Weaknesses of Lee-Li-Hwang's hash-based password authentication scheme

Authors:
Wei-Chi Ku;Chien-Ming Chen;Hui-Lung Lee
Affiliations:
Fu Jen Catholic University, Hsinchuang, Taipei County, Taiwan, R.O.C.;Fu Jen Catholic University, Hsinchuang, Taipei County, Taiwan, R.O.C.;Fu Jen Catholic University, Hsinchuang, Taipei County, Taiwan, R.O.C.
Venue:
ACM SIGOPS Operating Systems Review
Year:
2003

Citing 5
Cited 8

Augmented encrypted key exchange: a password-based protocol secure against dictionary attacks and password file compromise

CCS '93 Proceedings of the 1st ACM conference on Computer and communications security
Cryptography and network security (2nd ed.): principles and practice

Cryptography and network security (2nd ed.): principles and practice
Password authentication with insecure communication

Communications of the ACM
A remote user authentication scheme using hash functions

ACM SIGOPS Operating Systems Review
Efficient protocols secure against guessing and replay attacks

ICCCN '95 Proceedings of the 4th International Conference on Computer Communications and Networks

A simple password authentication using a polynomial

ACM SIGOPS Operating Systems Review
Weaknesses of Yoon-Ryu-Yoo's hash-based password authentication scheme

ACM SIGOPS Operating Systems Review
A new method for using hash functions to solve remote user authentication

Computers and Electrical Engineering
Weaknesses and Improvements of Yang-Chang-Hwang's Password Authentication Scheme

Informatica
An efficient One-Time Password authentication scheme using a smart card

International Journal of Security and Networks
Secure remote user access over insecure networks

Computer Communications
Various types of attacks and solutions regarding secure remote user access over insecure networks

ICCSA'06 Proceedings of the 6th international conference on Computational Science and Its Applications - Volume Part I
Efficient password authenticated key agreement using bilinear pairings

Mathematical and Computer Modelling: An International Journal

Quantified Score

Hi-index	0.00

Visualization

Abstract

Many password authentication schemes employ hash functions as their basic building blocks to achieve better efficiency. In 2000, Peyravian and Zunic proposed a hash-based password authentication scheme that is efficient and can be easily implemented. Recently, Lee, Li, and Hwang demonstrated that Peyravian-Zunic's hash-based password authentication scheme is vulnerable to the off-line guessing attack, and then proposed an improved version. In this article, we show that their improved scheme is still vulnerable to the off-line guessing attack, the denial-of-service attack, and the stolen-verifier attack.