Security Issues in Smart Card Authentication Scheme

Transcription

1 Interntonl Journl o Computer Theory nd Engneerng Vol. 4, No., Aprl 0 ecurty Issues n mrt Crd Authentcton cheme Rv ngh Pppl, Jdhr C. D., nd hshkl Tpsw Abstrct To secure normton rom unuthorzed ccess, vrous uthentcton schemes hve been deployed. Among these, pssword bsed uthentcton schemes usng smrt crd re wdely used or vrous pplctons such s remote user logn, onlne bnkng, vercton, ccess control nd e-commerce. It provdes mutul uthentcton between user nd server. Ths rtcle portrys securty requrements nd possble ttcks or smrt crd bsed pssword uthentcton scheme. In ddton, vrous solutons or derent ttcks re lso dscussed. Index Terms Authentcton, pssword, securty, smrt crd. I. INTRODCTION Wth the rpd growth o computer networks, more nd more users ccess the remote server s servce n dstrbuted computng envronment. Due to the st development o Internet nd wreless communctons, mny ctvtes lke onlne-shoppng, onlne bnkng, onlne votng re conducted over t. Electronc trnsctons crred out over the network pltorm re gnng populrty nd t s wdely ccepted n the Internet computng world. A number o orgnztons dong busness n the trdtonl wy re extendng themselves to do busness over the Internet. To protect dt durng ther trnsmsson over nsecure chnnel, dequte network securty mesures re needed to resst potentl ttcks rom evesdroppng, unuthorzed retrevl nd ntended modcton, etc. For every busness trnscton uthentcton s requred. It ensures the orgn o messge or electronc document correctly dented wth n ssurnce tht the dentty s not ke. It s the prmry requrement beore the user ccesses the server over nsecure chnnel s t prevents unuthorzed ccess. Vrous uthentcton schemes hve been proposed to secure the normton or resources rom unuthorzed user [], []. One mong them s pssword uthentcton scheme. In conventonl pssword uthentcton schemes, server mntns pssword tble or vercton tble whch contns user denter nd pssword or ll the regstered users. It s used to uthentcte the legtmte user. Every user hs n nd. Whenever user wnts to ccess resources rom server, he or she submts nd to pss the uthentcton phse. The server veres the correspondng to the rom vercton tble. I the submtted pssword mtches the one stored n the vercton Mnuscrpt receved Februry 6, 0; revsed Mrch 7, 0. R.. Pppl,. Tpsw re wth ABV-Indn Insttute o Inormton Technology nd Mngement, Gwlor-47400, Ind e-ml: rv@ tm.c.n, stpsw@ tm.c.n. Jdhr C. D. s wth Deence Insttute o Advnce Technology, Pune-405, Ind e-ml: jdhrcd@ dt.c.n. tble then server uthentctes the user. However, there s thret n such process; n ntruder cn mpersonte legl user by nterceptng the messges rom the network nd logn to the server lter usng the ntercepted normton. Even the s encrypted durng communcton, such n mpersonton ttck s stll possble. In ddton, n ntruder brek nto the server; the contents o the vercton tble cn be esly moded or stolen. Mjor downsde o ths scheme s securng the vercton tble whch stores the pssword n pln text orm. One o the solutons to cope up wth ths problem s to encode the pssword usng hsh uncton nd store the resultnt test pttern n vercton tble []. Another lternte soluton s to store the pssword n encrypted orm whch cnnot be esly derved rom n ttcker even ttcker knows the content o the vercton tble. However, t consumes more memory spce to store the encrypted pssword. In both the pproches, sze o the vercton tble s drectly proportonl to the number o users. In other words, sze o the vercton tble ncreses s the number o users ncreses. Mngement o such huge