TELKOM
NIKA Indonesia
n
Journal of
Electrical En
gineering
Vol. 12, No. 10, Octobe
r 20
14, pp. 7353
~ 736
0
DOI: 10.115
9
1
/telkomni
ka.
v
12i8.525
9
7353
Re
cei
v
ed
De
cem
ber 1, 20
13; Re
vised Ju
ly 8, 201
4; Accepted
Jul
y
30, 2014
A Security Enhanced P
assword Authentication and
Update Scheme Based on Elliptic Curve Cryptography
Hang Tu
Schoo
l of Math
ematics an
d Statistics,
W
uhan
Universit
y
, W
uhan, Ch
in
a 430
072
email: tuh
a
n
g
2
013
@16
3
.com
A
b
st
r
a
ct
As tw
o
funda
me
ntal re
quir
e
me
nts to ensu
r
e secu
re co
mmu
n
ic
ations o
v
er an ins
e
cur
e
pub
li
c
netw
o
rk chan
n
e
l, passw
ord
a
u
thentic
atio
n a
nd u
p
d
a
te of p
a
ssw
ord hav
e
receiv
ed co
nsi
dera
b
le
attenti
on.
T
o
satisfy the
ab
ove tw
o r
e
quir
e
ments, Isl
a
m et
al
.
pro
pose
d
a p
a
ss
w
o
rd auth
entic
ation
a
nd
up
d
a
te
sche
m
e
bas
ed
on
el
liptic
cur
v
e crypto
grap
h
y
. T
hey cla
i
me
d that th
eir sc
he
me
cou
l
d w
i
t
hstand v
a
rio
u
s
attacks. Unfort
unate
l
y, He
et
al. fou
nd Isl
a
m
et al.
’
s sc
he
me
is still
vul
ner
a
b
le to
off-li
ne
p
a
ssw
ord g
uess
i
ng
attack and stol
en-verifi
er atta
ck. In this pap
er, a secu
rity e
nha
nce
d
sche
m
e is
dev
elo
p
ed to el
i
m
in
ate
the
ide
n
tified
w
e
a
k
nesses. T
h
e
an
alysis
sh
o
w
s that our
sche
m
e
can
not o
n
ly
over
come th
e s
e
c
u
rity
vuln
erab
ility
in
Islam et a
l
.
’
s s
c
he
me,
but a
l
s
o
h
a
s
b
e
tter pe
rforma
nce t
han
their sc
he
me.
Then
our sc
he
me
is mor
e
suita
b
l
e
for practical
app
licati
ons.
Ke
y
w
ords
:
passw
ord aut
h
enticati
on, el
lip
tic curve cryp
to
grap
hy, off-line
passw
ord gu
e
ssing attack,
stolen-v
e
rifier attack
Co
p
y
rig
h
t
©
2014 In
stitu
t
e o
f
Ad
van
ced
En
g
i
n
eerin
g and
Scien
ce. All
rig
h
t
s reser
ve
d
.
1. Introduc
tion
With the adv
ancement a
n
d
tremen
dou
s devel
o
p
me
nt of commu
nicatio
n
tech
nology,
comm
uni
cati
on networks
have bro
ught
conveni
en
ce
to
people a
s
well as the p
o
tential threat
of
se
curity
p
r
o
b
l
e
ms. Ho
weve
r,
the cu
rre
nt comm
uni
cati
on
n
e
two
r
ks are not
yet secu
re, su
ch
t
hat
remote
serv
ers could
be cra
c
ked,
co
mm
uni
ca
tion content
co
uld
be
eave
s
drop
ped,
authenti
c
atio
n messa
g
e
s
could b
e
modified,
an
d identities
coul
d be im
person
a
ted.
User
authenti
c
atio
n is the esse
ntial se
curity
mecha
n
ism to overco
me
the above problem
s. Due
to
simpli
city and
convenie
n
ce
for providing
an effi
cient and accu
rate
way to identify valid remote
use
r
s,
pa
ssword b
a
sed
authe
nticati
on
schem
e
has be
com
e
one
of the
most
promi
s
ing
techni
que
s to
secure Inte
rn
et base
d
appl
ication
s
.
In 1981, La
mport [1] pro
posed the first
passwo
r
d
authenti
c
atio
n schem
e for netwo
rk
comm
uni
cati
ons. Ho
weve
r,
Lam
po
rt’s scheme
i
s
vu
lnera
b
le to re
ply attack an
d stolen
-verifi
e
r
attack [2]. To
improve the
se
curity and
perfo
rman
ce,
Peyravian et al. [3] propo
sed a p
a
ssword
authenti
c
atio
n and
pa
ssword
cha
nge
schem
es u
s
ing
only
col
lision
-
resi
stan
t one-way
h
a
sh
function. Ho
wever, L
ee a
t
el. [4] demonstrate
d
t
hat Peyravian et al.’s sche
me
[3] suffers fro
m
off-line p
a
ssword g
u
e
ssi
n
g
attack. Th
e
y
also
pr
opo
sed an
imp
r
ov
ed
scheme.
Unfortu
nately
,
Ku
et al. [5] poi
n
t
ed out th
at L
ee et
al.’s
scheme [4
] i
s
v
u
lnerable
to
servi
c
e
attack (DoS
), stol
en-
verifier attack and off-lin
e password gue
ssi
ng a
ttack. In 2004
, Yoon et al. [6] propose
d
an
improvem
ent
of Lee
et al
.’s sche
me.
Ho
wever, Ku
et al. [7] ha
ve sho
w
n
th
at Yoon et
a
l
.'s
scheme
is vu
lnera
b
le to
of
f-line g
u
e
ssi
n
g
attack
,
stol
en-ve
rifier
attack a
nd thei
r schem
e d
oes
not provide f
o
rward se
cre
c
y.
In 2002, Hwang et al. [8] demonst
r
ated that Peyravian et al.’s
scheme
[3] i
s
vuln
erable
to p
a
ssword gu
essin
g
attac
k
,
s
e
rver s
p
oofing attac
k
and
data
eavesdro
ppin
g
attack. The
also p
r
op
osed an imp
r
ov
ed sche
me u
s
ing p
ubli
c
key crypto
syst
em.
