| dc.description.abstract | Authentication ensures that servers′ services can only be obtained by legitimate users.
The password-based authentication scheme is regarded as one of the most generally used methods of authentication on the internet. In one-time password authentication schemes, users′ passwords are dynamically changed in each user login. The purpose of this thesis is to propose a secure and practical one-time password scheme that is computation efficient, storage efficient, interaction minimization, and time-stamp synchronization free for the prover. We revisit the challenge-response based Schnorr identification protocol. Our idea comes from reusing a challenge with different commitments in the Schnorr identification protocol, and we also give a brief security analysis to explain why this kind of challenge-reused version is secure. In this thesis, two one-time password schemes based on this modified Schnorr identification protocol are proposed. The preliminary scheme provides unilateral authentication and can resist the replay attack, brute force attack, impersonation attack, stolen verifier attack, verification-table tampering attack, and server compromise attack. In addition, this scheme is practical for smart card applications. The enhanced scheme provides mutual authentication and session key agreement, and it can resist the replay attack, impersonation attack, brute force attack, man-in-the-middle attack, reflection attack, and parallel session attack.
| en_US |