On the Remote Authentication with Self - Protected Smart Cards 植基於具自保功能智慧卡之遠端認證機制

Smart card is a secure device for remote authentication. However, if cardholders lost their card, attackers always can successfully guess passwords and impersonate legal users to login. In 2004, Lee et al. proposed a remote authentication scheme with smart cards. In this paper, we first show that their scheme cannot withstand the guessing attack. If attackers obtain the card, they can successfully guess the password. Next, we propose a self-protected smart card with a one-time pad. With the self-protected smart card, we propose a simple remote authentication scheme that can resist guessing attack. The proposed scheme can offer cardholders free from security risk even when they lose their smart cards.