An Enhanced Simple Secure Remote Password

Authentication Scheme Without Using Cryptography

Yu-Chang Yeh, Wei-Chi Ku, Wei-Ping Chen, and Yi-Lun Chen
Department of Computer and Information Science
National Taichung University
Email: wcku@mail.ntcu.edu.tw


AbstractSince the eavesdropping resistant remote password
authentication schemes based on cryptography require that
certain cryptosystems and/or cryptographic hash functions have
to be implemented in the users login device. Thus, many
eavesdropping resistant remote password authentication schemes
without using cryptography have been proposed. However, most
existing eavesdropping resistant remote password authentication
schemes without using cryptography are time-consuming, hard to
learn, difficult to use, and/or difficult to implement. Recently,
Yeh et al. have proposed a simple and efficient eavesdropping
resistant remote password authentication scheme without using
cryptography, ColorPallete. Unfortunately, the resistance of
ColorPallete to eavesdropping is unsatisfactory. In this paper, we
propose an enhanced version of ColorPallete. The eavesdropping
resistance and the password space of the proposed scheme are
superior to the ones of ColorPallete while the resistance to
accidental login is kept unchanged at the cost of additionally
memorizing one pass-icon.
Keywords-eavesdropping; password; remote authentication;
security; usability.
I. INTRODUCTION
User authentication is the process of verifying an identity
claimed by or for a user. Remote user authentication is the
authentication of a remote user via networks. Among existing
remote user authentication schemes, password authentication is
probably the most widely adopted remote user authentication
mechanism because of its inexpensiveness, easy
implementation, and user-friendliness. However, in traditional
remote password authentication schemes, the users password
is transmitted from the user to the server in plaintext, the
transmitted password could be eavesdropped by the attacker in
open network environments. To address such password
eavesdropping attacks, many cryptography based secure
remote password authentication schemes that can resist
eavesdropping attacks have been proposed, including the
well-known Kerberos [1][2] and SSH [3] and other secure
schemes, e.g., [4][5][6][7].
However, as the schemes based on cryptography require
that certain cryptosystem(s) and/or cryptographic hash
function(s) have to be implemented in the users login device,
additional implementation cost and computational overhead
cannot be avoided. Therefore, in 2002, Sobrado and Birget [8]
proposed three eavesdropping resistant remote password
authentication schemes based on graphics without using
cryptography, In particular, these three schemes can resist
shoulder-surfing attacks. Since then, many eavesdropping
resistant remote password authentication schemes without
using cryptography have been proposed, e.g., [9][10][11][12]
[13][14][15].
Unfortunately, most existing eavesdropping resistant
remote password authentication schemes without using
cryptography are time-consuming, hard to learn, difficult to use,
and/or difficult to implement. Hence, in 2011, Yeh et al. [16]
have proposed a simple eavesdropping resistant remote
password authentication scheme without using cryptography in
that the user can easily and efficiently complete the login
process. However, its resistance to eavesdropping is not very
strong. Once the attacker has intercepted a login session, he can
know the user's password length. Thus, in this paper, we will
propose an enhanced version of Yeh et al.s simple secure
remote password authentication scheme without using
cryptography. In our proposed scheme, a special mechanism is
employed to hide the user's password length in that the attacker
cannot easily obtain the user's password length even he has
intercepted multiple login sessions.
The rest of this paper is organized as follows. In Section 2,
we will review the related works. Then, we will describe the
proposed scheme in Section 3. Next, we will analyze the
security and usability of the proposed scheme in Section 4.
Finally, conclusions are made in Section 5.
II. RELAED WORKS
In 2002, Sobrado and Birget [8] developed three
eavesdropping resistant remote password authentication
schemes without using cryptography, the Triangle scheme, the
Movable Frame scheme, and the Intersection scheme. In the
Triangle scheme, the user must find three of the pass-icons
selected in the registration phase and click inside the invisible
triangle created by those three pass-icons to complete a
challenge. In the Movable Frame scheme, the user must locate
the three displayed pass-objects, and then move the frame until
the pass-icons on the frame lines up with the other two
pass-icons inside the fame. The Intersection scheme uses the
intersection of the invisible lines formed by four displayed
pass-icons. The user must click near the intersection of the two
invisible lines inside the convex quadrilateral formed by those
four pass-icons. In 2004, Roth et al. [17] proposed an efficient
eavesdropping resistant remote password authentication
scheme without using cryptography, in which there are two
background colors randomly and averagely assigned to each
pad. However, Roth et al.s scheme is restricted to using PIN
(Personal Identification Numbers). In 2005, Sobrado et al. [18]
First IEEE International Conference on Communications in China: Communications Theory and Security (CTS)
978-1-4673-2815-9/12/$31.00 2012 IEEE 231
proposed the Convex-Hull Click scheme, which is an improved
version of the Triangle scheme. To avoid the high probability
of accidental login of central area, it employs the
out-of-shadow placements to ensure that all locations on the
screen have roughly similar probabilities of being in the
convex hull formed by the pass-icons. In 2006, Wiedenbeck et
al. [19] reported on the design and evaluation of the
Convex-Hull Click scheme, and pointed out that the login time
of the Convex-Hull Click scheme is too long. In the same year,
Hartanto et al. [20] pointed out that the Movable Frame scheme
