It is important to guarantee the privacy and the security of the users in the telecare medicine information system. Recently, Wu et al.'s proposed an authentication scheme for mobile devices in telecare medicine information system. They added the pre-computing idea within the communication process to avoid the time-consuming exponential computations. They also claimed their scheme can withstand various attacks. We will show that their scheme suffers from the impersonation attack to the insider's attack. In order to overcome the weaknesses, we propose an improved scheme to eliminate the weakness. Our scheme is not only more secure than Wu et al.'s scheme, but also has better performance. Then our scheme is more efficient and appropriate to collocating with low power mobile devices for the telecare medicine information system.

A More Secure Authentication Scheme for Telecare Medicine Information Systems

Cryptanalysis and security enhancement of a 'more efficient & secure dynamic ID-based remote user authentication scheme'

Designing a user authentication protocol for wireless sensor networks is a difficult task because wireless networks are susceptible to attacks and sensor node has limited energy, processing and storage resources. Recently, several authentication schemes have been proposed. This short paper shows some security problems and design weaknesses in those schemes. Furthermore, an enhanced two-factor user authentication protocol is presented. The proposed scheme only uses hash function, and a successful user authentication just requires three message exchanges. Security and performance analyses demonstrate that compared to the well-known authentication schemes, our proposal is more secure and efficient.

An Enhanced Two-factor User Authentication Scheme in Wireless Sensor Networks

Password-based remote user authentication schemes are widely investigated, with recent research increasingly combining a user's biometrics with a password to design a remote user authentication scheme that enhances the level of the security However, these authentication schemes are designed for a single server environment and result in users needing to register many times when they want to access different application servers To solve this problem, in this paper we propose an anonymous multi-server authenticating key agreement scheme based on trust computing using smart cards, password, and biometrics Our scheme not only supports multi-server environments but also achieves many security requirements In addition, our scheme is a lightweight authentication scheme which only uses the nonce and a hash function From the subsequent analysis, the proposed scheme can be seen to resist several kinds of attacks, and to have more security properties than other comparable schemes

An anonymous multi-server authenticated key agreement scheme based on trust computing using smart cards and biometrics

Improving the security of 'a flexible biometrics remote user authentication scheme'

In 2002, Lee, Ryu and Yoo proposed an improved password authentication scheme without using a password table by employing a fingerprint verification mechanism in the user's smartcard and two servers' secret keys. It is shown that their scheme is vulnerable to a simple and effective forgery attack. In addition, it is demonstrated that their scheme is not easily repairable.

Further cryptanalysis of fingerprint-based remote user authentication scheme using smartcards

Many password authentication schemes employ hash functions as their basic building blocks to achieve better efficiency. In 2000, Peyravian and Zunic proposed a hash-based password authentication scheme that is efficient and can be easily implemented. Recently, Lee, Li, and Hwang demonstrated that Peyravian-Zunic's hash-based password authentication scheme is vulnerable to the off-line guessing attack, and then proposed an improved version. In this article, we show that their improved scheme is still vulnerable to the off-line guessing attack, the denial-of-service attack, and the stolen-verifier attack.

Weaknesses of Lee-Li-Hwang's hash-based password authentication scheme

So far, many strong-password authentication schemes have been proposed, however, none is secure enough. In 2003, Lin, Shen, and Hwang proposed a strong-password authentication scheme using smart cards, and claimed that their scheme can resist the guessing attack, the replay attack, the impersonation attack, and the stolen-verifier attack. Later, Ku, Tsai, and Chen showed that Lin-Shen-Hwang's scheme suffers from a replay attack and a denial-of-service attack. Herein, we propose a more secure hash-based strong-password authentication scheme without using smart cards.

A hash-based strong-password authentication scheme without using smart cards

In 2001, Lin, Sun, and Hwang proposed a strong-password authentication protocol, OSPA, which was later found to be vulnerable to a stolen-verifier attack and a man-in-the-middle attack. Recently, Lin, Shen, and Hwang [10] proposed an improved protocol of OSPA and showed that the improved protocol can resist the guessing attack, the replay attack, the impersonation attack, and the stolen-verifier attack. Herein, we show that their protocol is still vulnerable to a replay attack and a denial-of-service attack.

Two simple attacks on Lin-Shen-Hwang's strong-password authentication protocol

In 2000, Peyravian and Zunic proposed an efficient hash-based password authentication scheme that can be easily implemented. Later, Lee, Li, and Hwang demonstrated that Peyravian-Zunic's scheme is vulnerable to an off-line guessing attack, and then proposed an improved version. However, Ku, Chen, and Lee pointed out that their scheme can not resist an off-line guessing attack, a denial-of-service attack, and a stolen-verifier attack. Recently, Yoon, Ryu, and Yoo proposed an improved scheme of Lee-Li-Hwang's scheme. Unfortunately, we find that Yoon-Ryu-Yoo's scheme is still vulnerable to an off-line guessing attack and a stolen-verifier attack. Furthermore, their scheme can not achieve backward secrecy. Herein, we first briefly review Yoon-Ryu-Yoo's scheme and then describe its weaknesses.

Wei-Chi Ku

Papers

Further cryptanalysis of fingerprint-based remote user authentication scheme using smartcards

Weaknesses of Lee-Li-Hwang's hash-based password authentication scheme

A hash-based strong-password authentication scheme without using smart cards

Two simple attacks on Lin-Shen-Hwang's strong-password authentication protocol

Weaknesses of Yoon-Ryu-Yoo's hash-based password authentication scheme