vercton tble ncreses burden to the server. In ddton, they re not secure snce n ttcker cn mody the contents o the vercton tble whch result the entre system to brek down. To resst ll possble ttcks on the vercton tble, smrt crd bsed pssword uthentcton scheme hs been proposed. In ths scheme, server does not mntn vercton tble to uthentcte the legtmte user. The rest o the pper s orgnzed s ollows. ecton II descrbes vrous possble ttcks on smrt crd uthentcton scheme wth solutons or them. ecton III explores the securty requrements. Fnlly, secton IV concludes the pper. II. POIBLE ATTACK ON MART CARD ATHENTICATION CHEME The remote user uthentcton scheme s used to uthentcte the legtmcy o the remote users over n nsecure chnnel. nce lst decde mny elegnt remote user uthentcton schemes usng smrt crd hve been proposed [4], [6], [8-0], [-7], [], [], [4-5]. mrt crd uthentcton scheme s usully composed o three phses nmely; regstrton phse, logn phse nd uthentcton phse. The regstrton phse s nvoked only once when new user regsters n the server. pon recevng regstrton request over secure chnnel, server ssues smrt crd to user by storng the computed prmeters nto smrt crd memory. The logn phse nd uthentcton phse re nvoked when user wnts to logn the server. pon recevng the logn request, server checks the vldty o the logn request to uthentcte the user. The nottons used throughout ths 06

2 Interntonl Journl o Computer Theory nd Engneerng Vol. 4, No., Aprl 0 rtcle re dened n Tble I. Nottons X TABLE I: NOTATION ED IN THI PAPER Ther Menng Legtmte user Identer o Pssword o ecret key o the server Adversry Identer o Pssword o Pssword guessed by New pssword entered durng pssword chnge phse T Tmestmp t whch logn request s creted T T T 4 Tmestmp t whch server receves the logn request Tmestmp t whch server sends messge bck to Tmestmp t whch receves messge rom server Current tmestmp o s system T T Predetermned tme ntervl o trnsmsson dely r, b Rndom numbers Prmtve element p, q Prme numbers hdowed dentty h ecure one wy hsh uncton Btwse Exclusve-OR operton E ymmetrc encrypton usng key x x D x ymmetrc decrypton usng key x C K Functon to generte check dgt Re d One-wy shdow uncton mntned t the server A remote user uthentcton scheme bsed on ElGml s cryptosystem hs been proposed [4]. It conssts o regstrton phse, logn phse nd uthentcton phse. In the regstrton phse, submts to the server. pon recevng the regstrton request, server computes X mod p nd ssues smrt crd to by storng h, p nto smrt crd memory. The s delvered to through secure chnnel. In the logn phse, nserts the smrt crd to the crd reder nd keys n nd. Ater enterng the credentls, the crd reder genertes rndom number r, computes C r mod p, t h T mod p, M t r mod p, C M mod p nd sends the logn request, C, C, T to the server. In the uthentcton phse, upon recevng the logn request, server rst checks the vldty o to ccept/reject the logn request. I t s ncorrect, the request s rejected else t s consdered or next step o check. The vldty o tme ntervl between T nd T s computed.e., checks T T T. I true, server rejects the logn request, else, X test out whetherc C h T mod p holds or not n order to uthentcte. It s clmed tht the scheme does not mntn ny pssword or vercton tble nd secure gnst reply ttck. However, t s vulnerble to mpersonton ttck [5]. A. Impersonton Attck It s dened s the ttck n whch ttempts to mody the ntercepted messges to msquerde the legl nd logn to the server. submts to the server to msquerde s legl [5]. The server ssues nd smrt crd to. pon recevng, computes vld pr o, o legtmte user wthout