Security Enhanced Anonymous Two Factor Mutual Authentication Scheme with Key Agreement

2-1 User registration phase

This phase is performed once when user U registers with the server. User U selects ID_U, PW_U, and two random numbers r_U and r. And then smart catd computes PID_U = h ( ID_U || r_U ), RPW = h ( PW_U || r_U )⊕ r. And U sends the registration request { ID_U , RPW } to S using a further secure communication. Server S computes M, N as follows. M = h ( PID_U || ID_S || k ), N = M ⊕ RPW. And then, server S puts {N, P, Pub_S , h(∙) } on user U’s smart card SC and send it to U. user U computes V₁, N', V₂ as follows. V₁= r_U ⊕ h ( ID_U || PW_U ), N′ = N_r = M ⊕ h ( PW_U || r_U ), V₂ = h ( PID_U || h ( PW_U || r_U )), And then, the U stores them on the received SC. SC includes the values {N′, V₁, V₂, P, Pub_S , h (∙)}. Figure 1 shows user registration phase of Reddy et al.’s Scheme.

Fig. 1.

User registration phase of Reddy et al.’s Scheme

2-2 Key agreement authentication phase

Figure 2 shows Key agreement authentication phase of Reddy et al.’s scheme. User U and server S can authenticate each other and compute a session key in mutual authentication with key agreement. U inputs smart card SC and inputs own ID_U and PW_U. SC computes r_U, PID_U. r_U = V₁ ⊕ h (ID_U ||PW_U ), PID_U = h ( ID_U || r_U ), and checks the accuracy V₂ ⊕ h ( PID_U || h ( PW_U || r_U )).

Fig. 2.

Key agreement authentication phase of Reddy et al.’s Scheme

If they are same, then the smart card SC generates a random number α and computes N_U, M , Y as follows. N_U = a∙ P , N`<sub>U</sub> = a∙ Pub<sub>S,</sub> M = N′⊕ h (PW<sub>U</sub> || r<sub>U</sub>), Y = h(PID<sub>U</sub> || N<sub>U</sub> || M ), And then, user U sends the REQUEST( AID<sub>U</sub> , N<sub>U</sub> , Y ) to server S. S computes N`_U , PID_U , M as follows. N`<sub>U</sub> = Pri<sub>S</sub> ∙ N<sub>U</sub> , PID<sub>U</sub> = AID<sub>U</sub> ⊕ N`_U, M = h ( PID_U ||ID_S || k ), And then, verifies Y = h ( PID_U ||N_U|| M ).

If they are same, server S authenticates U. if not, process stops. S generates a random number β and calculate X, N_S, SK_S, auth_S. X = M⊕β, N_S = β ∙ N`<sub>U</sub>, SK<sub>S</sub> = h ( PID<sub>U</sub> || N<sub>S</sub> || β ), auth<sub>S</sub> = h ( SK<sub>S</sub> || PID<sub>U</sub> || M ), And then, server S sends CHALLENGE(realm, X, auth<sub>S</sub> ) to user U. Then using receiving CHALLENGE messages, SC computes β, N`_S , SK_U as follows. β = M ⊕ X , N`<sub>S</sub> = β ∙ N`_U, SK_U = h ( PID_U || N`_S || β), And then, the server S verifies auth_S messages as follows. auth_S = h ( SK_U || PID_U || M ). If auth_S is same to h ( SK_U || PID_U || M ), U authenticates S and further computes auth_U. auth_U = h ( SK_U || PID_U || β ), And then, U sends the RESPONSE( realm, auth_U ) to server S. Server S checks auth_U = h ( SK_S|| PID_U || β ). If they are same, S accepts for next communication using computed session key SK_U = SK_S. If not, S drops the session key and stop the communication with U.

SK_U = h ( PID_U || N`_S || β ),

SK_S = h ( PID_U || N_S || β ).

