关键词: 用户认证, 智能卡, 离线密码字猜测攻击, 相互认证

Abstract: In this paper, Duan et al.’s scheme is analyzed. It is showed that this scheme is insecure against offline-guessing attack, replay attack, forgery attack and a session key doesn’t be provided after mutual authentication. An improved scheme is proposed that overcomes the above-mentioned security flaws with not affecting the merits of the original scheme. The proposed scheme not only allows the users to choose and change their passwords freely, but also generates a session key agreed by the user and the server.

Key words: user authentication, smart card, offline password guessing attack, mutual authentication