title: Security enhanced anonymous multiserver authenticated key agreement scheme using smart cards and biometrics.
abstract: An anonymous user authentication scheme allows a user, who wants to access a remote application server, to achieve mutual authentication and session key establishment with the server in an anonymous manner. To enhance the security of such authentication schemes, recent researches combined user's biometrics with a password. However, these authentication schemes are designed for single server environment. So when a user wants to access different application servers, the user has to register many times. To solve this problem, Chuang and Chen proposed an anonymous multiserver authenticated key agreement scheme using smart cards together with passwords and biometrics. Chuang and Chen claimed that their scheme not only supports multiple servers but also achieves various security requirements. However, we show that this scheme is vulnerable to a masquerade attack, a smart card attack, a user impersonation attack, and a DoS attack and does not achieve perfect forward secrecy. We also propose a security enhanced anonymous multiserver authenticated key agreement scheme which addresses all the weaknesses identified in Chuang and Chen's scheme.
authors.affiliation: Department of Computer Engineering, Sungkyunkwan University, 2066 Seoburo, Suwon, Gyeonggido 440-746, Republic of Korea.
authors.forename: Younsung
authors.initials: Y
authors.lastname: Choi
authors.affiliation: Department of Computer Engineering, Konkuk University, 268 Chungwondaero, Chungju, Chungcheongbukdo 380-701, Republic of Korea.
authors.forename: Junghyun
authors.initials: J
authors.lastname: Nam
authors.affiliation: Department of Computer Engineering, Sungkyunkwan University, 2066 Seoburo, Suwon, Gyeonggido 440-746, Republic of Korea.
authors.forename: Donghoon
authors.initials: D
authors.lastname: Lee
authors.affiliation: Department of Computer Engineering, Sungkyunkwan University, 2066 Seoburo, Suwon, Gyeonggido 440-746, Republic of Korea.
authors.forename: Jiye
authors.initials: J
authors.lastname: Kim
authors.affiliation: Department of Computer Engineering, Sungkyunkwan University, 2066 Seoburo, Suwon, Gyeonggido 440-746, Republic of Korea.
authors.forename: Jaewook
authors.initials: J
authors.lastname: Jung
authors.affiliation: Department of Computer Engineering, Sungkyunkwan University, 2066 Seoburo, Suwon, Gyeonggido 440-746, Republic of Korea.
authors.forename: Dongho
authors.initials: D
authors.lastname: Won
mesh_terms: D000465:Algorithms; D056667:Biometric Identification / Q000379:methods*; D016494:Computer Security / Q000592:standards*; D003219:Confidentiality / Q000592:standards*; D006801:Humans; D015203:Reproducibility of Results; D014584:User-Computer Interface