Comments on a secure dynamic ID-based remote user authentication scheme for multiserver environment using smart cards

Transcription

1 Comments on a secure dynamc ID-based remote user authentcaton scheme for multserver envronment usng smart cards Debao He chool of Mathematcs tatstcs Wuhan nversty Wuhan People s Republc of Chna Emal: hedebao@63com Tel: Abstract: The securty of a dynamc ID-based remote user authentcaton scheme for multserver envronment usng smart cards proposed by Lee et al [Lee C-C Ln T-H Chang R-X A ecure Dynamc ID based Remote ser Authentcaton cheme for Mult-server Envronment usng mart Cards Expert ystems wth Applcatons (20 do: 006/eswa200490] s analyzed Three knds of attacks are presented n dfferent scenaros Key words: Authentcaton smart cards dynamc ID mult-server system password attack Introducton Recently Lee et al gave sx requrements for password authentcaton scheme for mult-server envronment [] They also proposed a scheme usng smart cards for password authentcaton over nsecure networks clamed that t satsfed all the sx requrements thus s mmune to varous attacks In ths paper however some securty loopholes of ther scheme wll be ponted out the correspondng attacks wll be descrbed The organzaton of the paper s sketched as follows The ecton 2 gves a bref revew of Lee et al s scheme The securty flaws of Lee et al s scheme are shown n ecton 3 Fnally we gve some conclusons n ecton 4 2 Lee et al s scheme In ths secton we wll brefly revew Lee et al s scheme Ther scheme conssts of four phases: regstraton phase logn phase verfcaton phase password change phase In order to facltate future references frequently used notatons are lsted below wth ther descrptons

2 : The th user; ID : The dentty of ; : The password of : The th server; ; RC : The regstraton center; C : A smart card; ID : The dentty of ; CID : The dynamc ID of ; x y : Two secret keys mantaned by regstraton center; h () : A one-way hash functon; : The btwse XOR operaton; : trng concatenaton operaton Three enttes: the user ( ) the server ( ) the regstraton center ( RC ) are nvolved n Lee et al s scheme Frst RC chooses the master key x secret number y to compute hx ( y ) hy ( ) then shares them wth n the secure channel Only RC knows the master secret key x secret number y 2 Regstraton phase In ths phase everyone who wants to regster at the server should submt hs dentty password to RC obtan a smart card The detal of the phase s descrbed as follows generates a rom number b chooses hs dentty computes hb ( ) Then sends regstraton center RC through a secure channel ID ID hb ( ) to the 2) After recevng ID hb ( ) RC computes T = h( ID x) V = T h( ID h( b )) B = hhb ( ( ) H( x y)) H = h( T) Then RC stores { V B H h () hy} ( ) nto a smart card ssue t to 3) When recevng the smart card keys b nto t fnsh the regstraton 2

3 22 Logn phase Once the user perform the followng logn steps wants to logn to the server as shown n Fg he wll nserts hs smart card nto the smart card reader then nputs 2) The smart card computes T = V h( ID h( b )) H = h( T) ID If H does not equal H the smart card stops the request 3) The smart card generates a rom number N computes A = h( T h( y) N ) CID = h( b ) h( T A N ) Q = h( B A N ) P = T h( h( y) N ID ) Then the smart card sends M = { CID P Q N} to the serer 23 Verfcaton phase Ths phase s executed by the server to determne whether the user s allowed to logn or not executes the followng steps to verfy the legtmacy of We use Fg to demonstrate the phase pon recevng M computes T = P h( h( y) N ID) A = h( T h( y) N ) hb ( ) = CID ht ( A N) B = hhb ( ( ) hx ( y)) Then computes hb ( A N ) checks t wth Q If they are not equal reects the logn request termnates ths sesson Otherwse generates a rom number N to compute M = hb ( N A ID ) Fnally sends the message M 2 = { M N } to 2) pon recevng M 2 checks whether hb ( N A ID ) equals M If they are not equal stops the sesson Otherwse M = hb ( N A ID ) At last sends M 3 = { M } to computes 3)pon recevng M 3 checks whether hb ( N A ID ) equals M If they are not equal successfully stops the request Otherwse s authentcated 3

4 After fnshng verfcaton phase can compute K = h( B N N A ID ) as the sesson key for securng communcatons wth authentcator The logn phase verfcaton phase are depcted n Fgure Fg Logn phase verfcaton phase of Lee et al s scheme 24 Password change phase to If Ths phase wll be nvoked f the clent wants to change hs password from nserts hs smart card nto the smart card reader then nputs 2) The smart card computes T = V h( ID h( b )) H = h( T) H does not equal H the smart card stops the request 3) nputs the password ID a rom number b computes hb ( ) V = T h( ID h( b )) At last sends ID hb ( ) to RC through a secure channel 4) pon recevng ID hb ( ) RC computes B = hhb ( ( ) hx ( y)) sends t to 5) The smart card replaces V B wth V B 4

