Security Weaknesses of Two Dynamic ID-based User Authentication and Key Agreement Schemes for Multi-server Environment

Abstract

A remote user authentication scheme for multi-server environment provides mutual authentication and session key establishment between users and multiple servers. Recently, two dynamic ID-based remote user authentication schemes for multi-server environment were proposed. In this article, we analyze the security of both schemes. One scheme was proposed by Geng and Zhang. And we show that the proposed scheme suffers from a user-spoofing attack. In 2009, Hsiang and Shih also proposed the other scheme. We show that Hsiang and Shih’s scheme is vulnerable to an insider attack and a server-spoofing server attack.