Search

This paper presents a smart card based remote access password authentication scheme which can verify a log-in password without verification table. It utilizes the signature property of public key systems. The security of our scheme rests in part on the difficulty of factoring a large number and on the discrete logarithm problem. Not only can the network users freely choose their preferred passwords, but the network system can also be protected against replay by time stamping the password.

Recently, Sun proposed an efficient remote user authentication scheme by employing one-way hash function. In his scheme, the system does not need to maintain a password table and the communication cost of the scheme is low, but the user cannot freely choose a password. Therefore, Wu and Chieu improved Sun's scheme for enhancing the user's demand that the user can choose and change his password freely. However, in this paper, we point out that Wu and Chieu's improvement is vulnerable to the password guessing and forgery attacks.

A conventional password authentication scheme requires password files or verification tables which cannot withstand an attack of replaying previously intercepted passwords by an intruder. In this paper, we propose a new password authentication scheme which is based on ElGamal's signature scheme. This scheme is suitable for applications which make use of passwords that are sent from remote locations. Our scheme can verify remote passwords using neither password files nor verification tables. Our password authentication scheme has three phases: (1) the computer system issues a smart card and a password according to the ID submitted by the registering user; (2) the login procedure is invoked; and (3) the password authentication procedure is invoked. We have also analyzed the security of this newly proposed remote password authentication scheme.