knowng server secret key,.e. X. mod p X mod p mod p Further mprovement hs been suggested [6] whch s lso cryptnlyzed [7]. To wthstnd mpersonton ttck, moded scheme hs lso been proposed n whch logn request prmeters re computed rom nsted o [8]. Addtonl mprovement hs been gven n whch computed nsted o, ts logn request contents re C, C, C, T [9], where C C K. A remote user uthentcton scheme usng one-wy hsh uncton hs been proposed [0]. Its mjor drwbcks re pssword s ssued by the server whch results not to choose nd chnge the pssword reely. no mutul uthentcton. In ddton, t s ponted out tht the scheme s vulnerble to olne nd onlne pssword guessng ttcks []. B. Olne Pssword Guessng Attck In olne pssword guessng ttck, s ttempts to determne whether ech o the guessed psswords s correct or not rom the ntercepted messges trnsmtted between nd the server. cn esly very whether guessed pssword s correct or not s pssword s wek. As per the scheme [], ntercepts the logn request, T, C where C h T, rndomly guesses nd checks whether C h T holds or not. I equl, the guessed s vld one. sng, s ble to mpersonte the legtmte to logn the server. The other possble ttck s onlne pssword guessng ttck. C. Onlne Pssword Guessng Attck In ths, tres to use guessed psswords tertvely to pss the uthentcton phse onlne. As dened n [], rndomly guesses nd cretes orged logn request, T, C where C h T P. I the logn request s ccepted by the server, vld s W successully mpersontes to logn the server nd the guessed pssword s pssword. Ths ttck cn be restrcted by lmtng 07

3 Interntonl Journl o Computer Theory nd Engneerng Vol. 4, No., Aprl 0 the number o ttempts. To overcome these lmttons, remote user uthentcton scheme usng one-wy hsh uncton hs been proposed []. It s clmed tht the scheme does not requre ny pssword or vercton tble n the server nd legl user cn choose pssword wthout the help o server. Moreover, t provdes mutul uthentcton between user nd server. However, t s ponted out tht scheme s vulnerble to prllel sesson ttck []. D. Prllel esson Attck It s dened s the ttck n whch evesdrops the messges trnsmtted between nd server nd sends t bck s vld logn request to the server. As mentoned n [], computes C h h T to crete the logn request, C, T whch s trnsmtted to server. In order to provde mutul uthentcton, server sends the response messge T, C to n whch C h C T h h T. ntercepts the messges exchnged between nd server to msquerde s legl to strt new sesson. sends, C, T bck to server where T T nd C C. Ths messge psses the uthentcton phse snce C C h C T h h whch T results to logn nto the server. Moded scheme hs been proposed to overcome the prllel sesson ttck []. However, stll t s vulnerble to mpersonton ttck nd relecton ttck; does not provde user nonymty [4]. E. Relecton Attck In relecton ttck, evesdrops logn request durng trnsmsson between nd server nd sends t or moded verson o the messge bck to to msquerde s the legtmte server. As stted n [4], ntercepts the logn request, C, T trnsmtted between nd the server, where C h h nd sends bck T T, C to mmedtely to mpersonte the server where T nd C h C h h h. pon T T recevng the messge T, C, computes h h C T h h h. nce the T computed result equls C, beleves tht the messge s sent by the server. The relecton nd prllel sesson ttcks re possble due to the trnsmsson o messges wth smlr structure. To overcome these weknesses, urther mprovement hs lso been proposed [4]. However, the scheme does not solve the tme synchronzton problem nd server mntns n extr dtbse or ech user. To wthstnd nsder ttck nd relecton ttck, n mprovement