Robust Remote Mutual Authentication Scheme with Key Agreement

Abstract

In 2006, Shieh and Wang proposed a remote mutual authentication and key agreement scheme, in which a user can login to a remote server with his password and smartcard. In Shieh and Wang’s scheme, it requires only hash functions operations during the login and key agreement phase. However, Hölbl et al. demonstrated some attacks on Shieh and Wang’s scheme and proposed an improved scheme to overcome the shown attacks in 2010. In this paper, we point out that Hölbl et al.’s proposed scheme is still vulnerable to an offline password guessing and forgery attack. In addition, Hölbl et al.’s scheme fails to achieve explicit key authentication. We propose a robust remote mutual authentication scheme with key agreement to resist against above mentioned attacks and provide more security requirements.