So far, many strong-password authentication schemes have been proposed, however, none is secure enough. In 2003, Lin, Shen, and Hwang proposed a strong-password authentication scheme using smart cards, and claimed that their scheme can resist the guessing attack, the replay attack, the impersonation attack, and the stolen-verifier attack. Later, Ku, Tsai, and Chen showed that Lin-Shen-Hwang's scheme suffers from a replay attack and a denial-of-service attack. Herein, we propose a more secure hash-based strong-password authentication scheme without using smart cards.

A hash-based strong-password authentication scheme without using smart cards

In this paper, an improved differential cryptanalysis framework for finding collisions in hash functions is provided. Its principle is based on linearization of compression functions in order to find low weight differential characteristics as initiated by Chabaud and Joux. This is formalized and refined however in several ways: for the problem of finding a conforming message pair whose differential trail follows a linear trail, a condition function is introduced so that finding a collision is equivalent to finding a preimage of the zero vector under the condition function. Then, the dependency table concept shows how much influence every input bit of the condition function has on each output bit. Careful analysis of the dependency table reveals degrees of freedom that can be exploited in accelerated preimage reconstruction under the condition function. These concepts are applied to an in-depth collision analysis of reduced-round versions of the two SHA-3 candidates CubeHash and MD6, and are demonstrated to give by far the best currently known collision attacks on these SHA-3 candidates.

/pdf/linearization-framework-for-collision-attacks-application-to-18pw5n76d4.pdf

Linearization Framework for Collision Attacks: Application to CubeHash and MD6

The user authentication is an important part of network security. Several strong-password authentication protocols have been introduced, but a secure scheme, which probably withstands to several known attacks, is not yet available. Recently, a hash-based strong-password authentication scheme was described in [2], which withstands to the several attacks, including replay, passwordflle compromise, denial-of-service, and insider attacks. However, we show that this protocol is still vulnerable to stolen-verifler, denial-of-service, replay, and impersonation attacks.

/pdf/a-simple-attack-on-a-recently-introduced-hash-based-strong-qqdtjp4zw1.pdf

A Simple Attack on a Recently Introduced Hash-Based Strong-Password Authentication Scheme

Password authentication protocols range from complex public-key cryptosystems to simple hash-based password authentication schemes. One common feature of these protocols is that the user’s identity is transmitted in plain during the authentication process, which allows an attacker to monitor the user’s activities. In many cases, the user’s anonymity is a desirable security feature. In this paper, we propose a hash-based Strong Password Authentication Protocol with user Anonymity (SPAPA). We also analyze the security of our proposed scheme against known attacks.

/pdf/a-hash-based-strong-password-authentication-protocol-with-2be2u4avnb.pdf

A Hash-based Strong Password Authentication Protocol with User Anonymity

Password-based authentication is the protocol that two entities share a password in advance and use the password as the basic of authentication. Existing password authentication scheme can be categorized into two types: weak-password authentication schemes and strong-password authentication schemes. In general, strong-password authentication protocols have the advantages over the weak-password authentication schemes in that their computational overhead are lighter, designs are simpler, and implementation are easier, and therefore are especially suitable for some constrained environments. In this paper, we propose a strong password authentication scheme (SPAS) based on previous research. The SPAS is resistant to Dos attacks, replay attacks and stolen-verifier attacks. It expects SPAS can be employed in application scenarios where lightweight and secure user authentication scheme is required.

Strong password authentication protocols

In 2001, Lin, Sun, and Hwang proposed a strong-password authentication protocol, OSPA, which was later found to be vulnerable to a stolen-verifier attack and a man-in-the-middle attack. Recently, Lin, Shen, and Hwang [10] proposed an improved protocol of OSPA and showed that the improved protocol can resist the guessing attack, the replay attack, the impersonation attack, and the stolen-verifier attack. Herein, we show that their protocol is still vulnerable to a replay attack and a denial-of-service attack.

Hao-Chuan Tsai

Papers

Two simple attacks on Lin-Shen-Hwang's strong-password authentication protocol