over the scheme [] hs been suggested [5]. F. Insder Attck Durng the regstrton phse, s pssword s reveled to server over secure chnnel. An nsder o server obtns s pssword to mpersonte the legl nd ccess other servers sme pssword s used to ccess other servers. In ddton, the scheme [5] llows users to chnge ther pssword reely through pssword chnge phse. The pssword chnge phse s nvoked whenever wnts to chnge old pssword wth new pssword. nserts the smrt crd to the reder, keys nd nd requests to chnge the pssword by enterng new. mrt crd computes R R h b h b whch yelds h E h b where E n, R h E h b, n denotes the number o tmes re-regsters to server. mrt crd replces R wth R. nce the pssword chnge operton s perormed t the crd reder sde, there s no need to nterct wth the server. It s proved tht the scheme s wek gnst prllel sesson ttck nd hs nsecure pssword chnge phse. Further mprovement hs lso been suggested [6]. Nevertheless, the scheme s vulnerble to guessng ttck, Denl-o-ervce ttck nd orgery ttck [7]. To overcome these drwbcks, n mproved scheme hs been proposed whch s lso cryptnlyzed [8]. Further, t s ound tht the scheme s nsecure gnst guessng ttck, dennng-scco ttck nd hs ndequcy to provde perect orwrd secrecy. G. Attck on Perect Forwrd ecrecy Perect orwrd secrecy ssures tht even one long term key s compromsed, t does not revel ny sesson keys used beore. esson key s C h s per [8]. I gets server secret key X nd evesdrops the logn request, C, C,, where T C P h C h h C hp h T esly computes P h nd C P C h whch results to obtn the sesson key. Another possble ttck s dennng scco ttck. H. Dennng cco Attck It s n cton where obtns sesson key rom n evesdropped sesson nd uses the sme key ether to mpersonte the legtmte or mount dctonry ttck on s pssword. As per [8], gets the sesson key C h r nd obtns s secret normton s b ollows C C P h h C C P C C h pon obtnng s secret vlue h, cn mpersonte the legtmte. Consder the cse, computes C P h r b, C h h r P b T where r,b re two rndom numbers chosen by nd T 08

4 Interntonl Journl o Computer Theory nd Engneerng Vol. 4, No., Aprl 0 denotes current tmestmp o s system. prepres orged logn request M, C, C, T to mpersonte. Another possble ttck s smrt crd stolen ttck. I. mrt Crd tolen Attck When smrt crd s lost or stolen, unuthorzed user who obtns the smrt crd cn guess the pssword o usng pssword guessng ttcks or mpersonte vld to logn nto the server. who stels the smrt crd cn obtn the secret normton stored n the stolen smrt crd by montorng the consumpton o power [9] or by nlyzng the reveled normton [0]., who stels smrt crd, knows R, V, b, h, h nd [8]. sng these prmeters, k derves rom V hp h b wthout ny knowledge o server secret key X s by checkng V hr h b h b or not where s the guessed pssword V h h b P I holds, pproch, R h b W P Rh b P h s the correct pssword o. In ths derves h nd h b to s mpersonte. All the schemes dscussed so r do not solve the tme synchronzton problem. Nonce-bsed scheme [] overcomes the tme synchronzton problem. It nherts ll the prevous dvntges wth ddtonl eture such s sesson key generton greed between nd server. However, securty lws n ths scheme re: t s susceptble to nsder ttck. s not llowed to chnge the pssword reely. t uses symmetrc encrypton nd decrypton whch s necent or low computtonl powered smrt crds. Another nonce-bsed scheme hs been proposed [] to solve the serous tme synchronzton problem. It tkes over ll the prevous dvntges wth n ddtonl chrcterstc tht t uses one wy hsh uncton to reduce the computtonl cost. Nevertheless, t s vulnerble to mpersonton ttck, olne