Weaknesses and drawbacks of a password authentication scheme using neural networks for multiserver architecture

In 2001, Li et al. proposed a password authentication scheme for the multiserver architecture by using a pattern classification system based on neural networks. Herein, we demonstrate that Li et al.'s scheme is vulnerable to an offline password guessing attack and a privileged insider's attack, and is not reparable. Additionally, we show that Li et al.'s scheme has several drawbacks in practice.

I. Introduction

Password authentication is a popular approach to authenticate users logging into any kind of server. A common feature of conventional password authentication schemes is that a password verification table, which contains the verifiers of users' passwords, should be securely stored in the server. If the password verification table is compromised to an adversary, the system will be partially or totally breached. In 1990, Hwang et al. [2] initially proposed a password authentication scheme that does not require storing verifiers in the server. However, Hwang et al.'s scheme has several drawbacks and weaknesses: 1) the user's password is difficult to memorize; 2) the user cannot freely choose his password; 3) the user cannot freely change his password; and 4) the scheme cannot withstand the forgery attack. Since then, many verifier-free password authentication schemes have been proposed, and each has its pros and cons.