Ku et al. [9]
p
o
inted th
at Hwan
g et
al.’s
scheme
is
vul
nera
b
le to
th
e re
play atta
ck. Lin
et al. [1
0]
also
pointe
d
out that Hwa
ng et al.’s scheme[8]
suffe
rs
from DoS attack and d
oes not
p
r
ovi
des
perfe
ct forwa
r
d secre
c
y and afterward
prop
ose
d
.
In 2006, Peyravian et al. [11] pro
p
o
s
ed
a
se
curity en
h
anced
sch
e
m
e ba
sed
o
n
Peyravian
et
al.’s
work
[3]. Shim [11] c
l
aimed tha
t
Peyravian an
d Jeffrie
s’s
schem
e suffe
rs from
off-lin
e password gue
ssi
ng and
DoS attacks. In
2006, Ch
ang
et al.
[13] propo
sed a ne
w pa
ss
wo
rd authenti
c
atio
n
sc
heme b
a
s
ed on
symm
etric
key
crypto
system. Ho
weve
r, appli
c
atio
n
of symmetr
i
c
key di
strib
u
tion was a b
u
rden o
n
the
u
s
er
as the sym
m
etric
key e
x
chan
ge is
an immen
s
e
challe
nge o
v
er the unre
liable net
works.
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 23
02-4
046
TELKOM
NI
KA
Vol. 12, No. 10, Octobe
r 2014: 735
3
– 7360
7354
Re
cently, Zh
u et al. [14] propo
se
d an e
nhan
ce
d
sch
e
me to elimin
ate the wea
k
nesse
s of Hwang
et al.’s sche
me, based
on publi
c
key encrypt
ion/decryption
with timest
amp and
sa
lting
techni
que. Howeve
r, Zhu
et al. have
the se
rio
u
s clock syn
c
hroni
zatio
n
p
r
oble
m
due
to
timestamp, a
nd the tru
s
ted
platform mod
u
le (TPM
) put
s a burden o
n
the use
r
.
To imp
r
ove
the sy
stem
se
curity, ma
ny sm
a
r
t
ca
rd ba
se
d p
a
ssword
auth
e
n
tication
scheme
s
hav
e be
en p
r
o
p
o
s
ed
in the
la
st decays
(e
.g.
,
[15-22]
). Ho
wever, th
ese
solutio
n
s tend
to still be v
u
lnerable to som
e
s
ophisticated attacks
such
as offline pa
ssword di
ctionary
sea
r
ching, ob
servin
g po
we
r con
s
u
m
ptio
n, and physi
cally exposing
the chip to ex
tract the data
it
st
ore
s
.
B
e
si
d
e
s,
mo
st
ex
ist
i
ng sma
r
t
ca
rd ba
sed
sc
h
e
mes a
r
e v
u
l
nera
b
le t
o
st
olen/
lo
st
sma
r
t
card attack [
23], beca
u
se
some
sen
s
it
ive verifi
er a
nd se
cret values
stored in
the sma
r
tca
r
d
whi
c
h can b
e
extracte
d
by monitorin
g
their ti
min
g
inform
ation
,
powe
r
con
s
umption [24]
and
reverse e
ngi
neeri
ng te
ch
nique
s a
s
me
ntioned by K
o
ch
er et al. [25] and Me
sserge
s et al. [26].
Therefore if
an adve
r
sary
steal
s a sm
artca
r
d
of
a legitimate u
s
e
r
, he can u
s
e it to prod
u
c
e a
fabricated log
i
n messag
e, and then imp
e
rsonate a
s
a legal user.
In addition, tampe
r
-re
s
ista
nt
card rea
ders are
not avail
able everywh
e
re
[27
], the
sma
r
t card b
a
se
d a
u
thenti
c
ation
sch
e
m
e
s
prop
osed in [15-2
2
] are n
o
t
practi
cal for
real worl
d.
Very re
ce
ntly, Islam et
al.[28] propo
se
d
a pa
ssword
authenti
c
atio
n and
up
date
schem
e
based on elli
ptic cu
rve cry
p
togra
phy to satisfy t
he re
quire
ment of appli
c
ation
s
. Ho
wever, He
e
t
al. [29] pointe
d
out that I
s
la
m et al.’s sch
e
me i
s
vuln
erable to
off-lin
e pa
sswo
rd
g
uessin
g
atta
ck
and stol
en-v
e
rifier atta
ck.
In this pap
er, we
will
prop
ose a secu
rity enha
nce
d
schem
e to
overcome
se
curity
wea
k
n
e
sse
s
. Th
e remaind
e
r of
t
h
is
pap
er i
s
o
r
gani
ze
d a
s
f
o
llows. Se
ction 2
prop
oses
our improve
d
scheme.
Th
e secu
rity analy
s
is
of the pr
o
posed
schem
e is p
r
e
s
ente
d
in
Section 3. In Section 4, perform
an
ce a
nd se
cu
rity analysi
s
are p
r
esented. So
me con
c
lu
sio
n
s
are given in S
e
ction 5.
