Affiliations: Department of Computer Science and Information Engineering, National Chiayi University, 300 University Road, Chia-Yi City, Taiwan 600, R.O.C., e-mail: thchen@mail.ncyu.edu.tw | Institute of Computer Science, National Chung-Hsing University, 250 Kuo-Kuang Road, Taichung 402, Taiwan, R.O.C.
Abstract: Recently, there are several articles proposed based on Yang and Shieh's password authentication schemes (YS for short) with the following features: (1) A user can choose password freely. (2) The server does not need to maintain a password table. (3) There is no need to involve a trusted third party. Although there were several variants of the YS-like schemes claimed to address the forgery attacks, this paper analyzes their security and shows that they still suffer from forgery attacks. Furthermore, a new scheme based on the concept of message authentication is proposed to foil the forgery attack.