2-3 Password changing phase

Reddy et al.’s protocol claims that users can freely update user’s passwords. The password change phase works as follows. U inserts SC and enters the existing user’s ID_U and PW_U. SC computes r_U. r_U=V₁⊕h(ID_U||PW_U). And SC checks calculated value and V₂ as follows. V₂ = h( PID_U|| h(PW_U|| r_U)). If V₂ = h(PID_U|| h ( PW_U || r_U )) are corresponding, then U derives M as follows. M=N′⊕ h(PW_U||r_U). A user U selects a new password PW_Unew and computes RPW^new, V₁^new, N′^new, V₂^new as follows. RPW^new=h (PW_U^new||r_U)⊕r, V₁^new= r_U ⊕ h ( ID_U||PW_U^new), N′^new=M⊕h(PW_U^new||r_U), V₂^new =h (PID_U || h(PW_U^new||r_U)). Then, S replaces existing values on the received SC. Thus, SC contains {N′^new, V₁^new, V₂^new, P, Pub_S, h(∙)}.

3-1 Off-line Password Guessing Attack

An attacker can reveal user’s identity and password from user’s smart card in Reddy et al.’s authentication scheme. the attacker can analyze the stored information of smart card using the simple power analysis or differential power analysis.[7-9] If the attacker steals the user’s smart card, and then the attacker obtains the all of information {N’, V₁, V₂, P, Pub_s, h(∙)} from smart card using physical monitoring. So the attacker can knows formula of all parameters such as V₂, PID_U and r_U.

V₂ = h ( PID_U || h ( PW_U||r_U), PID_U = h⊕(ID_U||r_U), r_U = V₁⊕ h(ID_U||PW_U).

The attacker can compute V₂=h(PID_U|| h(PW_U ||r_U) as follows. Using PID_U → V₂=h (h(ID_U ||r_U)||h( PW_U||r_U), Using r_U → V₂ = h(h(ID_U|| V₁⊕h(ID_U||PW_U))||h(PW_U||V₁ h(ID_U||PW_U)).

The attacker got V₁, V₂, h(∙) from U’s SC, and so does not know ID_U and PW_U on V₂ = h(h(ID_U ||V₁⊕h(ID_U||PW_U))||h(PW_U||V₁⊕h(ID_U|| PW_U)). The attacker can guess the ID_U and PW_U because they are both small size. |D_id| and |D_pw| defined the number of identities in D_id and the number of passwords in D_pw. If T_H is the running time for hash funtion, the running time of the aforementioned attack procedure is |D_id| * |D_pw| * T_H), because both PW and ID are human-memorable short strings but not high-entropy keys. So |D_id| and |D_pw| are often chosen from two corresponding dictionaries of small size. As |D_id| and |D_pw| are very limited in practice, |D_id|≤ |D_pw| ≤ 10⁶, the aforementioned attack can be completed inpolynomial time. Therefore the attacker can ID_U and PW_U using off-line password (and identity) guessing attack on Reddy et al.’s authentication scheme.

3-2 DoS Attack

Reddy et al.’s scheme has problem on A DoS attack. Their scheme use random number for preventing the replay attack but does not use timestamp so the scheme is weak on DoS. The attacker can obtain and intercept the previous authentication message {AID_U, N_U and Y} in the public communication. The attacker sends { AID_U, N_U and Y} again after authentication phase ends. But the server cannot found out that the message is previous message and cannot checks the legitimacy of incoming message because the server cannot check and know the freshness of message before auth_U is same to h(SK_S||PID_U||β). So the server executes various operation such as generating the random number operation, ∙ operation, hash operation, and exclusive OR operations before checking whether the attacker’s auth_U and computed h (SK_S||PID_U||β) are same. so the attacker can execute the DoS attack without difficulty.[7-9]

3-3 Wrong password change phase

Reddy et al.’s authentication scheme has procedural problem. If an user changes own password, first the user inputs ID_U and PW_U. So, the user’s SC computes r_U , M and verifies V₂ as follows. r_U=V₁⊕h(ID_U||PW_U), V₂=h(PID_U ||h(PW_U||r_U)), M = N′⊕ h ( PW_U || r_U).