2. Our Improv
ed
Scheme
Like
Isla
m e
t
al.’s
schem
e, ou
r
sche
me al
so
con
s
ist
s
of
four pha
se
s:
Re
gistratio
n
pha
se, Pa
ssword a
u
thenti
c
ation
pha
se,
Password
chang
e ph
ase
and Se
ssion
key di
strib
u
tion
phase. In order to facilitat
e futu
re
references, f
r
equently used
notations are l
i
sted
below
with
their de
scripti
ons.
a)
,
pn
: two large p
r
i
m
e numb
e
rs;
b)
p
F
: a finite field;
c)
()
p
EF
: an ellipti
c curve over
p
F
defined by th
e
equatio
n
23
y
xa
x
b
, where
,
p
ab
F
and
32
42
7
0
ab
;
d)
G
: the cyclic
additive gro
u
p
con
s
i
s
ting
of points on
()
p
EF
and a sp
eci
a
l point
calle
d infinite point;
e)
P
: a generato
r
point of
G
with the orde
r
n
;
f)
A
I
D
: Identity of th
e use
r
A
;
g)
A
pw
: Secret pa
ssword of the user
A
.
h)
S
d
: Secret key o
f
the server
S
.
i)
S
U
: Public key o
f
the server
S
, where
SS
Ud
P
.
j)
A
U
: Password-v
erifier of the u
s
er
A
, where
AA
Up
w
P
.
k)
x
K
: Secret
key co
mputed eit
her u
s
in
g
(,
)
AS
x
y
K
pw
U
K
K
or
(,
)
SA
x
y
K
dU
K
K
.
l)
()
k
E
: Symmetric encryptio
n (AE
S
) with
k
.
m)
()
H
: A collision-resi
stant one-way
secure hash function.
n)
/
AS
rr
: Random n
u
m
bers cho
s
e
n
by the user/
s
erve
r from
[1
,
1
]
n
respec
tively.
o)
/
: Elliptic curv
e point additi
on/su
btra
ctio
n.
2.1. Registra
tion Phase
In this ph
ase
,
everyone
who w
ants to
registe
r
at the
serve
r
sho
u
l
d
su
bmit his
identity
and pa
ssword-verifie
r to the serve
r
. The
det
ail of the pha
se is d
e
scribed a
s
follo
ws.
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
2302-4
046
A Securit
y
Enhan
ced Pa
ssword Authenti
c
ation a
nd Update Sch
e
m
e
Based o
n
…
(Han
g Tu)
7355
1) The u
s
e
r
A
choo
se
s hi
s identity
A
I
D
, passwo
r
d
A
p
w
, computes th
e password-
ver
i
fier
AA
Up
w
P
and send
s
A
I
D
and
A
U
to
the s
e
rver
S
.
2) After
re
cei
v
ing
A
I
D
and
A
U
,
S
comp
utes
()
Ax
A
VE
U
and
store
s
A
I
D
,
A
V
, and
a
s
ta
tus
b
it
in a
write p
r
otected
file,
whe
r
e th
e
s
ta
tus
b
it
in
dicate
s th
e
status
of the
u
s
er,
i.e.,
whe
n
the use
r
is logg
ed
-in
to the serve
r
the statu
s
-bit i
s
set to one,
otherwise it is set to zero.
2.2. Pass
w
o
r
d
Auth
entic
a
t
ion Phase
O
n
ce
th
e
us
er
A
wants to l
o
gin to the
server
S
, as shown in Fig. 2, he will perform
the
followin
g
logi
n step
s.
1) The u
s
e
r
A
inputs hi
s ide
n
tity
A
I
D
and the password
A
pw
into the terminal
. The use
r
sele
cts a
random
nu
m
ber
[1,
1
]
A
rn
, co
mp
utes
AA
S
Rr
U
,
()
AA
A
W
r
pw
P
an
d
1
(,
,
)
AA
A
hH
I
D
R
W
. Then
A
sen
d
s the message
11
{,
,
}
AA
M
ID
W
h
to
S
.
2) Upo
n
rece
iving
1
M
,
S
us
es
its
se
cr
e
t
k
e
y
x
to decr
ypt
A
V
and
gets
AA
Up
w
G
.
Then
S
computes
()
AA
A
Rx
W
U
and ve
rifies
wheth
e
r
1
h
and
(,
,
)
AA
A
H
ID
R
W
a
r
e e
qua
l. I
f
they are not
equal,
S
stops the sessio
n. Otherwise,
S
sele
cts a
ran
dom num
ber
[1
,
1
]
S
rn
,
comp
utes
SS
Rr
P
and
2
(,
,
,
)
AA
A
S
hH
I
D
R
W
R
. Then
S
send
s the me
ssage
22
{,
}
S
M
Rh
to
A
.
3) Up
on re
cei
v
ing
2
M
,
A
che
c
ks wh
ether
2
h
and
(,
,
,
)
AA
A
S
H
ID
R
W
W
are eq
ual
. If they
are
not
equ
al,
A
sto
p
s the
se
ssi
on.
Otherwise,
A
comp
utes
AA
S
A
S
K
r
R
rrP
an
d
3
(,
)
AA
hH
I
D
K
. At las
t,
A
sen
d
s the me
ssa
ge
33
{}
M
h
to
S
.
4) Up
on re
ce
iving
3
M
,
S
comp
utes
()
SS
A
A
A
S
K
r
W
U
rrP
and checks whethe
r
(,
)
AS
H
ID
K
and
3
h
are
equ
al. If they are
not equ
al,
S
rej
e
cts th
e u
s
e
r
login requ
est.
Otherwi
se,
S
granted the
A
’s login requ
e
s
t.
Figure 2. Password Auth
en
tication Pha
s
e of our Sch
e
m
e
2.3. Pass
w
o
r
d
Chang
e
Phase
This p
h
a
s
e will be invoke
d
if the user wants to chang
e his pa
sswo
rd from
A
pw
to
A
pw
.
T
h
e
us
er
A
and the serve
r
S
first exe
c
ute
step
s 1) and
2) in
sub
s
e
c
ti
on 2.2. The
n
the followi
ng
steps will be
executed.
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 23
02-4
046
TELKOM
NI
KA
Vol. 12, No. 10, Octobe
r 2014: 735
3
– 7360
7356
3) Up
on re
cei
v
ing
2
M
,
A
che
c
ks wh
ether
2
h
and
(,
,
,
)
AA
A
S
H
ID
R
W
W
are eq
ual
. If they
are not
eq
ual
,
A
stop
s the
se
ssi
on. Oth
e
rwi
s
e,
A
inpu
ts the n
e
w
p
a
ssword
A
pw
, compute
s
AA
Up
w
G
and
AA
S
A
S
K
r
R
rrP
. At las
t
,
A
send
s
3
{(
|
|
)
}
A
KA
A
ME
I
D
U
to
S
.