pssword guessng ttck, Denl-o-ervce ttck nd mn-n-the-mddle ttck []. J. Mn-n-the-Mddle Attck The mn-n-the-mddle ttck s orm o ctve evesdroppng n whch sts between the server nd by mkng ndependent connectons between them. The messges whch re exchnged between nd server re ntercepted by wthout the knowledge o nd server. As per the scheme [], ssume tht N modq nd W N modq sent by server nd respectvely. Durng the trnsmsson, ntercepts both the messges nd sends the moded/new messge to both o them. hs two sesson keys, one s used between nd.e., K se N Ns N modq modq nd the other s used between server nd.e., N N N Keu W mod q mod q. Hence, ntercepts the communcton exchnged between nd the server. In ddton, cn reply moded/new messge to both o them. Another scheme whch ressts mpersonton ttck, smrt crd loss ttck nd nsder ttck hs been proposed [4]. In ths scheme, tmestmp T s used n the logn phse to resst reply ttck. However, t ls to wthstnd ths ttck. K. Reply Attck The reply ttck s one n whch n ttcker re-submts the ntercepted logn request to mpersonte the genune user. The logn request contents re, C, r, k, y, T s per [4]. Durng the trnsmsson o logn request exchnged between nd server, cptures t nd resends the request by chngng the vlue o T. pon recevng the request, server nds the derence between T nd T to check the reshness o receved request.e., T T T. I t holds, s successul n n ttempt o mpersonton. Another possble ttck s Denl-o-ervce ttck. L. Denl-o-ervce Attck The Denl-o-ervce ttck prevents/nhbts the use o network resources nd communcton cltes. For exmple, sends nvld logn requests contnuously to mke the server busy. The schemes [], [], [5], [6], [], [], [4], [7], [0-5] re vulnerble to ths ttck. nserts ts own smrt crd nto the crd reder nd keys n nvld nd. The crd reder perorms the computton to crete logn request nd sends t to the server. contnuously does the sme thng to overlod the server whch results to restrn the server ccessblty or the other vld users. An bsed scheme usng RA cryptosystem hs been proposed [5]. However, t exhbts mpersonton ttck nd urther mprovement hs lso been suggested [6] whch nherts ll the merts o the prevous scheme wth n dded eture o mutul uthentcton. A user rendly uthentcton scheme bsed on one wy hsh uncton hs been proposed [7]. However, t s ponted out tht the scheme s vulnerble to mpersonton ttck. To overcome ths ttck, urther mprovement hs lso been proposed [8]. Moreover, t s proved tht the scheme s nsecure gnst guessng ttck nd orgery ttck. To overcome these securty weknesses, n mproved scheme hs lso been proposed [9]. Though, t s nlyzed tht scheme s vulnerble to relecton ttck nd prllel sesson ttck. Ths s due to the symmetrc structure o communcton messges exchnged between user nd server. A dynmc -bsed remote user uthentcton scheme usng one wy hsh uncton hs been proposed [0] nd clmed tht the scheme llows the users to choose nd chnge ther psswords reely, secure gnst -thet, nd ressts reply ttck, orgery ttck, guessng ttck, nsder 09

5 Interntonl Journl o Computer Theory nd Engneerng Vol. 4, No., Aprl 0 ttck nd stolen verer ttck. However, t s proved tht the scheme s nsecure gnst guessng ttck nd does not provde mutul uthentcton []. To deet these securty lws, new scheme hs been suggested. Nevertheless, t s susceptble to mpersonton ttck. Further, mproved scheme hs lso been proposed []. Its mjor drwbcks re t does not provde secure pssword chnge phse. b user needs to remember the secret number Y. On the other hnd, t s ponted out tht the scheme [0] does not provde mutul uthentcton nd s pssword ndependent. To