论文部分内容阅读
2009年Park等提出了一个高效远程用户认证协议,并宣称这是第一个能抵抗离线口令猜测攻击的基于智能卡的口令认证方案,具有不需要存储口令表、没有时间戳、传输和计算量小等优点.然而,本文指出了他们的方案无法抵抗离线口令猜测攻击和伪造攻击.为克服其安全性缺陷,提出了不影响原方案功能的、基于随机数和基于时间戳的两个认证协议.技术分析表明提出的改进方案是安全、高效和实用的.
Park et al. Proposed an efficient remote user authentication protocol in 2009 and claimed that this is the first smart card-based password authentication scheme that can resist off-line password guessing attacks, with no need to store password tables, no timestamps, small transmission and calculations Etc. However, this paper points out that their scheme can not resist offline password guessing attacks and counterfeit attacks.In order to overcome their security flaws, two authentication protocols based on random number and timestamp are proposed, which do not affect the original scheme. Technical analysis shows that the proposed improvement is safe, efficient and practical.