4) Up
on re
ce
iving
3
M
,
S
comp
utes
()
SS
A
A
A
S
K
r
W
U
rrP
and uses it to decry
pt
(|
|
)
A
K
AA
EI
D
U
. Then
S
checks
whethe
r
A
I
D
is inclu
ded i
n
the decryp
t
ion result. If it is no
t
inclu
ded,
S
r
e
je
c
t
s
th
e
us
er
’s
r
e
qu
es
t. O
t
h
e
r
w
i
se
,
A
accepts the re
qu
est and repla
c
e
s
A
V
with
()
Ax
A
VE
U
.
2.4.
Session ke
y
distribution phase
Once the
use
r
A
wants to lo
gin to the
se
rver
S
and g
e
n
e
rate
a sessi
on key for fut
u
re
comm
uni
cati
on, the phase
will be
executed.
T
he phase is simila
r wit
h
the password
authenti
c
atio
n ph
ase d
e
scribed
in
sub
s
ection
5.2.
T
he follo
win
g
t
w
o
step
s are
add
ed
to 3
)
and
4) se
pa
rately to generate the se
ssion
ke
y.
a)
The user
com
putes the fina
l sessio
n key
as
AA
SK
K
.
b)
The se
rver
co
mputes the fi
nal se
ssion
key as
SS
SK
K
.
3. Securit
y
A
n
aly
s
is
The foll
owin
g
se
cu
rity p
r
op
erties [30
-
32]:
re
play atta
ck, passwo
r
d
g
uessin
g
atta
ck, ma
n-
in-the
-middl
e
attack, stole
n
-verifie
r atta
ck, m
odification attack,
Dennin
g
-Sa
c
co
attack, mutu
al
authenti
c
atio
n, kno
w
n-key
security, session
key
se
curity, and perfect forwa
r
d
secrecy, mu
st be
con
s
id
ere
d
for the pro
p
o
s
e
d
scheme.
T
heorem 1
.
Our
scheme
can resi
st the
replay attacks.
Proof
. A replay attack is
an offensive
action
in whi
c
h an adve
r
sary imperso
n
a
tes or
deceives a
n
o
t
her legitimat
e
partici
pant
throug
h t
he reuse of information obtain
ed in a sche
me
[30, 31]. Sup
pose a
n
a
d
ve
rsa
r
y
A
interc
epts
11
{,
,
}
AA
M
ID
W
h
from
A
in Step
(1
) and
replay
s
it to imperso
nate
A
, where
AA
S
Rr
U
,
()
AA
A
Wr
p
w
P
and
1
(,
,
)
AA
A
hH
I
D
R
W
. Howev
e
r,
A
cann
ot com
pute a co
rrect
3
(,
)
AA
hH
I
D
K
and d
e
liver it to
S
in Step (3) u
n
le
ss
she
ca
n
c
o
rr
ec
tly gues
s pass
wor
d
A
pw
to obtai
n
A
rP
an
d gu
ess th
e ri
ght
A
r
from
A
rP
. When
A
tries
to gue
ss
A
r
from
A
rP
or
B
r
from
B
rP
, she
will face the DLP. On
the other hand, suppose
A
intercepts
22
{,
}
S
M
Rh
from
S
in Step (2) a
nd
replay
s it in o
r
de
r t
o
impe
rsonat
e
A
. For the
same
rea
s
on,
if
A
cann
ot gai
n the
co
rrect
A
r
from
()
AA
A
W
r
pw
P
,
A
will fi
nd out that
2
h
is
not eq
uivalen
t
to hi
s/her
co
mputed
(,
,
,
)
AA
A
S
H
ID
R
W
W
. Then,
A
will not
send
33
{}
M
h
ba
ck to
A
in Step (3). Therefo
r
e, the
prop
osed sch
e
me ca
n re
si
st again
s
t the
replay attacks.
Theorem 2
.
Our
scheme
can resi
st the
password g
u
essing atta
cks
Proof
. A gu
essing
attack in
volves an
ad
versa
r
y
–r
a
ndo
mly o
r
s
y
s
t
ema
t
ic
a
lly tr
ying
lo
n
g
-
term private keys (e.g., use
r
passwo
r
d
s
or se
rver
se
cret keys) o
ne
at a time, in a
hope of finding
the corre
c
t private key. Ensuri
ng that lo
ng-te
rm
priva
t
e keys are chosen from a
sufficiently la
rge
spa
c
e h
e
lp
s resi
st again
s
t exhau
stive searche
s
. Mo
st users, howe
v
er, sele
ct pa
sswo
rd
s from
a
small
sub
s
et
of the full pa
sswo
rd
spa
c
e. Such
wea
k
pa
sswo
rd
s
with a lo
w en
tropy are
ea
sily
gue
ssed by u
s
ing
so-call
e
d
dictiona
ry attacks [31].
An on
-line
pa
sswo
rd
gue
ssing
attack cannot
su
ccee
d, sin
c
e
S
ca
n
cho
o
se a
ppro
p
riate
trail interval
s.
On the oth
e
r hand, in a
n
o
ff-line pa
ssword gu
essin
g
attack, the
adversa
ry
A
ca
n
try to find
a
we
ak pa
ssword by
re
p
eatedly g
u
e
s
sing
po
ssible
pa
sswo
rd
s
and ve
rifying
th
e
corre
c
tne
s
s o
f
the gu
esse
s ba
sed
on
inf
o
rmatio
n o
b
ta
ined i
n
a
n
off-line ma
nne
r. I
n
ou
r
schem
e,
A
can gain kn
o
w
led
ge
of
11
{,
,
}
AA
M
ID
W
h
,
22
{,
}
S
M
Rh
and
33
{}
M
h
in Steps
(1),
(2
), an
d
(3),
re
sp
ectiv
e
ly. In order
to obtain
the
pa
sswo
rd
A
pw
of
A
;
A
first
gue
sse
s
p
a
ssword
A
pw
and the
n
com
putes
AA
A
rP
W
p
w
P
. By usi
ng
A
rP
and
SS
Rr
P
,
A
will
try to compute the
se
ssi
on key
AS
rr
P
. Ho
wev
e
r,
A
has to
brea
k t
he
CDHP to f
i
nd the
keyin
g
mate
rial
AS
rrP
from
A
rP
and
S
rP
to verify her guess
.
