A secure user authentication scheme using hash functions

ABSTRACT

Recently, Lee et al. proposed an improvement on Peyravian and Zunic scheme to make the protocol withstand the guessing attack. However, their scheme suffers from a denial of service attack. In this paper, we show that an attacker can easily prevent the normal use of communication facilities by performing the attack. We also propose an enhancement of the scheme to isolate such a problem.

REFERENCES

• 1: M. Peyravian and N. Zunic, "Methods for protecting password transmission," Computers & Security, vo1. 19, no. 5, pp. 466--469, 2000,
• 2: J. J. Hwang and T. C. Yeh, "Improvement on peyravian-zunic's password authentication schemes," IEICE Transactions on Communications, vol. E85-B, no. 4, pp. 823--825, April 2002.
• 3: Cheng-Chi Lee , Li-Hua Li , Min-Shiang Hwang, A remote user authentication scheme using hash functions, ACM SIGOPS Operating Systems Review, v.36 n.4, p.23-29, October 2002 [doi>10.1145/583800.583803]
• 4: Chun-Li Lin and Tzonelih Hwang, "A password authentication scheme with secure password updating," Computers & Security, vol. 22, no. 1, pp. 68--72, 2003.
• 5: Wei-Chi KU, Chien-Ming CHEN, and Hui-Lung LEE, "Cryptanalysis of a variant of peyravian-zunic's password authentication scheme," IEICE Transactions on Communications, vol. E86-B, no. 5, pp. 1682--1684, May 2003.
• 6: Chou-Chen YANG, Ting-Yi CHANG, Jian-Wei LI, and Min-Shiang HWANG, "Security enhancement for protecting password transmission," IEICE Transactions on Communications, vol. E86-B, no. 7, pp. 2178--2181, July 2003.

INDEX TERMS

Keywords:
authentication, cryptography, hash function, password, security