The Weaknesses of the Virtual Password Authentication Protocol with Cookie

2018 2nd annual International Conference on Cloud Technology and Communication Engineering

计算机科学;无线电电子学

Pan, Hsieh-Tsen^1 ; Wu, Chia-Chun^2 ; Yang, Cheng-Ying^3 ; Hwang, Min-Shiang^1,4

Department of Computer Science and Information Engineering, Asia University, Taichung

41354, Taiwan^1

Department of Industrial Engineering and Management, National Quemoy University, Taiwan^2

Department of Computer Science, University of Taipei, Taipei, Taiwan^3

Department of Medical Research, China Medical University Hospital, China Medical University, Taichung

40402, Taiwan^4

关键词: Brute-force attack;    Eavesdropping attacks;    Man in the middle attacks;    Off-line dictionary attacks;    Online dictionary attacks;    Password attacks;    Password authentication protocols;    Password-based authentication;   

Others  :  https://iopscience.iop.org/article/10.1088/1757-899X/466/1/012009/pdf
DOI  :  10.1088/1757-899X/466/1/012009

学科分类：计算机科学（综合）

来源: IOP

【 摘 要 】

Password-based authentication protocols are susceptible to various attacks. Recently, Sood, Sarje, and Singh proposed an inverse cookie-based virtual password authentication protocol. Their protocol is practical and easy to implement. They claim that their scheme is secure to against various attacks, include online dictionary attack, offline dictionary attack, eavesdropping attack, denial of service attack, phishing attack, pharming attack, man-in-the-middle attack, replay attack, leak of verifier attack, message modification or insertion attack, and brute force attack. However, we find that some weaknesses of Sood et al.'s scheme. In this article, we will show that Sood et al.'s scheme is vulnerable to the on-line guessing password attack and the denial of service attack.