Therefore, th
e prop
osed schem
e ca
n re
sist
ag
ain
s
t the password g
uessin
g
attacks.
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
2302-4
046
A Securit
y
Enhan
ced Pa
ssword Authenti
c
ation a
nd Update Sch
e
m
e
Based o
n
…
(Han
g Tu)
7357
Theorem 3
.
Our
scheme
can resi
st the
man-in
-the
-middle attacks.
Proof
. Th
e
man-i
n
-the
-m
iddle
attack i
s
a
form of
active e
a
vesdrop
p
ing
in
whi
c
h th
e
adversa
ry m
a
ke
s in
dep
e
ndent
con
n
e
c
tion
s with
the victim
s a
nd relays
m
e
ssag
es
bet
wee
n
them, ma
king
them
believe
that they
are
talkin
g
di
re
ct
ly to ea
ch
oth
e
r
over a
priv
ate
conn
ectio
n
whe
r
e in
fact
the entire con
v
ersatio
n
i
s
controlle
d by t
he adve
r
sary
[31, 32]. A mutual pa
sswo
rd
A
pw
between
A
an
d
S
is u
s
e
d
to
prevent th
e
man-i
n
-the
-m
iddle
attacks.
The ill
egal
a
d
versary
Eve can
not p
r
etend
to b
e
A
or
S
to authe
nticate
sin
c
e
sh
e doe
s
not o
w
n th
e mutu
a
l
passwo
r
d
A
pw
. Therefo
r
e, the pro
p
o
s
ed
scheme
can
resi
st
again
s
t the man
-
in-th
e
-mid
dle atta
cks.
Theorem 4
. Our scheme can withsta
n
d
the
stolen-ve
rifier
attack.
Proof
: The stolen-ve
rifier
attack me
an
s that an ad
versa
r
y who
steal
s the pa
sswo
rd
verifier f
r
om
S
can
u
s
e it
directly to m
a
sq
uera
de
as a
legitimate u
s
e
r
in
a
user
a
u
thentication
pro
c
e
s
s [31,
32]. Se
rvers a
r
e
al
ways t
he ta
rget
of attacks.
T
he atta
cker
A
may acquire
()
Ax
A
VE
U
st
o
r
ed
in
S
. Howeve
r,
without kno
w
ing
S
’s se
cr
et
k
e
y
x
;
A
cann
ot forg
e a l
ogin
requ
est to
pa
ss th
e a
u
then
tication, a
s
A
U
is hidde
n in
()
x
A
EU
using
S
’s
s
e
cr
et key
x
, and thu
s
the co
rre
ctne
ss of the gu
essed p
a
ssword
A
pw
cannot
be verified e
v
en if he is a legal u
s
er.
Therefore, th
e prop
osed schem
e ca
n re
sist
ag
ain
s
t the stolen
-verifi
e
r attacks.
Theorem 5
. Our scheme can
resi
st
the
modification attacks.
Proof
. A modification attack is an attem
p
t by an adversary to mo
dify information in an
unauth
o
ri
zed
manne
r. This is an att
a
ck agai
nst
the integrity of the information[31]. The
adversa
ry
A
may modify the com
m
uni
ca
tion messa
g
e
s
11
{,
,
}
AA
M
ID
W
h
,
22
{,
}
S
M
Rh
an
d
33
{}
M
h
being tra
n
smitted over a
n
inse
cu
re n
e
t
work. Ho
wev
e
r, althou
gh
A
can m
odify them,
the pro
p
o
s
ed
scheme
ca
n
detect this
modificatio
n
attack, b
e
cau
s
e it ca
n verify not only the
equality of
AS
rrP
computed by
each party, but
also the correctn
ess of
11
{,
,
}
AA
M
ID
W
h
and
22
{,
}
S
M
Rh
tran
smitted
b
e
twee
n two
p
a
rties,
by vali
dating
2
h
a
nd
3
h
i
n
the
propo
sed
schem
e.
Therefore, th
e prop
osed schem
e ca
n re
sist
agains
t the modific
a
tion attac
k
s
.
Theorem 6
.
Our
scheme
can resi
st the
Denni
ng-S
a
cco attacks.
Proof
.
Th
e Dennig
-
Sa
cco attack
works whe
r
e
an
attacker comp
ro
mise
s an old se
ssi
on
key an
d trie
s
to find a lon
g
-
term
private
key (e.g.,
use
r
pa
ssword
or se
rver p
r
ivat
e key
)
or oth
e
r
se
ssi
on
keys[30]. Although an adve
r
sa
ry
A
can
obtai
n the fre
s
h
session
key
AS
s
kr
r
P
,
A
can
not o
b
tain
the
se
cret p
a
ssword
S
from
()
AA
A
W
r
pw
P
becau
se
A
will face the
DLP to
obtain
A
r
from
AS
rrP
. Therefore, the p
r
op
osed
scheme
ca
n
resi
st again
s
t
the Den
n
ing
-
Sacco
at
t
a
ck
s.
Theorem 7
. Our scheme can
p
r
ovide mutual
authe
ntication.
Proof
. Mutu
al
authe
nticatio
n me
an
s that
both u
s
e
r
an
d serve
r
a
r
e
authenti
c
ated
to e
a
ch
other withi
n
the sam
e
sch
e
me [31, 32]. It is
easy to
say that there is no one could co
mpute
a
valid
2
h
without the knowl
edge
A
pw
and the se
cret key
x
, since he has to comput
e
()
AA
A
A
Rx
W
U
x
r
P
from
()
AA
A
W
r
pw
P
,
S
Ux
P
and
will face to
CDHP. Th
en u
s
er
A
coul
d auth
e
n
t
icate
S
by checki
ng the vol
a
tility of
2
h
. W
e
als
o
k
n
ow
th
a
t
th
e
r
e
is
no
on
c
e
c
an
comp
ute
AA
S
A
S
K
r
R
rrP
from
()
AA
A
W
r
pw
P
and
SS
Rr
P
without the kn
o
w
led
ge
A
p
w
and
rand
om
num
ber
A
r
. Then
S
could
a
u
thenticate
A
be
che
c
king
the validity o
f
3
h
.
