Abstract: Password authentication is the simplest，most convenient and most widely used means of authentication.Recently，Tsaur and some others point out that the password change protocol which is presented by Chang presents the denial-of-service attacks and cannot provide backward secrecy.Then，they present an improved password change mechanism which is claimed to be secure.Their protocol is analysed to show that their improved password change mechanism fails to against the off-line dictionary attack and cannot provide backward secrecy and forward secrecy.Finally，an improved against off-line dictionary attack password change protocol is proposed，which can resist off-line dictionary attack and provide backward secrecy and forward secrecy.

Key words: authentication, password change, off-line dictionary attacks, forward secrecy, backward secrecy

摘要： 口令认证是最简单，方便和应用最广泛的一种用户认证方式。最近，Tsaur等人指出了Chang等人的口令更新协议存在拒绝服务攻击并且不能提供口令的后向安全。随后，他们给出了一种改进的口令更新协议，并声称该协议是安全的。文中，分析了Tsaur等人的口令更新协议，指出了其方案是易受离线字典攻击的，且不能提供口令的前向和后向安全性。最后，提出一种改进的口令更新协议，并分析其安全性。

关键词: 认证, 口令更新, 离线字典攻击, 前向安全, 后向安全