On the Security of an Efficient and Secure Dynamic ID-Based Remote User Authentication Scheme

A remote user authentication scheme [1] is used to verify the legitimacy of remote users’ login requests through an insecure channel. Password-based authentication scheme is the most common method to check the validity of the login message and authenticate the user. Recently, many authentication schemes [1]–[12] have been proposed to improve the security and practicability of authentication. Quite recently, Wang et al. [12] proposed an efficient and secure dynamic ID-based remote user authentication scheme based on the one-way secure hash function. Wang et al. claimed that their scheme has the following merits: 1) it allows users to change and choose passwords freely; 2) server does not maintain any verifier tables because it uses a smartcard to store a secret key; 3) it provides mutual authentication between user and remote server; 4) it overcomes the fatal drawback that user’s authentication is independent of the password; 5) it is secure to against ID-theft [9]–[11], replay attacks and insider attacks, etc. Unfortunately, we find that Wang et al.’s scheme [12] is still vulnerable to impersonation attacks. Accordingly, this letter demonstrates that Wang et al.’s scheme is vulnerable to impersonation attacks, in which an attacker can easily impersonate any legal user.