Weaknesses of a Flexible Remote User Authentication Scheme Using Smart Cards

Abstract

Recently, Lee, Hwang, and Yang proposed a verifier-free remote user authentication scheme using smart cards. Their scheme is efficient because of mainly using cryptographic hash functions. However, we find that Lee-Hwang-Yang’s scheme is not reparable once the user’s permanent secret is compromised and is vulnerable to a privileged insider’s attack. Furthermore, it lacks the user eviction mechanism. In this paper, we first review Lee-Hwang-Yang’s scheme, and then show its weaknesses.