Two - factor Authentication Schemes Based Smart Card and Password with User Anonymity ⋆

Two-factor anonymous authentication using password and smart card could preserve user privacy and reduce the risk than the use of a single authentication factor. Recently, Chang et al. pointed some security weaknesses in Wang et al.’s anonymous authentication scheme and proposed enhanced scheme. They claimed that their scheme provides desired security properties. However, we show that Chang et al.’s scheme is still vulnerable to the off-line dictionary attack and denial of service attacks. To resist these attacks, we propose an improved two-factor authentication and key agreement scheme with user anonymity.