Category / Keywords: Multiserver Password-authentication, Insider Impersonation Attack, DoS Attack

Date: received 5 Oct 2009, last revised 16 Nov 2009

Contact author: nok60 at gdsu dongseo ac ktr

Available formats: PDF | BibTeX Citation

Version: 20091116:115101 (All versions of this report)

Discussion forum: Show discussion | Start new discussion