1. 電子商務與數位生活研討會 1 Further Security Enhancement for Optimal Strong-Password Authentication Protocol Tzung-Her Chen, Gwoboa Horng, Wei-Bin Lee,Kuang-Long Lin 3/27/2004

2. 電子商務與數位生活研討會 2 Outline Introduction Review of Ku-Chen scheme The problem of Ku-Chen scheme The proposed scheme Security Analysis Conclusions

3. 電子商務與數位生活研討會 3 Introduction In 2000, Sandirigama et al. proposed SAS scheme lowered storage, processing, and transmission overheads. In 2001, Lin, Sun, and Hwang proposed an enhanced password authentication scheme, called the OSPA.

4. 電子商務與數位生活研討會 4 Introduction In 2002,OSPA protocol has been shown vulnerable to the stolen-verifier attack and the impersonation attack. In 2003, Ku and Chen proposed a new improved version for the OSPA protocol In this paper, an improved scheme with mutual authentication is proposed.

5. 電子商務與數位生活研討會 5 Review of Ku-Chen scheme Notation: h(.) : collision-resistant hash function T : login times k : long-term secret key  : exclusive-or operation

6. 電子商務與數位生活研討會 6 Review of Ku-Chen scheme Registration phase Authentication phase

7. 電子商務與數位生活研討會 7 ID, h 2 (PW  1) Chooses his identity ID and password PW and computes h 2 (PW  1) Calculates verifier v 1 =h 2 (PW  1)  h(ID  k) Store {ID, v 1,T=1} into the verification table

8. 電子商務與數位生活研討會 8 ID, service request T= i c 1 =h(PW  i )  h 2 (PW  i ) c 2 =h 2 (PW  ( i +1))  h(PW  i ) c 3 =h(h 3 (PW  ( i +1))  T) Find i from verification table by the ID

9. 電子商務與數位生活研討會 9 Check c 1, c 2 c 1,c 2,c 3 Get h 2 (PW  i ) by v i  h(ID  k) y 1 =c 1  h 2 (PW  i )=h(PW  i ) y 2 =c 2  y 1 =h 2 (PW  ( i +1)) Check if h(y 1 )=h 2 (PW  i ) h(h(y 2 )  T)=c 3 v i+1 =h 2 (PW  ( i +1))  h(ID  k) Store ID,T= i +1, and v i +1

10. 電子商務與數位生活研討會 10 The problem of Ku-Chen scheme The user is authenticated by the remote server. But, remote server is not authenticated by the user (Server impersonation attack ).

11. 電子商務與數位生活研討會 11 The proposed scheme Registration phase Authentication phase

12. 電子商務與數位生活研討會 12 ID, h 2 (PW  1) Chooses his identity ID and password PW and computes h 2 (PW  1) Calculates verifier v 1 =h 2 (PW  1)  h(ID  k) Store {ID, v 1 } into the verification table

13. 電子商務與數位生活研討會 13 ID, r  h 2 (PW  i ) h(r)  h 2 (PW  i ) Check r c 1 =h(PW  i )  h 2 (PW  i ) c 2 =h 2 (PW  ( i +1))  h(PW  i ) c 3 =h(h 3 (PW  ( i +1))  T) choose r randomly and compute r  h 2 (PW  i ) Get h 2 (PW  i ) by v i  h(ID  k) r =(r  h 2 (PW  i ))  h 2 (PW  i )

14. 電子商務與數位生活研討會 14 Check c 1, c 2 c 1,c 2,c 3 y 1 =c 1  h 2 (PW  i )=h(PW  i ) y 2 =c 2  y 1 =h 2 (PW  ( i +1)) Check if h(y 1 )=h 2 (PW  i ) h(h(y 2 )  T)=c 3 v i+1 =h 2 (PW  ( i +1))  h(ID  k) Store ID and v i +1

15. 電子商務與數位生活研討會 15 Security Analysis Password guess attack Impersonation attack Stolen-verifier attack Server impersonation attack

16. 電子商務與數位生活研討會 16 Conclusions We point out the possible server impersonation problem in the Ku- Chen scheme and propose an enhanced version. The proposed concept of security enhancement is also suitable for the other SAS-like schemes.

17. 電子商務與數位生活研討會 17 THE END