智能卡安全认证：一种具备前向保密性的新方案
需积分: 9 146 浏览量
更新于2024-12-26
收藏 122KB PDF 举报
“一种使用智能卡的新远程用户身份验证方案，具有前向安全性”
在《使用智能卡的新远程用户身份验证方案》这篇论文中，作者Manoj Kumar针对Hwang和Li提出的首个使用智能卡的远程用户身份验证方案进行了讨论。Hwang和Li的方案旨在解决Lamport方案中的问题，但其自身存在安全弱点。Chan-Chang、Shen-Lin-Hwang以及Chang-Hwang指出了对Hwang-Li方案的一些攻击方法。因此，论文提出了一种新的身份验证方案，该方案引入了前向安全性，保护了认证服务器的长期秘密密钥，增强了安全性，同时能够抵御Chan-Cheng以及所有扩展攻击。
该文涉及的主要知识点包括：
1. **密码学**：在远程用户身份验证中，密码学是确保通信安全的基础，通过加密技术保护用户的身份信息和密码不被窃取。
2. **远程用户身份验证**：这种机制用于验证远程用户（如网络上的用户）登录请求的有效性，允许用户访问认证服务器的资源。
3. **认证服务器**：在系统中扮演关键角色，负责验证用户的身份并提供访问权限。
4. **智能卡**：作为安全存储设备，智能卡可以存储用户的敏感信息，如密码和个人识别号（PIN），并提供安全的身份验证。
5. **密码**：用户与认证服务器共享的秘密信息，用于验证用户身份。
6. **密码分析**：攻击者可能尝试通过分析密码的模式或结构来破解它，因此设计安全的身份验证方案需要考虑到这一点。
7. **网络安全**：身份验证方案是网络安全的重要组成部分，防止未经授权的访问和数据泄露。
8. **校验位**：一种用于检测数据传输错误的方法，可能在身份验证过程中用于增加安全性。
9. **前向安全性**：这是一种特性，即使密钥被泄露，也不能解密之前加密的数据，从而保护历史通信的安全。
10. **攻击模型**：论文中提到的攻击包括针对Hwang-Li方案的攻击，以及对新方案的潜在威胁，如Chan-Cheng的攻击。
作者的新方案旨在克服已知的安全缺陷，提供更高级别的安全保障，尤其是通过前向安全性来保护长期秘密密钥，使得即使密钥在未来的某个时间点被暴露，过去的数据通信仍然保持安全。这一方案对于现代网络环境中的远程身份验证至关重要，尤其是在高度敏感的信息系统中。
1
A New Remote User Authentication Scheme Using Smart Cards
with Forward Secrecy
Manoj Kumar
Abstract – Hwang and Li proposed the first remote user
authentication scheme using smart cards to solve the
problems of Lamport scheme. Unfortunately, Hwang and Li’s
scheme has some security weaknesses. First, Chan- Chang,
Shen- Lin- Hwang and then Chang-Hwang pointed out some
attacks on Hwang – Li’s scheme. This paper presents a new
remote user authentication scheme with forward secrecy,
which provides forward secrecy to the long term secret key of
the authentication server. This scheme is also secure against
Chan – Cheng and all the extended attacks
1
.
Index Terms — Cryptography, Remote user
authentication, Authentication server, Smart card,
Password, Cryptanalysis, Network security, Check digit,
Forward secrecy
I. INTRODUCTION
ASSWORD based remote user authentication schemes are
used to check the validity of a login request made by a
remote user U to gain the access rights on an authentication
server (AS). In these schemes, the AS and the remote user U
share a secret, which is often called as password. With the
knowledge of this password, the remote user U uses it to
create a valid login request to the AS. To provide the access
rights to the user U, AS checks the validity of the login
request. Password authentication schemes with smart cards
have a long history in the remote user authentication
environment. So far different types of password authentication
schemes with smarts cards [2]-[4]-[5]-[6]-[7]-[11]-[12]-[18]-
[20]-[21]-[23]-[24]-[31] have been proposed.
