对两个基于智能卡的口令认证协议的安全性分析  

Cryptanalysis of two smartcard-based remote user password authentication protocols

作　　者：薛锋 汪定 王立萍 马春光[2] 

机构地区：[1]解放军蚌埠汽车士官学校训练部,安徽蚌埠233011 [2]哈尔滨工程大学计算机科学与技术学院,哈尔滨150001

出　　处：《计算机应用》2012年第7期2007-2009,2021,共4页journal of Computer Applications

基　　金：国家自然科学基金资助项目(61073042;61170241);博士后科研人员落户黑龙江科研启动资金资助项目(LBH-Q10141);北京邮电大学网络与交换技术国家重点实验室开放课题(SKLNST-2009-1-10)

摘　　要：身份认证是确保信息系统安全的重要手段,基于智能卡的口令认证协议由于实用性较强而成为近期研究热点。采用基于场景的攻击技术,对最近新提出的两个基于智能卡的口令认证协议进行了安全性分析。指出"对Liao等身份鉴别方案的分析与改进"(潘春兰,周安民,肖丰霞,等.对Liao等人身份鉴别方案的分析与改进.计算机工程与应用,2010,46(4):110-112)中提出的认证协议无法实现所声称的抗离线口令猜测攻击;指出"基于双线性对的智能卡口令认证改进方案"(邓粟,王晓峰.基于双线性对的智能卡口令认证改进方案.计算机工程,2010,36(18):150-152)中提出的认证协议无法抗拒绝服务(DoS)攻击和内部人员攻击,且口令更新阶段存在设计缺陷。分析结果表明,这两个口令认证协议都存在严重安全缺陷,不适合安全需求较高的应用环境。Since identity authentication becomes an essential mechanism to ensure robust system security in distributed networks,smartcard-based remote user password authentication protocols have been studied intensively recently.Two recently proposed smartcard-based authentication protocols were examined with the scenario-based attack techniques.The protocol presented in ＂Cryptanalysis and improvement of Liao et al.＇s remote user authentication scheme＂（PAN Chun-lan,ZHOU An-min,XIAO Feng-xia,et al.Improved remote user authentication scheme.Computer Engineering and Applications,2010,46（4）：110-112） can not withstand the offline password guessing attack as the authors claimed,while the protocol presented in ＂Improved scheme for smart card password authentication based on bilinear pairings＂（DENG Li,WANG Xiao-feng.Improved scheme for smart card password authentication based on bilinear pairings.Computer Engineering,2010,36（18）：150-152） is found vulnerable to the Denial of Service（DoS） attack and insider attack.The analytical results show that,both protocols are susceptible to serious security threats and impractical for security-concerned applications.

关 键 词：身份认证 智能卡 认证协议 离线口令猜测攻击 拒绝服务攻击 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]