Cryptanalysis of Four Biometric Based Authentication Schemes with Privacy-preserving for Multi-server Environment and Design Guidelines

With the growing demand of user privacy preserving, there is an urgent requirement for designing a secure remote user authentication and key agreement (AKA) scheme with user privacy preserving. We survey and discuss present three-factor based remote user AKA schemes with user privacy preserving for multi-server environment, and we find that four of them have security defects. We will demonstrate that Ali-Pal scheme is vulnerable to malignant server attack and user untraceability attack, Chandrakar and Om’s schemes are vulnerable to insider attacks, and Choi et al.’s scheme does not achieve user anonymity. We then analyze the relevant schemes to propose the guidelines for designing a secure AKA scheme with user privacy preserving for multi-server environment. This paper is helpful for designing a better AKA scheme.