has high failure rate due to that the pass-icons are hard to line
up for the user.
In 2008, the GrIDsure Enterprise [21] proposed an
eavesdropping resistant remote password authentication
scheme without using cryptography, GrIDsure, in which the
system generates a one-time password in each login screen. In
2009, Gao et al. [22] proposed an eavesdropping resistant
remote password authentication scheme without using
cryptography, ColorLogin, in which the background color is a
usable factor for reducing the login time. However, the
resistance to eavesdropping is very weak. In 2009, Gao et al.
[23] also proposed an eavesdropping resistant remote password
authentication scheme without using cryptography based on
CAPTCHA (Completely Automated Public Turing tests to tell
Computers and Humans Apart), in which there is a CAPTCHA
under each icon on the login screen. The user must find his
pass-icons and input the CAPTCHAs with the correct
characters under his pass-icons to login the system. However,
the usability of this scheme is unsatisfactory because the user
has to memorize the pass-icons and the corresponding digits of
each pass-icon, i.e., the memory burden of the user is heavy. In
2009, Yamamoto et al. [24] proposed an eavesdropping
resistant remote password authentication scheme without using
cryptography, TI-IBA, in which icons are presented not only
spatially but also temporally. TI-IBA is less constrained by the
screen size and easier for users to find their pass-icons. But the
resistance to eavesdropping is weak. In 2009, Shi et al. [25]
proposed an eavesdropping resistant remote password
authentication scheme without using cryptography, and
discussed several methods for improving its usability. In 2011,
Kim et al. [26] proposed an eavesdropping resistant remote
password authentication scheme without using cryptography,
and employed an analysis method to analyze the security of
their proposed scheme. However, in both Shi et al.s scheme
and Kim et al.s scheme, if the attacker has intercepted a login
session, the attacker can know the user's password length. In
2011, Sreelatha et al. [27] proposed two eavesdropping
resistant remote password authentication schemes without
using cryptography, the pair-based authentication scheme and
the hybrid textual authentication scheme, in which texts and
colors are used to generate session passwords to resist
eavesdropping. Clearly, the usability of Sreelatha et al.s
schemes is unsatisfactory because the user has to memorize the
order of colors and map the color sequence number to the row
number and the column number of the login session to find the
session password. However, as most existing eavesdropping
resistant remote password authentication schemes without
using cryptography are time-consuming, hard to learn, difficult
to use, and/or difficult to implement, Yeh et al. [16], in 2011,
have proposed a eavesdropping resistant remote password
authentication scheme without using cryptography,
ColorPallete, in which there are five background colors
randomly and averagely assigned to each key pad, the user
must identify his pass-characters and click the color button
corresponding to each pass-character to complete the login
process. However, its resistance to eavesdropping is not very
strong. Once the attacker has intercepted a login session, he can
obtain the user's password length.
III. THE PROPOSED SCHEME
One of the common weaknesses of most existing
eavesdropping resistant remote password authentication
schemes without using cryptography is that the users password
length can be obtained by the attacker by just intercepting one
login session. In this section, we will propose an enhanced
eavesdropping resistant remote password authentication
scheme without using cryptography, based on texts and colors.
In the proposed scheme, we develop a start-icon mechanism
and an end-padding mechanism to strengthen the
eavesdropping resistance by hiding the starting-time and the
ending-time of password input so that the users password
length is concealed. In the proposed scheme, which involves
the registration phase and the login phase, the user can
efficiently and securely complete the login process.
A. Registration Phase
The user has to set his textual password of length L (8L
15) characters, including 26 lower case letters and 10
decimal digits, and choose one icon from 6 icons displayed on
the screen as his start-icon, which is the signal for starting
password input. The system stores the users textual password
and start-icon in the users entry in the password table, which
should be carefully protected. In addition, the user has to
register an e-mail address for re-enabling his disabled account,
which will be described later.
B. Login Phase
To login the remote system, the user has to finish the
following steps, within which N
click
denotes the total number of
color buttons clicked by the user and FLAG
pw_input
denotes the
Boolean variable indicating whether the user is entering
password:
Step 1: The user requests to login the remote system.
Step 2: The remote system displays an on-screen
qwerty-like keyboard with 36 keys, including 26
lower case letters and 10 decimal digits, on the
users login screen through the network. In
addition, 5 color buttons, excluding color white,
are randomly placed in an invisible 35 matrix
below the on-screen qwerty-like keyboard on this
login screen. In addition, a RESET button is also
placed on the login screen. The users first
password character is taken as the running
pass-character. The six icons are ordered randomly
with index 0 to 5. Let i = 0, N
click
= 0, and
FLAG
pw_input
= False.
Step 3: The background of each key is randomly assigned
with one of 6 colors, including color white, in a
way that each color is assigned to the backgrounds
232
of 6 keys, respectively. Simultaneously, the 5 color
buttons are randomly placed in the invisible 35
matrix, and the i-th icon is displayed on the login
screen. Let i = (i+1 mod 6). If ((FLAG
pw_input
=
False) and (N
click
< 5) and the displayed icon is the
users start-icon) or (FLAG
pw_input
= True), GOTO
Step 5.
Step 4: The user has to click any color button to set N
click

