Countermeasure on password-based authentication scheme for multi-server environments

Abstract

Recently, Tan proposed a remote user authentication scheme suite for multi-server environments, in which users can be authenticated using a single password shared with the registration center. A fundamental requirement for password-based authentication is security against off-line dictionary attacks. However, Tan’s scheme fails to meet the requirement. In this paper, we report this security problem with Tan’s scheme and show how to solve it.