Cryptanalysis of Hsiang-Shih’s Secure Dynamic ID Based Remote User Authentication Scheme

Abstract

Recently, Liao and Wang proposed a secure dynamic ID based remote user authentication scheme for multi-server environment. They achieved user's anonymity by using secure dynamic ID instead of static ID. Later, Hsiang and Shih gave an improved scheme to repair the security flaws found in Liao-Wang’s scheme. Hsiang and Shih claimed that their scheme inherits the merits, enhances the security of Liao-Wang’s scheme, and achieves mutual authentication that Liao-Wang’s scheme fails to provide. In this paper, however, we show that Hsiang-Shih’s scheme cannot withstand both user and server impersonation attacks. In addition, their scheme is vulnerable to malicious user and insecure for practical application.