= N
click
+1. If N
click
< 20, GOTO Step 3; otherwise,
GOTO Step 6.
Step 5: The user has to find the background color of the
key of the running pass-character. If the
background color of the key of the running
pass-character is white, the user can click any
color button; otherwise, the user has to click the
color button with the same color as the background
color of the key of the running pass-character. Let
FLAG
pw_input
= True and N
click
= Nclick+1. If the
running pass-character is not the last character of
the users password, reassign the running
pass-character to the character next to the running
pass-character within the users password;
otherwise, set FLAG
pw_input
= False. If (N
click
< 20),
GOTO Step 3.
Step 6: If all the colors corresponding to the characters of
password are correctly entered in order by the user,
the user is authenticated by the remote system.
Fig. 1 shows the flowchart of the proposed scheme. During
the login phase, the user can click the RESET button at any
time to start over to GOTO Step 2. If the user fails to login the
system consecutively for three times, this account will be
disabled and the system will send to the users registered
e-mail address an e-mail containing the secret link that can be
used by the legitimate user to re-enable his disabled account.
Fig. 2 shows an example of the login screen.
IV. ANALYSIS AND COMPARISON
In this section, we will analyze the security and the
usability of the proposed scheme, and show that the proposed
scheme is superior to ColorPallete [16].
A. Password Space
The number of all possible combinations of 6 start-icons
and characters with length L of the proposed scheme is
6 S6
L
. Therefore, the password space of the proposed
scheme is 6 S6
n 15
n=8
1.S6 1u
24
2
80
. That is, the
password space of the proposed scheme is larger than the
password space of ColorPallete [16], 2.27 1u
23
2
77
.
B. Resistance to Accidental Login
When FLAG
pw_input
is false, the users response will not
affect the authentication results. That is, the probability of
accidental login depends on the password length L.
Fig. 1: The flowchart of the proposed scheme.
Fig. 2: An example of the login screen.
233
LEMMA 1. Given the password length L, the probability of
accidental login for the proposed scheme, denoted by p
aI(L)
, is
p
aI(L)
= (1 S )
L
.
PROOF. If the attacker clicks any of the five color buttons, it
will be regarded as the response of both white and the color
that the attacker clicks. Since the numbers of six color,
including white, backgrounds are the same, the probability of
correctly responding to the background color of the running
pass-character is 2/6, i.e., 1/3. Therefore, given a password
length L, the probability of accidental login is p
aI(L)
= (1 S )
L
.
For example, if L = 10, p
aI(L)
= (1 S )
10
1.69 1u
-5
.
Fig. 3 shows the p
aI(L)
values of the proposed scheme for
different values of L.
THEOREM 1. Assume that the probability distribution of the
lengths of the passwords to be used is uniform between 8 and
15. The probability of accidental login for the proposed scheme,
denoted by p
aI
, is

p
aI
=
1
15-8+1
p
aI(L)
=
1
8
p
aI(L)
2.8S 1u
-5 15
L=8
15
L=8
.
PROOF. Since the password length varies from 8 to 15 and the
attacker doesnt know the password length, the attacker has to
guess the password length before attacking the password. As
the probability distribution of the lengths of the passwords to
be used is assumed uniform between 8 and 15, the probability
that the attacker correctly guesses the password length is 1/8.
Therefore, by using Lemma 1, the probability of accidental
login for the proposed scheme is p
aI
= 18 p
aI(L)
15
L=8

