Cryptanalysis and Improvement of an Anonymous Multi-server Authenticated Key Agreement Scheme

A multi-server authentication scheme offers a single registration procedure, but allows to access services from multiple servers. For efficiently communicating with the servers, a number of password based remote user authentication schemes have been explored. Recently, Chuang and Chen (Expert Syst Appl 41(4):1411–1418, 2014) have discussed an anonymous multi-server a uthenticated key agreement scheme using smart card together with password and biometrics. This scheme achieves various security requirements while supporting multiple servers as claimed by the authors. In this paper, we show that this scheme is susceptible to different attacks, such as DOS attack, user/server impersonation attack, a smart card attack, session specific temporary key attack, and it does not achieve perfect forward secrecy. In this paper, we propose a new scheme by overcoming the drawbacks of the Chuang and Chen’s scheme. Our scheme can provide non-repudiation as the authentication message sent by a user is digitally signed by the server using the RSA digital signature. Due to efficiency and security, our scheme is suitable for the services like tele medicine information system, which can provide healthcare delivery services between the patients and doctors to employ telecare medicine facilities and access electronic medical records.