A Secure Remote User Authentication Scheme with Smart Cards Manoj Kumar 報告者 : 許睿中 日期 :

Outline Introduction Notations Scheme Conclusions 2

Introduction 3 Register phase Login phase USER SERVER Authentication phase

Introduction The point of vulnerabilities in a remote user authentication scheme: – Security vulnerabilities due to remote user – Security vulnerabilities due to remote server – Security vulnerabilities due to insecure channel To solve these vulnerabilities: – mutual authentication – Secure session key generation 4

Outline Introduction Notations Scheme Conclusions 5

Notations 6 U denote a remote user ID denote an identify of a remote user U ID S denote an identify of a remote server PW denote a password corresponding to a register identify ID AS denote an authentication server XSXS denote a permanent secert key of an authentication server f(. ) denote a cryptographic one way hash function ⊕ XOR operation U↔AS:M the user U send M to the server AS through a secert channel U→AS:M the user U send M to the server AS through a open channel p denote a large prime number S ID the redirected identify corresponding to a registered identifity ID C ID denote a check digit sum corresponding to a register idebtify ID Red(. ) a function to redirect the identity ID for every user U C K (. ) a function to generatr check digit for registered identify

Outline Introduction Notations Schema Conclusions 7

Scheme The Register phase The Login phase The Verification phase The Password change phase 8

The Register phase 9 US

The Login phase 10 U S

The Verification phase 11 U S

The Verification phase 12 US

The Password change phase 13 US

Outline Introduction Notations Scheme Conclusions 14

C onclusions This scheme not only provides mutual authentication between the user and server, but also establishes a common session key to provide message confidentiality. In the password change phase of the propose protocol, each user can change his password without connect to any server. 15