5 3 Cryptanalyss of Lee et al s scheme In ths secton we wll demonstrate that Lee et al s scheme s vulnerable to mpersonaton attack server spoofng attack can not provde two-factor securty 3 Impersonaton attack In ths subsecton we frst show that any malcous legal user can mpersonate other legal users to log nto remote server Then we demonstrate that any malcous server also can mpersonate any other legal users to log nto remote server Malcous user s mpersonaton attack We assume that the adversary Z s a legal user of the system then he can obtan a smart card contanng { V Z another legal user communcates wth B Z the logn message { CID P Q N } between H Z h () hy ( ) b Z } When the adversary Z can ntercept mpersonate though the followng steps We use Fg 2 to demonstrate the attack Z two rom numbers r N sets T r computes A = h( T h( y) N ) CID = h( b ) h( T A N ) Z Z Q = h( B A N ) P = T h( h( y) N ID ) Then the smart card Z sends M = { CID P Q N } to the serer 2)pon recevng M computes T = P h( h( y) N ID ) = T A = h( T h( y) N ) = h( T h( y) N ) = A hb ( ) = CID ht ( A N ) = hb ( ) Z Z B = hhb ( ( ) hx ( y)) = hhb ( ( ) hx ( y)) = B It s obvous that Z Z Z hb ( A N ) equals Q snce Q = h( BZ A N ) B = B Z Then generates a rom number N to compute M = hb ( N A ID) Fnally sends the message M 2 = { M N } to Z 3) pon recevng M Z computes M = hb ( N A ID) sends M 3 = { M } to Z 5

6 4)pon recevng M 3 checks whether hb ( N A ID ) equals M It s obvous hb ( N A ID ) equals M snce B = B Z M = hb ( Z N A ID ) Then Z mpersonate successfully After above steps Z can compute K = h( B N N A ID ) as the sesson key for securng communcatons wth authentcator Z Fg 2 Malcous user s mpersonaton attack Malcous server s mpersonaton attack We assume that s a malcous server of the system then he can obtan hx ( y ) hy ( ) from RC When a legal user wth communcates can mpersonate ths user to obtan the servces from other servers + The detal of the attack as shown n Fg 3 s descrbed as follows When recevng M = { CID P Q N } from uses hs hy ( ) hx ( y ) to compute T = P h( h( y) N ID ) A = h( T h( y) N ) hb ( ) = CID ht ( A N) B = hhb ( ( ) H( x y)) 6

7 P+ = T h( h( y) N ID+ Then sends M = { CID P+ Q N} to another server + 2) pon recevng M + computes T = P+ h( h( y) N ID+ A = h( T h( y) N ) hb ( ) = CID ht ( A N) B = hhb ( ( ) H( x y)) Then + computes hb ( A N ) checks f t equals Q It s obvous hb ( A N ) equals Q Then + generates a rom number N + to compute M + = h( B N A ID+ Fnally sends the message M2 = { M N } to 3) pon recevng { M + N + } computes M + = h( B N + A ID+ sends M3 = { M + } to + 4) pon recevng M 3 + checks whether hb ( N + A ID+ equals M + From the computaton of M + we knows hb ( N + A ID+ equals M + Then mpersonate successfully After above steps + can compute K = h( B N N A ID ) as the sesson key for securng + + communcatons wth authentcator Fg 3 Malcous server s mpersonaton attack 7

8 32 erver spoofng attack We assume that s a malcous server of the system then he can obtan hx ( y ) hy ( ) from RC When another legal user communcates wth + can ntercept the logn message M = { CID P+ Q N} between + mpersonate + though the followng steps where CID = h( b ) h( T A N ) Q = h( B A N) P+ = T h( h( y) N ID+ T = h( ID x) We use Fg 4 to demonstrate the attack pon recevng M computes T = P+ h( h( y) N ID+ A = h( T h( y) N ) hb ( ) = CID ht ( A N) B = hhb ( ( ) H( x y)) Then computes hb ( A N ) checks t wth Q If they are not equal reects the logn request termnates ths sesson Otherwse generates a rom number N + to compute M + = h( B N A ID+ Fnally sends the message M = { M N } to 2) pon recevng M 2 checks whether hb ( N A ID + ) equals If they are not equal stops the sesson Otherwse M + computes M + = h( B N + A ID+ At last sends M 3 = { M } to After fnshng verfcaton phase can compute K = h( B N N A ID ) as the sesson key for securng + + communcatons wth authentcator Then mpersonate + successfully 8

9 Fg 4 erver spoofng attack 33 Password guessng attack Although un et al clam that ther scheme can provde two-factor securty e the user s password s secure even when the clent s smart card s lost the parameters n the card are derved[] an password guessng attack wll be gven here uppose the clent s smart card s lost an attacker A can read all the data ncludng { V B H h () hy ( ) b } from the smart card va physcally access to the storage medum He can get the password through the followng steps A selects a password from a unformly dstrbuted dctonary 2) A computes T = V h( ID h( b )) H = h( T) 3) A check f H equals H If H equals H hen A fnd the correct passwords Otherwse A repeats steps 2 3 untl the correct password f found 4 Concluson In [] Lee et al proposed a dynamc ID-based remote user authentcaton scheme for mult-server envronment usng smart cards demonstrated ts mmunty aganst varous attacks However after revew of ther scheme analyss of ts securty three knds of attacks e mpersonaton attack server spoofng attack password guessng attack are presented n dfferent scenaros The analyses show that the scheme s nsecure for practcal applcaton 9

10 Reference [] Lee C-C Ln T-H Chang R-X A ecure Dynamc ID based Remote ser Authentcaton cheme for Mult-server Envronment usng mart Cards Expert ystems wth Applcatons (20 do: 006/eswa