2.8S 1u
-5
.
The accidental login resistance of the proposed scheme is
the same as the one of ColorPallete [16]. In practice, if the
attacker fails to login the system consecutively for three times,
this account will be disabled and the system will send to the
users registered e-mail address an e-mail containing the secret
link that can be used by the legitimate user to re-enable his
disabled account. That is, only the legitimate user can re-enable
his disabled account. Thus, accidental login cannot be
performed easily.
C. Resistance to Eavesdropping Attacks
In ColorPallete [16], the attacker can obtain the password
length by intercepting a login session. The success probability
of eavesdropping attacks for ColorPallete is
1
_1 + [
11
SS

K-1
11_
L

where L denotes the password length and K denotes the
number of login sessions intercepted by the attacker. In the
proposed scheme, the resistance to eavesdropping is improved
by using the start-icon and end-padding mechanisms, which
can conceal the users password length by hiding the
starting-time and the ending-time of password input. In the
proposed scheme, as the attacker doesnt know the start-icon,
the attacker cannot know when the user starts to inputting his
password. In addition, no matter how long is the users
password L, where 8L15, the user has to click color
buttons 20 times to finish the login process. Thus, the attacker
cannot obtain the users password length by observing the
number of color buttons the user has clicked. On the other hand,
since the 5 color buttons are randomly placed in the invisible 3
5 matrix each time the user clicks any color button, the user
will not keep clicking the same position, which avoid revealing
the password length. Clearly, by employing the start-icon and
end-padding mechanisms, the eavesdropping resistance of the
proposed scheme is better than the one of ColorPallete.
D. Usability
The user interface of the proposed scheme has a
qwerty-like on-screen keyboard that is familiar to most users.
By using colors, the user can efficiently complete the login
process. Since the user can easily learn the operations of the
proposed scheme even without reading detailed instructions,
the proposed scheme is suitable for people of all ages. In
addition, the user is free to use the same or similar textual
passwords to access multiple systems to reduce his memory
burden. Comparing with ColorPallete [16], the user only needs
to additionally memorize one start-icon and the login time is
slightly longer. Additionally, different background colors of the
color buttons can be replaced by different background patterns,
e.g., solid lines, dashed lines, dotted lines, wavy lines, grids,
and meshes, for color-blind users.
V. CONCLUSIONS
Herein, we have proposed an enhanced eavesdropping
resistant remote password authentication scheme, in which the
user can securely and efficiently complete the login process,
without using cryptographic technology. The proposed scheme
is simple in that its design, implementation, and operation are
simple. We have shown that the eavesdropping resistance and
the password space of the proposed scheme are superior to the
ones of ColorPallete while the resistance to accidental login is
kept unchanged at the cost of additionally memorizing one
pass-icon. In practice, as it is difficult for the attacker to
intercept the complete login process many times, the resistance
of the proposed scheme to eavesdropping attacks is satisfactory.
The proposed scheme achieves a good balance between
security and usability.
Fig. 3: The probability of accidental login (p
aI
).
234
REFERENCES
[1] J. G. Steiner, B. Clifford Neuman, and J.I. Schiller, Kerberos: An
authentication service for open network systems, Proceedings of the
1988 Winter Usenix Conference, 1988.
[2] J. T. Kohl, B. C. Neuman, and T. Y. T'so, The evolution of the
Kerberos authentication system, Distributed Open Systems, IEEE
Computer Society Press, pp. 78-94, 1994.
[3] Network Working Group of the IETF, The Secure Shell (SSH)
authentication protocol, RFC 4252, 2006.
[4] M. S. Hwang, C. C. Lee, and Y. L. Tang, A simple remote user
authentication scheme, Mathematical and Computer Modelling, vol. 36,
no. 1-2, pp. 103-107, 2002.
[5] W. C. Ku and S. M. Chen, Weaknesses and improvements of an
efficient password based remote user authentication scheme using smart
