Two simple attacks on Lin-Shen-Hwang's strong-password authentication protocol

Authors:
Wei-Chi Ku;Hao-Chuan Tsai;Shuai-Min Chen
Affiliations:
Fu Jen Catholic University, Hsinchuang, Taipei County, Taiwan, R.O.C.;Fu Jen Catholic University, Hsinchuang, Taipei County, Taiwan, R.O.C.;Fu Jen Catholic University, Hsinchuang, Taipei County, Taiwan, R.O.C.
Venue:
ACM SIGOPS Operating Systems Review
Year:
2003

Citing 7
Cited 6

Augmented encrypted key exchange: a password-based protocol secure against dictionary attacks and password file compromise

CCS '93 Proceedings of the 1st ACM conference on Computer and communications security
Comments on the S/KEY user authentication scheme

ACM SIGOPS Operating Systems Review
Strong password-only authenticated key exchange

ACM SIGCOMM Computer Communication Review
Password authentication with insecure communication

Communications of the ACM
Security enhancement for Optimal Strong-Password Authentication protocol

ACM SIGOPS Operating Systems Review
Optimal authentication protocols resistant to password guessing attacks

CSFW '95 Proceedings of the 8th IEEE workshop on Computer Security Foundations
Efficient protocols secure against guessing and replay attacks

ICCCN '95 Proceedings of the 4th International Conference on Computer Communications and Networks

A hash-based strong-password authentication scheme without using smart cards

ACM SIGOPS Operating Systems Review
Efficient and secure password authentication schemes for low-power devices

International Journal of Sensor Networks
A proactive wireless self-protection system

Proceedings of the 5th international conference on Pervasive services
Weaknesses and Improvements of Yang-Chang-Hwang's Password Authentication Scheme

Informatica
A smart card based authentication protocol for strong passwords

ACOS'06 Proceedings of the 5th WSEAS international conference on Applied computer science
Efficient and secure password authentication schemes for low-power devices

MSN'05 Proceedings of the First international conference on Mobile Ad-hoc and Sensor Networks

Quantified Score

Hi-index	0.00

Visualization

Abstract

In 2001, Lin, Sun, and Hwang proposed a strong-password authentication protocol, OSPA, which was later found to be vulnerable to a stolen-verifier attack and a man-in-the-middle attack. Recently, Lin, Shen, and Hwang [10] proposed an improved protocol of OSPA and showed that the improved protocol can resist the guessing attack, the replay attack, the impersonation attack, and the stolen-verifier attack. Herein, we show that their protocol is still vulnerable to a replay attack and a denial-of-service attack.