An efficient biometrics-based remote user authentication scheme using smart cards

The author first reviews the recently proposed Li-Hwang's biometric-based remote user authentication scheme using smart cards; then shows that the Li-Hwang's scheme has some design flaws in their scheme. In order to withstand those flaws in their scheme, an improvement of their scheme is further proposed. The author also shows that the improved scheme provides strong authentication with the use of verifying biometric, password as well as random nonces generated by the user and the server as compared to that for the Li-Hwang's scheme and other related schemes.

Analysis and improvement on an efficient biometric-based remote user authentication scheme using smart cards

Internet and networks applications are growing very fast, so the needs to protect such applications are increased. Encryption algorithms play a main role in information security systems. On the other side, those algorithms consume a significant amount of computing resources such as CPU time, memory, and battery power. This paper provides evaluation of six of the most common encryption algorithms namely: AES (Rijndael), DES, 3DES, RC2, Blowfish, and RC6. A comparison has been conducted for those encryption algorithms at different settings for each algorithm such as different sizes of data blocks, different data types, battery power consumption, different key size and finally encryption/decryption speed. Experimental results are given to demonstrate the effectiveness of each algorithm.

/pdf/evaluating-the-performance-of-symmetric-encryption-4bhgguzky5.pdf

Evaluating the Performance of Symmetric Encryption Algorithms

Connected health care has several applications including telecare medicine information system, personally controlled health records system, and patient monitoring. In such applications, user authentication can ensure the legality of patients. In user authentication for such applications, only the legal user/patient himself/herself is allowed to access the remote server, and no one can trace him/her according to transmitted data. Chang et al. proposed a uniqueness-and-anonymity-preserving remote user authentication scheme for connected health care (Chang et al., J Med Syst 37:9902, 2013). Their scheme uses the user's personal biometrics along with his/her password with the help of the smart card. The user's biometrics is verified using BioHashing. Their scheme is efficient due to usage of one-way hash function and exclusive-or (XOR) operations. In this paper, we show that though their scheme is very efficient, their scheme has several security weaknesses such as (1) it has design flaws in login and authentication phases, (2) it has design flaws in password change phase, (3) it fails to protect privileged insider attack, (4) it fails to protect the man-in-the middle attack, and (5) it fails to provide proper authentication. In order to remedy these security weaknesses in Chang et al.'s scheme, we propose an improvement of their scheme while retaining the original merit of their scheme. We show that our scheme is efficient as compared to Chang et al.'s scheme. Through the security analysis, we show that our scheme is secure against possible attacks. Further, we simulate our scheme for the formal security verification using the widely-accepted AVISPA (Automated Validation of Internet Security Protocols and Applications) tool to ensure that our scheme is secure against passive and active attacks. In addition, after successful authentication between the user and the server, they establish a secret session key shared between them for future secure communication.

A Secure and Efficient Uniqueness-and-Anonymity-Preserving Remote User Authentication Scheme for Connected Health Care

Recently, biometric-based remote user authentication schemes along with passwords have drawn considerable attention in research. In 2011, Das proposed an improvement on an efficient biometric-based remote user authentication scheme using smart cards and claimed his scheme could resist various attacks. However, there are some weaknesses in Das’s scheme such as the privileged insider attack and the off-line password guessing attack. Besides, Das’s scheme also cannot provide user anonymity. To overcome these weaknesses, we shall propose a secure biometric-based remote user authentication with key agreement scheme using extended chaotic maps. The proposed scheme not only can resist the above-mentioned attacks, but also provide user anonymity.

A secure biometric-based remote user authentication with key agreement scheme using extended chaotic maps

Nyberg and Ruppel first proposed a signature scheme with message recovery based on DSA in 1993, and the authenticated encryption scheme is a special application of their scheme. Afterward, there are many papers proposed about the authenticated encryption schemes. The signature scheme can reduce the transmitted cost, because the message has been contained in the signature of the message and the signer does not necessary to send the receiver the message and the signature. The scheme is very suitable for the key agreement application, because a key is a small amount of a message. In order to comprehend and interpret the authenticated encryption schemes overall, we discuss the evolution and the existed problems of authenticated encryption schemes.

http://ijns.jalaxy.com.tw/contents/ijns-v1-n2/ijns-2005-v1-n2-p61-73.pdf

Authenticated Encryption Schemes: Current Status and Key Issues

An electronic voting protocol with deniable authentication for mobile ad hoc networks

Recently, Wu-Chieu proposed an efficient and friendly remote authentication scheme with smart card. This scheme is very elaborate since no password table in the remote system, and could keep as well as low communication and low computation costs. In addition, freely choosing and changing password is very friendly for users. However, their scheme could not withstand the forged attack. Flaw is proposed in this study.

Cryptanalysis of a User Friendly Remote Authentication Scheme with Smart Card

In this article, we propose a publicly verifiable authenticated encryption scheme based on factoring and discrete logarithms. We point out that even if either factoring or discrete logarithms is broken, this scheme still could keep the authentication, integration, and confidentiality of the message.

/pdf/a-publicly-verifiable-authenticated-encryption-scheme-based-2vn9g0xbe3.pdf

A Publicly Verifiable Authenticated Encryption Scheme Based on Factoring and Discrete Logarithms.

Group signature has been proposed for many years, those schemes are still not efficient. In 2002, Shi proposed a group signature scheme based on the discrete logarithm problem. In Shi's scheme, he claims that his scheme is efficient compared to previous proposed schemes. Although his scheme is better than others, the scheme is not secure. In this article, we will show that Shi's scheme will be subjected forgery attack.

Chi-Yu Liu

Papers

Authenticated Encryption Schemes: Current Status and Key Issues

An electronic voting protocol with deniable authentication for mobile ad hoc networks

Cryptanalysis of a User Friendly Remote Authentication Scheme with Smart Card

A Publicly Verifiable Authenticated Encryption Scheme Based on Factoring and Discrete Logarithms.

Cryptanalysis of an efficient secure group signature scheme