Improvement of an Efficient and Practical Solution to Remote Authentication: Smart Card

Recently, Chien et al. proposed an efficient timestampbased remote user authentication scheme using smart cards. The main merits include: (1) user-independent server, i.e., there is no password or verification table kept in the server; (2) users can freely choose their passwords; (3) mutual authentication is provided between the user and the server; and (4) lower communication and computation cost. In this paper, we show that Chien et al.’s scheme is insecure against forgery attack because one adversary can easily pretend to be a legal user, pass the server’s verification and login to the remote system successfully. An improved scheme is proposed that can overcome the security risk while still preserving all the above advantages. key words: remote authentication, smart card, network security, cryptography, data security