And the user chooses a new password PW_U^new and have to compute RPW^new as follows. RPW^new = h (PW_U^new || r_U ) ⊕ r. But the user cannot compute RPW^new because the user does not know parameter r. parameter r does not store in the smart card and cannot compute r using other parameters. A parameter related r in smart card is only N’ as follows.

N = N ⊕ r , N = M ⊕ RPWN = h (PID_U ||ID_S || k ) ⊕ h(PW_U || r_U) ⊕ r→ N′= h(PID_U ||ID_S||k)⊕h(PW_U||r_U ⊕ r ⊕ r→ N′= h( PID_U||ID_S || k )⊕ h ( PW_U || r_U )

N’ does not contain the information about r because the parameter r is removed by ⊕ operation. So the user of Reddy et al.’s scheme cannot change the user’s password because user cannot calculate parameter r.

3.4 Session key disclosure attack

An attacker can calculate the session key SK including previous session key using SK. Reddy et al.’s authentication scheme is weak on session key disclosure attack. An attacker can obtains all of AID, X including previous AID, X in public communication In this scheme, Using an power analysis, an attacker found out user’s smart card, the attacker can extracts all information from the smart card. And he can compute user’s ID_U and PW_U using the stored information. So he has AID, X, ID_U, PW_U, N’, and V₁, so he can calculate the session key.

r_U = V₁h ( ID_U || PW_U ),

PID_U = h (ID_U || r_U ) [ using computed r_U ],

N`_U = AID_U⊕PID_U [using computed PID_U ],

M = N′⊕ h(PW_U ||r_U) [using computed r_U],

β = MX [using computed M ],

N_S = β ∙ N`_U [using computed β ]

→ SK_U = h ( PID_U || N`_S || β )

The attacker computes all formula's parameter of session key SK_U = h (PID_U || N`_S || β ). It is important that the attacker can computes all of session key including previous session key.

4-1 System initialization phase

Before the protocol is ever executed, this scheme computes and shares the secret.

(1) S generates a point P on an elliptic curve E(a, b) over F_p.

(2) S selects h(∙) and Pri_S , and calculates Pub_S = Pri_S ∙ P.

(3) S stores Pri_S and publishes {E(a, b), P, Pub_S, h(∙) }.

4-2 User registration phase

For a user U, this phase is executed once when User U registers itself with the server.

(1) User U selects ID_U and two random numbers r_U and r. Then U imprints biometrics BIO_i and Generate R_i, P_i and PID_U, RPW.

Gen(BIO_i’) = < R_i , P_i > ,

PID_U = h ( ID_U || r_U ) , RPW = h ( PW_U || r_U )⊕r

And U sends registration request { ID_U , RPW } to S using a secure communication.

(2) S calculates M, N as follows;

M = h ( PID_U || ID_S || k ), N = M⊕RPW

And then, S inputs { N, P, Pub_S , h(∙) } on user’s smart card SC and send it to U .

(3) U computed V₁ , N′, V₂, V₃ as follows.

V₁= r_U⊕ h(ID_U|| PW_U,

N′= N ⊕ r = M ⊕ h (PW_U || r_U),

V₂ = h(PID_U|| h(PW_U|| r_U )),

V3 = r ⊕ h( ID_U || R_i || r_U ))

And then, U stores them on the received smart card SC. Therefore SC(Smart Card) stores { N , V₁ ,V₂ , V₃ , P, P_i , Pub_S , h (∙)}. Figure 3 shows user registration phase of proposed scheme.

Fig. 3.

