Improving the security of 'a flexible biometrics remote user authentication scheme'

Authors:
Muhammad Khurram Khan;Jiashu Zhang
Affiliations:
Research Group for Biometrics and Security, Sichuan Province Key Lab of Signal and Information Processing, Southwest Jiaotong University, Chengdu, Sichuan, PR China;Research Group for Biometrics and Security, Sichuan Province Key Lab of Signal and Information Processing, Southwest Jiaotong University, Chengdu, Sichuan, PR China
Venue:
Computer Standards & Interfaces
Year:
2007

Citing 13
Cited 14

Why cryptosystems fail

CCS '93 Proceedings of the 1st ACM conference on Computer and communications security
Authenticating public terminals

Computer Networks: The International Journal of Computer and Telecommunications Networking - Special issue on computer network security
Password authentication with insecure communication

Communications of the ACM
A flexible remote user authentication scheme using smart cards
A Remote Authentication Scheme Preserving User Anonymity

AINA '05 Proceedings of the 19th International Conference on Advanced Information Networking and Applications - Volume 2
Some Forgery Attacks on a Remote User Authentication Scheme Using Smart Cards

Informatica
A public key cryptosystem and a signature scheme based on discrete logarithms

IEEE Transactions on Information Theory
A new remote user authentication scheme using smart cards

IEEE Transactions on Consumer Electronics
An efficient remote use authentication scheme using smart cards

IEEE Transactions on Consumer Electronics
A modified remote user authentication scheme using smart cards

IEEE Transactions on Consumer Electronics
Cryptanalysis of a modified remote user authentication scheme using smart cards

IEEE Transactions on Consumer Electronics
New remote user authentication scheme using smart cards

IEEE Transactions on Consumer Electronics
A dynamic ID-based remote user authentication scheme

IEEE Transactions on Consumer Electronics

Cryptanalysis and improvement on two efficient remote user authentication scheme using smart cards

Computer Standards & Interfaces
Weaknesses and improvement of Wang et al.'s remote user password authentication scheme for resource-limited environments

Computer Standards & Interfaces
Smart Card Based AKE Protocol Using Biometric Information in Pervasive Computing Environments

ICCSA '09 Proceedings of the International Conference on Computational Science and Its Applications: Part II
An efficient biometrics-based remote user authentication scheme using smart cards

Journal of Network and Computer Applications
Secure group key agreement protocol based on chaotic Hash

Information Sciences: an International Journal
Security analysis of 'two-factor user authentication in wireless sensor networks'

AST/UCMA/ISA/ACN'10 Proceedings of the 2010 international conference on Advances in computer science and information technology
Cryptanalysis and improvement of a biometrics-based remote user authentication scheme using smart cards

Journal of Network and Computer Applications
Cryptanalysis and security enhancement of a 'more efficient & secure dynamic ID-based remote user authentication scheme'

Computer Communications
Improvement of Li-Hwang's biometrics-based remote user authentication scheme using smart cards

WSEAS TRANSACTIONS on COMMUNICATIONS
Mobile device integration of a fingerprint biometric remote authentication scheme

International Journal of Communication Systems
A new dynamic identity-based authentication protocol for multi-server environment using elliptic curve cryptography

Security and Communication Networks
An enhanced biometrics-based remote user authentication scheme using mobile devices

International Journal of Computational Intelligence Studies
Cryptanalysis of truong et al.'s fingerprint biometric remote authentication scheme using mobile device

BICS'13 Proceedings of the 6th international conference on Advances in Brain Inspired Cognitive Systems
Enhanced Dynamic Authentication Scheme (EDAS)

Information Systems Frontiers

Quantified Score

Hi-index	0.00

Visualization

Abstract

Recently, Lin-Lai proposed 'a flexible biometrics remote user authentication scheme,' which is based on El Gamal's cryptosystem and fingerprint verification, and does not need to maintain verification tables on the server. They claimed that their scheme is secured from attacks and suitable for high security applications; however, we point out that their scheme is vulnerable and can easily be cryptanalyzed. We demonstrate that their scheme performs only unilateral authentication (only client authentication) and there is no mutual authentication between user and remote system, thus their scheme is susceptible to the server spoofing attack. To fill this security gap, we present an improvement which overcomes the weakness of Lin-Lai's scheme. As a result, our improved security patch establishes trust between client and remote system in the form of mutual authentication. Moreover, some standards for biometric-based authentication are also discussed, which should be followed during the development of biometric systems.