Therefore, th
e prop
osed schem
e ca
n provide mutual
authenti
c
atio
n.
Theorem 8
. Our scheme can
p
r
ovide known-key
se
curity.
Proof
. Known
-
key
se
curity mean
s that e
a
ch
run of an
authenti
c
atio
n and key agreement
scheme
between two com
m
unication e
n
tities (the
user an
d the
se
rver) sh
ould
prod
uce uni
q
u
e
se
cret keys; su
ch keys
a
r
e
call
ed
session
keys[30]. Knowin
g
a session key
AS
s
kr
r
P
and the
rand
om valu
es
A
r
and
S
r
are
usel
ess fo
r
computing
the
other sessio
n keys
AS
s
kr
r
P
, s
i
nce
without kno
w
ing
A
r
and
S
r
it is impo
ssi
ble
to compute
the se
ssi
on
key
s
k
. Theref
ore, the
prop
osed sch
e
me provide
s
the kno
w
n-key security.
Theorem 9
. Our scheme can
p
r
ovide session key
se
curity.
Proof
. Sessi
on key securi
ty means tha
t
at
the end of the key excha
nge, the
se
ssi
on
key is n
o
t known by an
yone but onl
y the two
communi
catio
n
entities (th
e
use
r
an
d the
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 23
02-4
046
TELKOM
NI
KA
Vol. 12, No. 10, Octobe
r 2014: 735
3
– 7360
7358
serve
r)[3
1
, 3
2
]. The
se
ssi
on
key
AS
s
k
rrP
is
not
kn
own by
an
yone b
u
t only
A
an
d
S
s
i
nc
e th
e
rand
om val
u
es
A
r
an
d
S
r
are
prote
c
ted
by
the
DLP a
n
d
the
se
cu
re
one
-way ha
sh fu
nctio
n
.
Nothin
g ab
ou
t this
se
ssi
on
key
AS
s
k
rrP
is
kn
o
w
n to
anybo
dy but
A
and
S
. The
r
efore, the
prop
osed sch
e
me provide
s
the sessio
n key security.
Theorem 10
. O
u
r
sc
he
me
c
a
n
pr
o
v
id
e
pe
r
f
e
c
t fo
rw
ar
d s
e
cr
ec
y.
Proof
. Perfe
c
t forward
se
cre
c
y me
an
s
that if
a long
-t
erm p
r
ivate
key (e.g., pa
ssword) i
s
comp
romi
se
d
,
this doe
s
no
t comp
romi
se
any ea
rlier
session
key
s
[30, 31]. If the passwo
r
d
A
pw
sha
r
ed betwe
en
A
and
S
is
compromised,
it does n
o
t all
o
w a
n
adve
r
sary
A
to determine the
se
ssi
on key
AS
s
k
rrP
for
the
pa
st session
s
and
decrypt
them,
sin
c
e
A
s
t
ill fac
e
s
the CDHP to
comp
ute the
se
ssi
on key
AS
rr
P
from the two extracte
d value
s
A
rP
and
S
rP
. Therefo
r
e, the
prop
osed sch
e
me sati
sfies
the prop
er
ty of perfec
t
forward s
e
crec
y.
4. Securit
y
a
nd Performa
nce Comp
ari
s
on
To the b
e
st
of our
kn
owl
edge, Isl
a
m
et al.’
s
sche
me [28] is s
uperi
o
r to
previously
prop
osed
scheme
s
[3-1
4], then we wil
l
just co
m
p
a
r
e our
schem
e with Islam
et al.’s sche
me
here. It i
s
necessa
ry to
the u
s
e
r
a
nd the
serv
er to
gen
erate sessio
n
key fo
r fut
u
re
comm
uni
cati
on, then we compa
r
e the p
e
rform
a
n
c
e
o
f
the se
ssi
on
key di
stributi
on ph
ase. T
a
ble
1 an
d T
able
2 sho
w
the
secu
rity and
p
e
rform
a
n
c
e
compa
r
ison
be
tween
ou
r
scheme
and
Isl
a
m
et al.’s schem
e, resp
ectivel
y
.
From
Tabl
e 1
,
we
kno
w
th
at Islam
et al
.’s sch
e
me i
s
vulnerable t
o
pa
sswo
rd
g
uessin
g
attack
and
st
olen-ve
rifier
a
ttack. Th
en o
u
r en
han
ce
d
scheme i
s
su
perio
r to Isl
a
m et al.’s sch
e
me
[28] by suppo
rting all security requirem
e
nts. It
is well kno
w
n that p
o
int addition,
hash ope
ratio
n
and
en/de
cry
p
tion o
peration may
be
i
gnored
co
mp
ared
with
pa
iring
s
o
p
e
r
ati
on a
nd
scal
ar
multiplicatio
n. Beside
s, pai
ring
s op
erati
on is
mo
re
complicated th
an scala
r
mul
t
iplication. Th
en
we ca
n co
ncl
ude that our
scheme h
a
ve
better
perfo
rmance Islam
et al.’s sche
m
e. Then ou
r
scheme i
s
m
o
re suitable f
o
r practi
cal a
pplication
s
.
