Park等远程用户认证协议的分析与改进

Cryptanalysis and improvement of Park et al.'s remote user authentication protocol

2009年Park等提出了一个高效远程用户认证协议,并宣称这是第一个能抵抗离线口令猜测攻击的基于智能卡的口令认证方案,具有不需要存储口令表、没有时间戳、传输和计算量小等优点.然而,本文指出了他们的方案无法抵抗离线口令猜测攻击和伪造攻击.为克服其安全性缺陷,提出了不影响原方案功能的、基于随机数和基于时间戳的两个认证协议.技术分析表明提出的改进方案是安全、高效和实用的.

In 2009,Park,et al.proposed an efficient remote user authentication protocol.They claimed that their protocol was the first password and smart card based remote user authentication scheme which can resist the off-line password guessing attack,and had many advantages over existing solutions such as no password tables and timestamp,low communication and computational costs.However,this paper shows that their protocol cannot resist the forgery attack and off-line password guessing attack.To overcome the security weaknesses,two improved schemes based on either nonce or timestamp without affecting the merits of the Park,et al.scheme are proposed.Technical discussions are provided to show that the improved protocol is secure,efficient and practical.