Cryptanalysis of Two ID Based Password Authentication Schemes for Multi-server Environments

Recently, Hsiang and Shih proposed a secure dynamic ID based remote user authentication scheme for multi-server environment. In this paper, we show that Hsiang and Shih's scheme is still vulnerable to off-line password guessing attacks, impersonation attacks and server spoofing attacks. And it cannot resist agai nst extracting secr et data by in tercepting th e authentication m essage. Chen , Hua ng a nd Chou proposed an improvement on Hsian g and Shih 's scheme. However, we demonstrate that Chen, Huang an d C hou's i mproved schem e s uffers from imp ersonation attac ks, pa ssword g uessing a ttacks and server spoofing attacks. In addition, Chen et al.'s scheme cannot provide perfect forward security.