User registration phase of proposed scheme

4-3 Key agreement authentication phase

This paper proposed secure authentication scheme with key-agreement phase, user U and server S can authenticate each other and the they compute a session-key of them. Figure 4 shows the process of authentication phase.

Fig. 4.

Key agreement authentication phase of proposed scheme

(1) U inserts SC and enters ID_U and imprint BIO_i. Then SC computes R_i, r_U, and PID_U .

R_i = Rep(BIO’_i, P_i), r_U = V₁ ⊕ h ( ID_U || PW_U ) , PID_U = h ( ID_U || r_U ). And checks the accuracy of V₂ . V₂ = h ( PID_U || h ( PW_U || r_U )). And then the SC generates a random number α and computes N_U, AID_U, timestamp T₁, M , Y as follows;

N_U = a ∙ P , N`<sub>U</sub> = a∙ Pub<sub>S</sub> , AID<sub>U</sub> = PID<sub>U</sub> ⊕ N`_U, M = N′⊕ h (PW_U || r_U), Y = h (PID_U || N_U || M || U). User U sends the REQUEST( AID_U, N_U, Y, T₁ ) to server S.

(2) S checks the received timestamp T₁, and calculates N`<sub>U</sub> , PID<sub>U</sub>, M. N`_U = Pri_S ∙N_U , PID_U = AID_U ⊕N`_U, M = h( PID_U ||ID_S || k ).

And then, verifies Y = h ( PID_U ||N_U|| M|| T₁). If they are not same, process aborts. S generates a random number β and computes X, N_S, SK_S, auth_S , S’s timestamp T₂. X = M⊕β , N_S = β ∙ N`_U , SK_S = h( PID_U || N_S || β ), Generate T₂, auth_S = h (SK_S|| PID_U || M ||T₂).

S sends CHALLENGE(realm, X, auth_S, T₂) to U.

(3) U receives CHALLENGE messages, SC checks timestamps T₂ and computes β, N`_S, SK_U.

β = M ⊕ X, N`<sub>S</sub> =β∙N`_U, SK_U= h (PID_U || N`_S || β )And then checks auth_S messages as follows;

auth_S = h ( SK_U || PID_U || M || T₂ )

If auth_S is same to h ( SK_U||PID_U||M|| T₂ ), U generates T₃ and computes auth_U. auth_U = h ( SK_U || PID_U || β || T₃ ). And then, U sends the RESPONSE(realm, auth_U ) to server S.

(4) S checks T₃ and auth_U = h ( SK_S|| PID_U || β ). If they are same, S computed session key SK_U = SK_S for using next communication.

4-4 Biometrics updating phase

Proposed scheme allows users to freely update biometrics on biometrics updating phase as shown in Figure 5.

Fig. 5.

Biometrics updating phase of proposed scheme

(1) U inserts SC and enters the own user’s ID_U and imprint BIO’_i. SC computes R_i, r_U, r as follows ; R_i = Rep(BIO’_i, P_i ), r_U = V₁ ⊕ h ( ID_U || R_i), r = V₃ ⊕ h(ID_U || R_i || r_U )). And then, SC verifies the computed value and V₂ as follows; V₂ = h( PID_U || h (R_i || r_U )). If V₂ = h( PID_U || h ( R_i || r_U )) are same, then U imprint new BIO_i , generate new R_inew and P_inew and compute M = N′⊕ h( R_inew|| r_U).

(2) U computes RPW^new, V_1new, V_2new, V_3new, , N′_new as follows; RPW^new = h (R_inew|| r_U )⊕r,

V_1new = r_U ⊕ h ( ID_U || R_inew ),

N′_new = M ⊕ h ( R_inew || r_U ),

V_2new = h ( PID_U || h ( R_inew||r_U )),

V_3new = r ⊕ h(ID_U || R_inew || r_U)).

And then, user U replaces the existing values on the smart card as follows.

{N′_new, V_1new, V_2new, P , P_{inew ,} Pub_S , h(∙)}.