Secure password-based authentication scheme with anonymous identity without smart cards

Abstract

Rhee-Kwon-Lee’s password-based scheme without using smart cards is vulnerable to insider attack,password can’t be changed freely,and its computational cost is high.In order to fix all these security flaws,a new password-based authentication scheme with anonymous identity without using smart cards was presented.The security and computational efficiency of our scheme were improved by confusing the anonymous identity with user’s password and taking use of the timestamp.According to comparisons with other password authentication schemes without smart cards,our scheme not only fixes weaknesses of Rhee-Kwon-Lee’s scheme,but also satisfies all the security requirements for ideal password authentication without smart cards and is the better one in security performance and computational cost.

Keywords

• password;password authentication;hash function;attack;smart card