Park等远程用户认证协议的分析与改进  

Cryptanalysis and improvement of Park et al.'s remote user authentication protocol

作　　者：谢琪[1,2] 陈德人[1] 于秀源[3] 

机构地区：[1]浙江大学计算机学院,杭州310027 [2]杭州师范大学信息科学与工程学院,杭州310036 [3]杭州师范大学理学院,杭州310036

出　　处：《系统工程理论与实践》2010年第10期1877-1882,共6页Systems Engineering-Theory & Practice

基　　金：国家重点基础研究发展计划(973计划)(2006CB303100);国家博士后科学基金(20080440200);国家自然科学基金(10671051;61070153);浙江省自然科学基金(Y1080831)

摘　　要：2009年Park等提出了一个高效远程用户认证协议,并宣称这是第一个能抵抗离线口令猜测攻击的基于智能卡的口令认证方案,具有不需要存储口令表、没有时间戳、传输和计算量小等优点.然而,本文指出了他们的方案无法抵抗离线口令猜测攻击和伪造攻击.为克服其安全性缺陷,提出了不影响原方案功能的、基于随机数和基于时间戳的两个认证协议.技术分析表明提出的改进方案是安全、高效和实用的.In 2009,Park,et al.proposed an efficient remote user authentication protocol.They claimed that their protocol was the first password and smart card based remote user authentication scheme which can resist the off-line password guessing attack,and had many advantages over existing solutions such as no password tables and timestamp,low communication and computational costs.However,this paper shows that their protocol cannot resist the forgery attack and off-line password guessing attack.To overcome the security weaknesses,two improved schemes based on either nonce or timestamp without affecting the merits of the Park,et al.scheme are proposed.Technical discussions are provided to show that the improved protocol is secure,efficient and practical.

关 键 词：智能卡 远程用户认证 双向认证 离线口令猜测攻击 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]