Lamport [21] proposed the first well-known remote
password authentication scheme using smart cards. In
Lamport’s scheme, the AS stores a password table at the
server to check the validity of the login request made by the
user. However, high hash overhead and the necessity for
password resetting decreases the suitability and practical
ability of Lamport’s scheme. In addition, the Lamport scheme
is vulnerable to a small n attack [8]. Since then, many similar
schemes [26]-[29] have been proposed. They all have a
common feature: a verification password table should be
securely stored in the AS. Actually, this property is a
disadvantage for the security point of view. If the password
table is stolen /removed /modified by the adversary, the AS
will be partially or totally braked/affected.
In 2000, Hwang and Li [23] pointed that Lamport’s scheme
suffers from the risk of a modified password table and the
cost of protecting and maintaining the password table.
1
Manoj Kumar is with the Department of Applied Sciences and
Humanities, Sharda Group of Institutions (SGI), Jawahar Nagar, Khandri,
Agra, India - 282004, (e-mail: Balyanyamu@rediffmail.com,
Chayayamu@yahoo.co.in)
.
Further, they proposed a new remote user authentication
scheme using smart cards. This scheme does not maintain the
password table to check the validity of the login request. Also,
it can withstand message-replaying attack.
In [9], Chan and Cheng pointed out an attack on the
Hwang-Li’s scheme. In 2003, Shen-Lin- Hwang [18]
discussed a different attack on the Hwang-Li’s scheme and
they also proposed a modified scheme to prevent the attacks
on Hwang-Li’s scheme. In the same year, Chang and Hwang
[3] explained the practical problems of the Chan – Cheng’s
attack on the Hwang-Li’s scheme and Leung, - Cheng, - Fong
and Chen [19] pointed out that the Shen-Lin-Hwang’s scheme
is still vulnerable to the attack proposed by Chan and Cheng.
Awasthi and Lal [2] pointed a different type of attack on
Hwang-Li’s scheme and they also introduced a remote user
authentication scheme. Awasthi and Lal claimed that their
scheme provides forward secrecy [1] - [38] to the AS. In 2004,
Kumar [22] analyzed the practical pitfalls of Awasthi and
Lal’s scheme. Kumar also pointed out the security pitfalls of
Awasthi and Lal’s scheme. In the same year, Lee et al. [30]
raised a question on the correctness of Awasthi and Lal’s
scheme. Lee et al. also proved that Awasthi and Lal’s scheme
is incorrect and does not provide the forward secrecy to the
secret key of the AS.
Contributions
This paper proposes a new remote user authentication
scheme with forward secrecy. Our scheme provides forward
secrecy with respect to the secret key of the long - term secret
key of the AS if compromised of the secret key of the AS does
not result in compromise of the security of the previously
registered identities and the corresponding passwords. Our
scheme is also removes the security pitfalls of Hwang and
Li’s scheme.
Organization
Section II reviews the Hwang – Li’s scheme [23]. Section
III describes the cryptanalysis of Hwang – Li’s scheme.
Section IV reviews Shen-Lin- Hwang’s scheme [18]. Section
V describes the cryptanalysis of Shen-Lin- Hwang’s scheme.
Section VI reviews the Awasthi and Lal’s scheme [2]. The
security pitfalls and the comments on Awasthi and Lal’s
scheme are described in the section VII. Section VIII presents
a new remote user authentication scheme with forward
secrecy. The security of the new scheme is analyzed in
section IX. Finally, comes to a conclusion in the section X.
II. REVIEW OF HWANG-LI’S SCHEME
There are three phases in the Hwang-Li’s scheme: the
registration phase, login phase and the authentication phase.
In the registration phase, the user U sends a request to the AS
for the registration. The AS will issue a smart card and a
password to every user legal through a secure channel. In the
P
下载后可阅读完整内容，剩余6页未读，立即下载
点击了解资源详情
点击了解资源详情
点击了解资源详情
2021-02-09 上传
2021-02-09 上传
2021-02-22 上传
2021-02-09 上传
2021-02-10 上传
2021-02-09 上传
2021-02-09 上传
longmumin
- 粉丝: 0
- 资源: 10
我的内容管理
展开
