A Common Weakness of Password Authentication Schemes Requiring Synchronous Update of Stored Data

Abstract

To resist off-line password guessing attacks without using public-key techniques, many newer hash-based one-time password authentication schemes additionally employ a smart card to generate a one-time high-entropy passcode from the userchosen fixed password. Among these schemes, some require synchronous update of stored data in the user’s smart card and the server. Herein, we show that such schemes tend to suffer from denial-ofservice attacks by using three illustrative examples.