overcome these lmttons, n enhnced scheme hs been proposed []. It s shown tht the scheme s exposed to nsder ttck, does not provde users to choose the pssword, sesson key estblshment nd does not preserve user nonymty [4]. An mproved scheme hs lso been proposed to overcome these lws. Mjor drwbcks n the mproved scheme re server mntns n extr tble or the vlue o N correspondng to every user, where N denotes the number o tmes user regsters t the server. b wrong pssword detecton s slow. mrt crd uthentcton scheme bsed on one wy hsh uncton nd symmetrc key cryptogrphy hs been proposed [5]. It s clmed tht the scheme ressts mpersonton ttck, prllel sesson ttck, reply ttck nd modcton ttck. In ddton, t provdes mutul uthentcton nd genertes shred sesson key. However, t s ponted out tht the scheme ls to resst Denl-o-ervce ttck nd provde perect orwrd secrecy [6]. III. ECRITY REQIREMENT FOR MART CARD ATHENTICATION CHEME Ths secton descrbes mjor securty requrements or n del smrt crd uthentcton scheme. To consder ny uthentcton scheme s secure nd ecent, t hs to encompss the ollowng etures: erver need not to mntn pssword or vercton tble to uthentcte the vld user. ser nds dculty to remember the pssword t s ssued by the server. Hence, scheme s needed to llow the users to choose nd chnge ther pssword reely t ny tme wthout ny ntercton rom the server. ecure trnsmsson o pssword s desrble t the tme o regstrton. The pssword s not embedded n logn request or n other words t s not reveled to the server n pln text s prt o logn request. 4 The computtonl worklod o the smrt crd needs to be low. Even though the cpbltes o smrt crds re ncresng, they re stll lmted. Intense computtons need to be voded both t the crd reder sde s well s server sde. 5 Attcks such s Impersonton ttck, Prllel sesson ttck, relecton ttck, Onlne Pssword Guessng ttck, Olne Pssword Guessng ttck, Reply ttck, tolen Verer ttck, ttck on Perect Forwrd ecrecy, mrt Crd Loss ttck, Denl-o-ervce ttck, Dennng cco ttck, Mn-n-the-Mddle ttck must be wthstnd by the uthentcton scheme. 6 I n dversry tres to ccess the resources rom the server by enterng wrong pssword, t hs to detect quckly. 7 In tmestmp-bsed uthentcton schemes, the clock o the server nd ll user systems re to be synchronzed. In ddton, trnsmsson dely o the logn request needs to be lmted. However, t s necent rom the prctcl pont o vew. To overcome clock synchronzton problem nd the lmtton o trnsmsson dely tme, some o the schemes use nonce n plce o tmestmps. In order to check the reshness o the nonce, server needs to mntn n older nonce vlue or short spn o tme. 8 It s necessry tht not only server veres the legl users, but users lso very the legl server to cheve two wy uthentcton. Every uthentcton scheme must support mutul uthentcton. 9 esson keys re used to secure the communcton between user nd server tll the end o the sesson. Every smrt crd uthentcton scheme needs to support sesson key generton. 0 It s better tht the user s dentty s nonymous. It s necessry tht n ecent remote user uthentcton scheme preserves strong nonymty not only rom the evesdropper but lso rom the server. IV. CONCLION ecurty nd ecency re the mn ctors or ny uthentcton scheme rom the user s perspectve. In vew o the ct, severl smrt crd bsed remote user uthentcton schemes hve been proposed. Ths pper descrbes vrous possble ttcks nd prmry requrements to consder ny smrt crd bsed uthentcton scheme s secure nd ecent or prctcl pplctons. These ssues re helpul to desgn nd develop secure nd ecent smrt crd uthentcton scheme. ACKNOWLEDGMENT The uthors would lke to thnk