Table 1. Security Comp
ari
s
on
Islam et al.’s
scheme[28]
Our scheme
Resistance to repla
y
attack
√
√
Resistance to passw
o
r
d gu
essing
attack
√
Resistance to man-in-th
e
-m
iddle
attack
√
√
Resistance to stolen-verifier attack
√
Resistance to modification attack
√
√
Resistance to Denning-Sacco atta
ck
√
√
Mutual authentication
√
√
Know
n-
key
security
√
√
Session key
secur
i
ty
√
√
Perfect for
w
a
r
d s
e
crec
y
√
√
Table 2. Perf
orma
nce Co
mpari
s
o
n
Islam et al.’s
scheme[28]
Our scheme
Communication entit
y
A S
A S
Pairings
operatio
n
0 2
0 0
Scalar
multiplicat
ion
4 3
3 3
Point
addition
1 1
1 1
Hash
operation
2 2
3 3
En/decr
y
ption
o
p
e
ration
1 1
0 0
5. Conclusio
n
In this pape
r, we have p
r
opo
se
d an i
m
prove
d
sch
e
me that ad
dre
s
ses the
kno
w
n
se
curity probl
ems. Compa
r
ed with Isla
m
et al
.’s sche
me, the pro
p
o
se
d sche
me
overcome
s the
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
2302-4
046
A Securit
y
Enhan
ced Pa
ssword Authenti
c
ation a
nd Update Sch
e
m
e
Based o
n
…
(Han
g Tu)
7359
se
curity
wea
k
ne
sse
s
an
d
ha
s bette
r
perfo
rman
ce.
The
r
efore, the p
r
op
osed
schem
e i
s
well
suited to the
pra
c
tical a
ppli
c
ation
s
environment.
Referen
ces
[1]
L Lamport. Passw
o
rd Authentica
tio
n
w
i
t
h
Insecur
e
Com
m
unic
a
tion. C
o
mmunic
a
tio
n
s
of the AC
M
.
198
1; 24(1
1
): 770-7
72.
[2]
MS H
w
a
n
g
, L
H
Li. A ne
w
r
e
mote user a
u
thentic
atio
n sch
eme usi
ng sm
art cards.
IEEE
T
r
ansactio
n
s
on
Co
nsu
m
er
Electron
ics.
20
00; 46(1): 2
8–3
0.
[3]
M Pe
yravi
an,
N Z
unic. Met
h
ods
for protect
i
ng pass
w
o
r
d
t
r
ansmissi
on.
C
o
mputers &
S
e
curity
. 20
00;
19(5): 46
6-4
6
9
.
[4]
CC Le
e, LH
Li, MS H
w
a
n
g
.
A remote
user a
u
the
n
tic
a
tion sc
he
me
usin
g has
h functio
n
s.
ACM
Operatin
g S
y
st
ems Revi
e
w
. 2
002; 36(
4): 23-
29.
[5]
W
C
Ku, CM
Che
n
, HL
Le
e
.
W
eakness
e
s
of L
ee-L
i
-H
w
ang
’s H
a
sh-b
a
s
ed
pass
w
o
r
d
auth
enticati
o
n
scheme.
ACM
Operatin
g Systems R
e
vi
ew
.
2003; 37(
4): 19–
25.
[6]
EJ Yoo
n
, EK Ru
y, KY R
o
o. A secur
e
u
s
er auth
entic
a
t
ion sch
eme
usin
g h
a
sh fu
nctions.
ACM
Operatin
g Systems R
e
vi
ew
. 2004; 38(
2): 62-
68.
[7]
W
C
Ku, MH
Ch
ain
g
, ST
Ch
ang.
W
e
akness
e
s
of Yoo
n
-R
yu-Y
oo’s
has
h-b
a
sed
pass
w
o
r
d
authe
nticati
on scheme,
ACM
Operatin
g Systems R
e
vi
ew
.
2005; 39(
1): 85-
89.
[8]
JJ H
w
a
ng, T
C
Yeh. Improv
e
m
ent on
Pe
yr
avia
n-Z
unics
Pass
w
o
r
d
Aut
hentic
atio
n Sc
hemes.
IEICE
T
r
ansactio
n
s o
n
Co
mmu
n
icati
ons
. 200
2; E85
-
B(4); 823–
82
5
.
[9]
W
C
Ku, CM C
hen,
L H
u
i. Cr
ypt
ana
l
y
sis
of
a Va
ri
ant
of Pe
y
r
avi
an-zu
nic’
s Pass
w
o
r
d
A
u
thentic
atio
n
Scheme.
IEICE T
r
ansactions
on Co
mmu
n
ic
ations.
20
02; E
86-B(5): 16
82-
168
4.
[10]
CL L
i
n, T
H
w
a
ng. A p
a
ss
w
o
r
d
auth
entic
atio
n schem
e
w
i
t
h
secure
pass
w
ord u
p
d
a
ting.
Co
mp
uters &
Security.
200
3;
22(1): 68-7
2
.
[11]
M Pe
y
r
av
ia
n, C Jeffries.
Secure R
e
mo
te User Access over Insecure Net
w
ork
s
.
Comp
uter
Co
mmun
icati
o
ns
. 2006; 2
9
(5)
:
660-66
7.
[12]
KA Shim, Sec
u
rit
y
fl
a
w
s
of remote us
er ac
cess over
ins
e
cure n
e
t
w
orks.
Co
mp
uter co
mmu
n
icati
ons
.
200
6; 30(1): 1
17-1
21.
[13]
YF
Chang, C
C
Chan
g, YL
Liu, Pass
w
o
r
d
Authentic
ati
on w
i
th
out
t
he Server Publ
ic Ke
y
. IEICE
T
r
ansactio
n
s o
n
Co
mmu
n
icati
ons
. 200
4; E87
-
B(10): 308
8-3
091.
[14]
L Z
hu, S Yu, X Z
h
a
ng. Impr
oveme
n
t
upo
n
Mutual Pass
w
o
rd Auth
entic
ation Sc
heme.
Internatio
na
l
semin
a
r on Bu
siness a
nd Info
rmati
on Ma
nag
ement
. 200
8; 4
00-4
03.
[15]
Z
H
Shen. A ne
w
mo
difi
ed rem
o
te user a
u
the
n
ticatio
n
sche
m
e usin
g smar
tcards.
Appli
e
d
Mathe
m
atics
.
200
8; 23(3): 37
1-37
6.