cards, IEEE Transactions on Consumer Electronics, vol. 50, no. 1, pp.
204-207, 2004.
[6] M. L. Das, A. Saxena, and V. P. Gulati, A dynamic ID-based remote
user authentication scheme, IEEE Transactions on Consumer
Electronics, vol.50, no.2, pp. 629-631, 2004.
[7] H. Y. Chien, J. K. Jan, and Y. M. Tsheng, A modified remote login
authentication scheme based on geometric approach, The Journal of
System and Software, vol. 55, pp. 287-290, 2001.
[8] L. Sobrado and J. C. Birget, Graphical passwords, The Rutgers
Scholar, An Electronic Bulletin for Undergraduate Research, vol. 4,
2002.
[9] S. Man, D. Hong, and M. Mathews, A shoulder surfing resistant
graphical password scheme, Proceedings of the 2003 International
Conference on Security and Management, pp. 105-111, 2003 .
[10] B. Hoanca and K. Mock, Screen oriented technique for reducing the
incidence of shoulder surfing, Proceedings of the 2005 International
Conference on Security and Management, pp. 334-340, 2005.
[11] F. Alsulaiman and A. E. Saddik, A novel 3D graphical password
schema, Proceedings of the 2006 IEEE International Conference on
Virtual Environments, Human-Computer Interfaces and Measurement
Systems, pp. 125-128, 2006.
[12] H. Zhao and X. Li, S3PAS: A scalable shoulder-surfing resistant
textual-graphical password authentication scheme, Proceedings of the
21st International Conference on Advanced Information Networking and
Applications Workshops, vol. 2, pp. 467-472, 2007.
[13] S. Komanduri and D. Hutchings, Order and entropy in Picture
Passwords, Proceedings of the 2098 Graphics Interface Conference,
2008.
[14] T. Perkovic, M. Cagalj, and N. Rakic, SSSL: shoulder surfing safe
login, Proceedings of the 17th International Conference on Software,
Telecommunications & Computer Networks, pp. 270-275, 2009.
[15] Z. Zheng, X. Liu, L. Yin, and Z. Liu, A stroke-based textual password
authentication scheme, Proceedings of the First International Workshop
on Education Technology and Computer Science, pp. 90-95, 2009.
[16] Y. C. Yeh, W. C. Ku, W. P. Chen, and Y. L. Chen, An easy-to-use
login-recording attacks resistant password scheme, Proceedings of the
2011 Conference on Innovative Applications of Information Security
Technology, 2011.
[17] V. Roth, K. Richter, and R. Freidinger. A pin-entry method resilient
against shoulder surfing, Proceedings of the 11th ACM Conference on
Computer and Communication Security, pp. 236-245, 2004.
[18] L. Sobrado and J.C. Birget, Shoulder-surfing resistant graphical
passwords Draft, 2005
(http://clam.rutgers.edu/~birget/grPssw/srgp.pdf).
[19] S. Wiedenbeck, J. Waters, L. Sobrado, and J. C. Birget, Design and
evaluation of a shoulder-surfing resistant graphical password scheme,
Proceedings of the 2006 Working Conference on Advanced Visual
Interfaces, pp. 177-184, 2006.
[20] B. Hartanto, B. Santoso, and S. Welly, The usage of graphical
password as a replacement to the alphanumerical password, Journal
Informatika, vol. 7, no. 2, pp. 91-97, 2006.
[21] M. Bond. Comments on Gridsure Authentication
(http://www.cl.cam.ac.uk/~mkb23/research/GridsureComments.pdf)
[22] H. Gao, X. Liu, S. Wang, H. Liu, and R. Dai, Design and analysis of a
graphical password scheme, Proceedings of the 4th International
Conference on Innovative Computing, Information and Control, pp.
675-678, 2009.
[23] H. Gao, X. Liu, S. Wang, and R. Dai, A new graphical scheme against
spyware by using CAPTCHA, Proceedings of the 5th Symposium on
Usable Privacy and Security, pp. 760-767, 2009.
[24] T. Yamamoto, Y. Kojima, and M. Nishigaki, A
shoulder-surfing-resistant image-based authentication system with
temporal indirect image selection, Proceedings of the 2009
International Conference on Security and Management, pp. 188-194,
2009.
[25] P. Shi, B. Zhu, and A. Youssef. A PIN entry scheme resistant to
recording-based shoulder-surfing, Proceedings of the 3rd International
Conference on Emerging Security Information, Systems and
Technologies, pp. 237-241, 2009.
[26] S. H. Kim, J. W. Kim, S. Y. Kim, and H. G. Cho. A new
shoulder-surfing resistant password for mobile environments,
Proceedings of the 5th International Conference on Ubiquitous
Information Management and Communication, 2011.
[27] M. Sreelatha, M. Shashi, M. Anirudh, Md. S. Ahamer, and V. M. Kumar.
Authentication schemes for session passwords using color and images,
International Journal of Network Security & Its Applications, vol. 3, no.
3, 2011.



235