Weaknesses and Improvements of Yang–Chang–Hwang's Password Authentication Scheme

Article type: Research Article

Authors: Ku, Wei‐Chi | Tsai, Hao‐Chuan

Affiliations: Department of Computer Science and Information Engineering, Fu Jen Catholic University, 510 Chung Cheng Road, Hsinchuang, Taipei County, Taiwan 242, R.O.C., e‐mail: wcku@csie.fju.edu.tw

Abstract: In 2001, Tseng, Jan, and Chien proposed an improved version of Peyravian–Zunic's password authentication scheme based on the Diffie–Hellman scheme. Later, Yang, Chang, and Hwang demonstrated that Tseng–Jan–Chien's scheme is vulnerable to a modification attack, and then described an improved scheme. In this paper, we show that Yang–Chang–Hwang's scheme is still vulnerable to a denial‐of‐service attack and a stolen‐verifier attack. In addition, we also propose an improved scheme with better security.

Keywords: password authentication, denial‐of‐service attack, stolen‐verifier attack

Journal: Informatica, vol. 16, no. 2, pp. 203-212, 2005