ABV-Indn Insttute o Inormton Technology nd Mngement, Gwlor, Ind or provdng the cdemc support. REFERENCE [] R. M. Needhm nd M. D. chroeder, sng encrypton or uthentcton n lrge networks o computers, Communctons o the ACM, vol., no., pp , 978. [] K.. Booth, Authentcton o sgntures usng publc key encrypton, Communctons o the ACM, vol. 4, no., pp , 98. [] L. Lmport, Pssword uthentcton wth nsecure communcton, Communctons o the ACM, vol. 4, no., pp , 98. [4] M.. Hwng nd L. H. L, A new remote user uthentcton scheme usng smrt crds, IEEE Trnsctons on Consumer Electroncs, vol. 46, no., pp. 8-0, 000. [5] C. K. Chn nd L. M. Cheng, Cryptnlyss o remote user uthentcton scheme usng smrt crds, IEEE Trnsctons on Consumer Electroncs, vol. 46, no. 4, pp , 000. [6] J. J. hen, C. W. Ln, nd M.. Hwng, A moded remote user uthentcton scheme usng smrt crds, IEEE Trnsctons on Consumer Electroncs, vol. 49, no., pp , 00. [7] K. C. Leung, L. M. Cheng, A.. Fong, nd C. K. Chn, Cryptnlyss o moded remote user uthentcton scheme usng smrt crds, IEEE Trnsctons on Consumer Electroncs, vol. 49, no. 4, pp. 4-45, 00. [8] A. K. Awsth nd. Ll, An enhnced remote user uthentcton scheme usng smrt crds, IEEE Trnsctons on Consumer Electroncs, vol. 50, no., pp ,

6 Interntonl Journl o Computer Theory nd Engneerng Vol. 4, No., Aprl 0 [9] M. Kumr, New remote user uthentcton scheme usng smrt crds, IEEE Trnsctons on Consumer Electroncs, vol. 50, no., pp , 004. [0] H. M. un, An ecent remote user uthentcton scheme usng smrt crds, IEEE Trnsctons on Consumer Electroncs, vol. 46, no. 4, pp , 000. [] C. L. Hsu, ecurty o two remote user uthentcton schemes usng smrt crds, IEEE Trnsctons on Consumer Electroncs, vol. 49, no. 4, pp , 00. [] H. Y. Chen, J. K. Jn, nd Y. M. Tseng, An ecent nd prctcl soluton to remote uthentcton: smrt crd, Computers nd ecurty, vol., no. 4, pp. 7-75, 00. []. W. Lee, H.. Km, nd K. Y. Yoo, Improvement o Chen et l.'s remote user uthentcton scheme usng smrt crds, Computer tndrds nd Interces, vol. 7, no., pp. 8-8, 005. [4]. K. ood, A. K. rje, nd K. ngh, ecure dynmc dentty-bsed remote user uthentcton scheme, n Proc. 6 th Interntonl Conerence on Dstrbuted Computng nd Internet Technologes, Bhubneswr, Ind, 00, pp [5] W. C. Ku nd. M. Chen, Weknesses nd mprovements o n ecent pssword bsed remote user uthentcton scheme usng smrt crds, IEEE Trnsctons on Consumer Electroncs, vol. 50, no., pp , 004. [6] E. J. Yoon, E. K. Ryu, nd K. Y. Yoo, Further mprovement o n ecent pssword bsed remote user uthentcton scheme usng smrt crds, IEEE Trnsctons on Consumer Electroncs, vol. 50, no., pp. 6-64, 004. [7] X. M. Wng, W. F. Zhng, J.. Zhng, nd M. K. Khn, Cryptnlyss nd mprovement on two ecent remote user uthentcton scheme usng smrt crds, Computer tndrds nd Interces, vol. 9, no. 5, pp , 007. [8] E. J. Yoon, E. J. Lee, nd K. Y. Yoo, Cryptnlyss o Wng et l. s remote user uthentcton scheme usng smrt crds, n Proc. 5 th Interntonl Conerence on Inormton Technology: New Genertons, Ls Vegs, Nevd, A, 008, pp [9] P. Kocher, J. Je, nd B. Jun, Derent power nlyss, n Proc. Advnces n Cryptology, Clorn, A, 999, pp [0] T.. Messerges, E. A. Dbbsh, nd R. H. lon, Exmnng smrt crd securty under the thret o power nlyss ttcks, IEEE Trnsctons on Computers, vol. 5, no. 5, pp , 00. [] W.. Jung, Ecent pssword uthentcted key greement usng smrt crds, Computers nd ecurty, vol., no., pp. 67-7, 004. [] H. T. Lw, J. F. Ln, nd W. C. Wu, An ecent nd complete remote user uthentcton scheme usng smrt crds, Mthemtcl nd Computer Modellng, vol. 44, no. -, pp. -8, 006. [] K. Hung, Q. Ou, X. Wu, nd Y. ong, Cryptnlyss