Improvement of a security enhanced one-time two-factor authentication and key agreement scheme

In 2010, Holbl et al. showed that Shieh et al.'s mutual authentication and key agreement scheme is vulnerable to the smart card lost attack, not achieving perfect forward secrecy, and proposed a security enhanced scheme to eliminate these weaknesses. In this paper, we show that Holbl et al.'s security enhancement is still vulnerable to the smart card lost attacks. In addition, their scheme cannot resist impersonation attacks and parallel session attacks. Seeing that the existing mutual authentication schemes using smart cards are almost vulnerable to the smart card lost attacks, we further propose a new one-time two-factor mutual authentication and key agreement scheme to eliminate these weaknesses. (C) 2012 Sharif University of Technology. Production and hosting by Elsevier B.V. All rights reserved.