A Secure and Efficient Multi-Factor Mutual Certificateless Authentication with Key Agreement Protocol for Mobile Client-Server Environment on ECC without the third-party

In 2009, Yang and Chang proposed an ID-based remote mutual authentication with key agreement scheme on elliptic curve cryptosystem (ECC). Based upon ID-based concept, Yang and Chang scheme (YC scheme) does not require additional computations for certificate and is not constructed by bilinear-pairings, which is an expensive operation on elliptic curve. In addition, YC scheme not only provides mutual authentication but also supports a session key agreement between the user and the server. Therefore, YC scheme is more efficient and practical than the related works. However, we find YC scheme is vulnerable to an impersonation attack and does not provide perfect forwardsecrecy in spite of efforts to perform mutual authentication and session key agreement between the user and the remote server and reduce the computational costs than the related works. Therefore, this paper proposes an improved ID-based remote mutual authentication with key agreement scheme for mobile devices on ECC. Compared with YC scheme, the proposed scheme is more secure, efficient, and practical for mobile devices because the proposed scheme not only eliminates the security flaws of YC scheme but also reduces the computational costs between the user and the server.

An ID-based remote mutual authentication with key agreement scheme for mobile devices on elliptic curve cryptosystem

Remote mutual authentication is an important part of security, along with confidentiality and integrity, for systems that allow remote access over untrustworthy networks, like the Internet. In 2006, Shieh-Wang pointed out the weakness of Juang's remote mutual authentication scheme using smart card and further proposed a novel remote user authentication scheme using smart card. However, this paper demonstrates that Shieh-Wang's scheme still does not provide perfect forward secrecy and is vulnerable to a privileged insider's attack. We also present an improved scheme based on the Elliptic Curve Diffie-Hellman problem (ECDHP) and secure one-way hash function, in order to isolate such security problems.

SUMMARYWith the use of smart card in user authentication mechanisms, the concept of two‐factor authentication came into existence. This was a forward move towards more secure and reliable user authentication systems. It elevated the security level by requiring a user to possess something in addition to know something. In 2010, Sood et al. and Song independently examined a smart‐card‐based authentication scheme proposed by Xu et al. They showed that in the scheme of Xu et al., an internal user of the system can turn hostile to impersonate other users of the system. Both of them also proposed schemes to improve the scheme of Xu et al. Recently, Chen et al. identified some security problems in the improved schemes proposed by Sood et al. and Song. To fix these problems, Chen et al. presented another scheme, which they claimed to provide mutual authentication and withstand lost smart card attack. Undoubtedly, in their scheme, a user can also verify the legitimacy of server, but we find that the scheme fails to resist impersonation attacks and privileged insider attack. We also show that the scheme does not provide important features such as user anonymity, confidentiality to air messages, and revocation of lost/stolen smart card. Besides, the scheme defies the very purpose of two‐factor security. Furthermore, an attacker can guess a user's password from his or her lost/stolen smart card. To meet these challenges, we propose a user authentication method with user anonymity. We show through analysis and comparison that the proposed scheme exhibits enhanced efficiency in contrast to related schemes, including the scheme of Chen et al. Copyright © 2013 John Wiley & Sons, Ltd.

In recent times, Debiao et al. proposed an ID-based user authentication with key agreement protocol on elliptic curve cryptography (ECC). Conversely, our analysis shows that their scheme contains various security limitations such as many logged-in users' problem, privileged insider attack, impersonation attack and so on. In this paper, we propose an anonymous ID-based remote mutual authentication with key agreement protocol on ECC using smart cards. The proposed scheme affords important security features such as identity protection, anonymity and secure session-key while remain the merits of Debiao's scheme. Our scheme guards the original identity of user by making it anonymous using pseudo random number generators, in order to free it from re-registration problem and smart-card-stolen attacks. The proposed scheme is also a two-factor authentication scheme, and makes the authentication procedure more secure by asking the user to provide two-means of identification. It also provides identity updating feature as depicted in further subsections.

In 2014, Arshad and Nikooghadam proposed an authentication and key agreement scheme for SIP to conquer the existing defects in Irshad et al.'s scheme. They claimed that their scheme resists various security attacks and has low computation cost. We found that even though Arshad et al.'s scheme achieves high efficiency, their scheme is insecure against server spoofing attacks, denial of service attacks and privilege insider attacks. Furthermore, the password change phase of their scheme is complicated and their scheme cannot provide user anonymity. To overcome the weaknesses of Arshad et al.'s scheme, we proposed an anonymous and secure authentication and key agreement protocol for SIP. Compared with Arshad et al.'s scheme, our scheme not only withstands more security attacks, but also achieves user anonymity and high efficiency.

Since the technologies of Internet and wireless communication have grown tremendously in the past, people have always occupied of some security sensitive wireless devices for the Internet services, such as voice call, instant messaging, online game, electronic banking, electronics trading and so on. Over a few decades, session key sharing has been used as a promising strategy for two/three parties authentication. In addition, several authentication and key agreement (AKA) protocols have been developed, but then very few protocols have been dedicated for the IP multimedia domain. In the literature, the 3-PAKE schemes, such as Xie et al., Xiong et al., Tallapally, Hsieh et al. and Tseng et al. have thoroughly been studied for the identification of its security weaknesses. Following are the security weaknesses of 3-PAKE schemes, namely user anonymity, known-key security, mutual authentication, (perfect) forward secrecy and so on. In addition, the existing schemes can not withstand for the attacks, like modification, key-impersonation, parallel-session, privileged-insider and so on. Thus, this paper presents a novel three party authentication and key agreement protocol based on computational Diffie---Hellman which not only fulfills all the security properties of AKA, but also provides the resiliency to the most of the potential attacks. Since the proposed 3-PAKE scheme has less computational overhead, it is able to curtail all the hop-by-hop security association defined by the standard of third generation partnership project. Above all, a real time multimedia server and client systems have been designed and developed for the purpose of average end-to-end delay analysis. The examination result is shown that the proposed 3-PAKE scheme can offer better service extensibility than the other 3-PAKE schemes, since it has the minimum message rounds to be executed for the establishment of service connection.