[16]
YL Jia, AM Jhou, MX Gao,
A
ne
w
mutu
al authe
nticati
on schem
e b
a
se
d
on no
nce a
n
d
smartcards.
Co
mp
uter Co
mmu
n
ic
ations
. 2
008; 31(
10): 22
05-2
209.
[17]
W
S
Juang,
W
K
Nien. Effi
cient p
a
ss
w
o
r
d
auth
entic
ate
d
ke
y a
g
re
em
ent usi
ng
bil
i
near
pair
i
n
g
s.
Mathematic
al a
nd Com
puter
Mode
lli
ng. 20
0
8
; 47(11-
12): 1
238-
124
5.
[18]
SK Kim, MG
Chung. More
secure
rem
o
te
user auth
enti
c
ation sch
eme
.
Computer C
o
mmunic
a
tio
n
.
200
9; 32(6): 10
18-1
021.
[19]
J Xu, W
T
Z
h
u, DG F
eng,
An improv
ed
smart card ba
sed pas
s
w
o
r
d
authentic
atio
n
scheme
w
i
t
h
prova
b
le sec
u
ri
t
y
.
Co
mp
uter Standar
ds & Interfaces
. 2009; 3
1
(4): 723-
72
8.
[20]
M Kumar. An
enh
anc
ed rem
o
te user
authe
nticatio
n sche
m
e
w
i
th smart
card.
Internati
o
nal Jo
urn
a
l o
f
Network Security
. 2010; 10(3);
175-1
84.
[21]
CT
Li, MS Hw
a
n
g
. An effic
i
ent b
i
ometrics
-bas
e
d
remot
e
user a
u
the
n
ti
cation sc
hem
e
usin
g smart
cards
. Journ
a
l
of Netw
ork and
Computer Ap
p
licatio
ns
. 20
10;
33(1): 1-5.
[22]
X.M. W
a
n
g
, W
.
F
.
Z
hang, J.S.
Z
hang, M.K.
Kha
n
, Cr
ypta
nal
ysis
a
nd
im
provem
ent o
n
t
w
o
effici
en
t
remote
user
a
u
thentic
atio
n s
c
heme
usi
n
g
s
m
art card
s,
Co
mputer Sta
n
d
a
r
ds & Int
e
rface
s
29
(2
007
)
507
–5
12.
[23]
Y Ch
en, JS
Ch
ou, CH
H
uan
g. Comme
nts o
n
fi
ve smart car
d
bas
ed
pass
w
o
r
d a
u
thentic
ati
on sc
hemes
.
Internatio
na
l Journ
a
l of Co
mputer
Scie
nce
and Infor
m
ati
o
n Security.
20
1
0
; 8(2): 129-1
3
2
.
[24]
M Jo
ye, F
Olivier. Sid
e
-ch
a
nne
l an
al
ysis,
Enc
y
c
l
op
ed
ia
of Cr
y
p
t
ogra
p
h
y
a
nd Sec
u
rit
y
. Kl
u
w
e
r
Academ
ic Publ
ishers. 20
05; 5
71-5
76.
[25]
P Kocher, J
Jaffe, B Jun.
Differenti
a
l po
w
e
r
ana
lysis
.
Procee
din
g
s
o
f
Advanc
es i
n
Cr
yptol
o
g
y
-
Cr
ypto’
99, LN
CS, 1999: 3
88-
397.
[26]
T
S
Messerges
, EA Dabbish,
RH Sloan. E
x
am
ini
ng
smar
t-card securit
y
under the thr
eat of po
w
e
r
analy
sis attack
s.
IEEE
Transactions on Computers
. 200
2; 5
1
(5): 541-
55
2.
[27]
JS Le
e, YF
C
han
g, CC
Ch
a
ng. A
nove
l
a
u
t
henticati
on sc
heme f
o
r mu
lti
-
server arc
h
ite
c
ture
w
i
th
ou
t
smart cards, In
ternatio
nal
Jou
r
nal
of Innov
ati
v
e Co
mput
in
g, Information an
d
Co
ntrol
. 2
0
0
8
; 4(6): 1
357-
136
4.
[28]
SK Hafizul Isla
m, GP Bis
w
as. Desig
n
of im
pr
oved p
a
ss
w
o
r
d
authentic
atio
n and u
p
d
a
te scheme b
a
se
d
on el
liptic curv
e cr
y
p
t
ogra
p
h
y
.
Mathematical
and C
o
mput
er Mode
lli
ng
. 20
1
3
; 57(11-
12): 2
703
–2
717.
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 23
02-4
046
TELKOM
NI
KA
Vol. 12, No. 10, Octobe
r 2014: 735
3
– 7360
7360
[29]
D H
e
, S W
u
,
J Ch
en.
Note
on '
D
esig
n
of
im
prove
d
pass
w
o
r
d
aut
hentic
ation
a
nd
up
d
a
te sch
em
e
base
d
on
ell
i
p
t
ic curve
cr
ypt
ogra
p
h
y
. M
a
th
ematic
a
l
and
Comp
uter
Mo
d
e
lli
ng.
20
12; 5
5
(3-4): 166
1–
166
4.
[30]
D Denn
in
g, G
Sacco. T
i
mestam
ps in ke
y di
stributio
n s
y
ste
m
s.
Commu
n
ic
ations of the A
C
M.
1981; 24
;
533
–5
36.
[31] AJ Menez
es,
PC Oorschot,
SA Vansto
ne,
Han
dbo
ok of A
ppli
ed
Cr
ypto
g
r
aph, C
RC Pre
ss, Ne
w
York,
199
7.
[32]
EJ Yoon, W
H
Kim, KY Yoo.
Rob
u
st an
d si
mp
le
auth
entic
ation sc
hem
e for secur
e
com
m
unic
a
tion
o
n
the
w
eb. ICW
E
2005.
L
e
cture
Notes in C
o
mp
uter Scienc
e
, Sprin
ger-Ver
lag.
2005; 3
579: 3
52–
36
2.
Evaluation Warning : The document was created with Spire.PDF for Python.