Attacks and Solutions of Yang et al.'s Protected Password Changing Scheme

Article type: Research Article

Authors: Yoon, Eun‐Jun | Ryu, Eun‐Kyung | Yoo, Kee‐Young

Affiliations: Department of Computer Engineering, Kyungpook National University, 1370 Sankyuk‐dong, Buk‐gu, Daegu 702‐701, South Korea, e‐mail: {ejyoon,ekryu}@infosec.knu.ac.kr, [email protected]

Abstract: Recently, Yang et al. proposed an improvement to Tseng et al.'s protected password changing scheme that can withstand denial of service attack. However, the improved scheme is still susceptible to stolen‐verifier attack and denial of service attack. Accordingly, the current paper demonstrates the vulnerability of Yang et al.'s scheme to two simple attacks and presents an improved protected password change scheme to resolve such problems. In contrast to Yang et al.'s protected password changing scheme and the existing password change schemes using server's public key, the proposed scheme can securely update user passwords without a complicated process and server's public key.

Keywords: cryptography, password, authentication, discrete logarithm, hash function

Journal: Informatica, vol. 16, no. 2, pp. 285-294, 2005