A Simple Attack on a Recently Introduced Hash-based Strong-password Authentication Scheme

The user authentication is an important part of network security. Several strong-password authentication protocols have been introduced, but a secure scheme, which probably withstands to several known attacks, is not yet available. Recently, a hash-based strong-password authentication scheme was described in [2], which withstands to the several attacks, including replay, passwordfile compromise, denial-of-service, and insider attacks. However, we show that this protocol is still vulnerable to stolen-verifier, denial-of-service, replay, and impersonation attacks.