In the new paradigm of blockchain-powered intelligent edge, the key agreement is a significant problem that has not been extensively studied so far. Existing key agreement protocols in the traditional public-key setting are usually too complicated and heavy for edge and end devices. Besides, most protocols in use do not have effective measures to resist side-channel attacks, which are increasingly threatening cloud servers, edge devices, and end devices. Identity (ID)-based protocols can be conveniently implemented in the blockchain-powered intelligent edge. Several leakage-resilient ID-based protocols, which can resist side-channel attacks, have been proposed. However, they all involve time-consuming pairing computations. Besides, none of them address side-channel attacks to the key generation center (KGC). This article designs and realizes two novel ID-based key agreement protocols for the blockchain-powered intelligent edge, including an extended Canetti-Krawczyk (eCK) secure ID-based authenticated key agreement (AKA) protocol and a continuous after-the-fact leakage-resilient eCK (CAFL-eCK) secure ID-based AKA protocol. Both protocols do not involve any heavy pairing computation. Besides, the second one can resist side-channel attacks to the KGC and the communicating parties. A hybrid implementation of the two protocols can achieve high efficiency and strong security at the same time in blockchain-powered intelligent edge environments. This is demonstrated via a use case of a blockchain-powered smart home.

A secure light weight scheme for user authentication and key agreement in multi-gateway based wireless sensor networks

In this paper, we propose a secure two-factor remote user authentication protocol using Elliptic curve cryptography. The proposed protocol provides the mutual authentication of participants, session key agreement and user anonymity. The security of our proposed protocol is based on one way hash function and elliptic curve cryptosystem and it is secure against all relevant security attacks. Compared with other relevant protocol, the security analysis and performance evaluation show that our proposed protocol can provide high level of security with less communication and computation cost. In addition, the BAN logic is applied to demonstrate the validity of the proposed protocol.

With the development of wireless networks and medical sensors, wireless body area networks are playing more and more important role in the field of healthcare service. The data transmitted in WBANs is very sensitive since it will be used in clinical diagnoses or measurements. Therefore, security and privacy of communication in WBANs derive increasing attentions from the academia and industry. In this paper, we propose an identity (ID)-based efficient anonymous authentication scheme for WBANs using elliptic curve cryptosystem (ECC). Due to the ID-based concept, there is no certificate is needed in the proposed scheme. Moreover, the proposed scheme not only provides mutual authentication between the client and the application provider but also provides client anonymity. Performance analysis shows that improvements of 50.58% and 3.87% in the client side and the application provider side separately. Then the proposed scheme is more suitable for WBANs.

Elliptic curve cryptosystems (ECCs) are becoming more popular because of the reduced number of key bits required in comparison to other cryptosystems (for example, a 160 bit ecc has roughly the same security as 1024 bit RSA). ECCs are especially suited to smart cards because of the limited memory and computational power available on these devices. This paper discusses an optimized implementation of the elliptic curve Digital Signature Algorithm implemented over the field $GF(p)$ on a Motorola smart card. Algorithms for point addition, point doubling and scalar multiplication are compared according to their timings. The effects of different memory usage, code size and speed tradeoffs which were considered during the implementation are discussed. Also, optimized point addition and doubling algorithms are presented.

One of the main barriers to the development of multi-application smart card is the limitation of the memory size and processing power. This paper gives a solution to it by using an elliptic curve cryptosystem (ECC) as the public key scheme. The basic mathematics principles of ECC are discussed. Based on the ECC, we also put a digital certificate inside the smart card. This paper presents a prototype of a multi-application smart card system using the ECC certificate. Several security issues are also discussed.

Most anonymous Conference Key Distribution (CKD) systems cannot provide forward security, which is a very important property. Even though some CKD systems provide that property, they can only provide partial forward security, not perfect forward security. An identity-based CKD scheme with user anonymity is proposed in this paper. Under the one-way hash (OWH) [1] and bilinear Diffie-Hellman (BDH) [2] cryptographic assumptions, the proposed scheme is secure against passive attacks, impersonation attacks and conspiracy attacks. Moreover, by distributing a random number to the participants through the Private Key Generator (PKG), this scheme provides perfect forward security, that is, even if the private keys of all the participants (including the chairman) are compromised, the conference key contributed by the chairman in the past will not be compromised.

In 2005, Yoon et al. proposed a user-friendly remote user authentication scheme using smart cards. The security of their scheme is based on one-way hash function and they claimed that their scheme is secured from attacks and achievable for proving mutual authentication, freely choosing password, no verification tables, and involving very lightweight hashing operations. However, we find that Yoon et al.'s scheme suffers from the denial of service attack and performs only unilateral authentication (only user authentication). In this paper we consequently propose an enhanced version to eliminate the vulnerability. Furthermore, our enhanced scheme can also provide mutual authentication and key agreement between a remote server and login users.