How to Preserve User Anonymity in Password-Based Anonymous Authentication Scheme

• SHIN SeongHan

  Information Technology Research Institute (ITRI), National Institute of Advanced Industrial Science and Technology (AIST)

• KOBARA Kazukuni

  Information Technology Research Institute (ITRI), National Institute of Advanced Industrial Science and Technology (AIST)

Abstract

A purpose of password-based anonymous authentication schemes is to provide not only password-based authentication but also user anonymity. In [19], Yang et al., proposed a password-based anonymous authentication scheme (we call it YZWB10 scheme) using the password-protected credentials. In this paper, we discuss user anonymity of the YZWB10 scheme [19] against a third-party attacker, who is much weaker than a malicious server. First, we show that a third-party attacker in the YZWB10 scheme can specify which user actually sent the login request to the server. This attack also indicates that the attacker can link different login requests to be sent later by the same user. Second, we give an effective countermeasure to this attack which does not require any security for storing users' password-protected credentials.

Journal

• IEICE Transactions on Information and Systems

  IEICE Transactions on Information and Systems E101.D (3), 803-807, 2018

  The Institute of Electronics, Information and Communication Engineers

Keywords

• password
• authentication
• user anonymity

Details

• CRID: 1390001204381235968
• NII Article ID: 130006414083
• DOI: 10.1587/transinf.2017edl8183
• ISSN: 17451361
• ISSN: 09168532
• Web Site: https://www.jstage.jst.go.jp/article/transinf/E101.D/3/E101.D_2017EDL8183/_pdf
• Text Lang: en
• Data Source:
  • JaLC
  • Crossref
  • CiNii Articles
  • KAKEN
• Abstract License Flag: Disallowed