o remote user uthentcton scheme usng smrt crds, n Proc. 5 th Interntonl Conerence on Wreless Communctons, Networkng nd Moble Computng, Bejng, Chn, 009, pp. -4. [4] Z. H. hen, A new moded remote user uthentcton scheme usng smrt crds, Appled Mthemtcs-A Journl o Chnese nverstes, vol., no., pp. 7-76, 008. [5] W. H. Yng nd. P. heh, Pssword uthentcton schemes wth smrt crds, Computers nd ecurty, vol. 8, no. 8, pp. 77-7, 999. [6] J. J. hen, C. W. Ln, nd M.. Hwng, ecurty enhncement or the tmestmp-bsed pssword uthentcton scheme usng smrt crds, Computers nd ecurty, vol., no. 7, pp , 00. [7]. T. Wu nd B. C. Cheu, A user rendly remote uthentcton scheme wth smrt crds, Computers nd ecurty, vol., no. 6, pp , 00. [8] N. Y. Lee nd Y. C. Chu, Improved remote uthentcton scheme wth smrt crd, Computer tndrds nd Interces, vol. 7, no., pp , 005. [9] M. Holbl nd T. Welzer, Cryptnlyss nd mprovement o n mproved remote uthentcton scheme wth smrt crd, n Proc. rd Interntonl Conerence on Avlblty, Relblty nd ecurty, Brcelon, pn, 008, pp [0] M. L. Ds, A. xen, nd V. P. Gult, A dynmc -bsed remote user uthentcton scheme, IEEE Trnsctons on Consumer Electroncs, vol. 50, no., pp. 69-6, 004. [] I. E. Lo, C. C. Lee, nd M.. Hwng, ecurty enhncement or dynmc -bsed remote user uthentcton scheme, In Proc. Interntonl Conerence on Next Generton Web ervces Prctces, eoul, Kore, 005, pp [] Q. Xe, J. L. Wng, D. R. Chen, nd X. Y. Yu, A novel user uthentcton scheme usng smrt crds, n Proc. Interntonl Conerence on Computer cence nd otwre Engneerng, Wuhn, Hube, Chn, 008, pp [] Y. Y. Wng, J. Y. Lu, F. X. Xo, nd J. Dn, A more ecent nd secure dynmc -bsed remote user uthentcton scheme, Computer Communctons, vol., no. 4, pp , 009. [4] M. K. Khn, Enhncng the securty o More ecent nd secure dynmc -bsed remote user uthentcton scheme, n Proc. rd Interntonl Conerence on Network nd ystem ecurty, Queenslnd, Austrl, 009, pp [5] R. ong, Advnced smrt crd bsed pssword uthentcton protocol, Computer tndrds nd Interces, vol., no. 5-6, pp. -5, 00. [6] R.. Pppl, Jdhr, C. D., nd. Tpsw, Comments on symmetrc key encrypton bsed smrt crd uthentcton scheme, n Proc. nd Interntonl Conerence on Computer Technology nd Development, Cro, Egypt, 00, pp Rv ngh Pppl hs receved B.E. Computer cence nd Engneerng rom J. E. C., Jblpur, Ind n 005 nd M.Tech. Computer cence nd Engneerng rom. A. T. I., Vdsh, Ind n 008. At present, he s pursung Full Tme Ph.D. n Inormton Technology t ABV-Indn Insttute o Inormton Technology nd Mngement, Gwlor, Ind. Hs reserch res o nterest nclude Cryptogrphy, Network ecurty Authentcton, Key Mngement, Dgtl gnture nd Hsh Functon. Jdhr C. D. hs obtned Ph.D. Computer cence nd Engneerng rom Ntonl Insttute o Technology, Truchrppll-5, Ind. He s presently workng s Assstnt Proessor t Deence Insttute o Advnce Technology, Pune, Ind. Hs prmry reserch re ncludes Network ecurty Authentcton, Key Mngement, Dgtl gnture nd Hsh Functon, ecurty ssues n Cloud Computng, ecurty Issues n Voce-over-IP, Cyber ecurty, Computer Networks, Adhoc Networks nd Cryptogrphy nd Ellptc Curve Cryptogrphy. hshkl Tpsw hs obtned her Ph.D. Computer Engneerng rom Indn Insttute o Technology, Roorkee, Ind n 00, M.Tech Computer cence rom nversty o Delh, Ind n 99 nd B.E. Electroncs Engneerng rom Jwj nversty, Gwlor, Ind n 986. he s Proessor n Inormton Technology Deprtment, ABV-Indn Insttute o Inormton Technology nd Mngement, Gwlor, Ind. Her prmry reserch res o nterest re Artcl Intellgence, Neurl Networks, Fuzzy Logc, Dgtl Imge Processng, Computer Networks, Moble Networks, Adhoc Networks, Network ecurty etc.