On the Limits of Anonymous Password Authentication

Password authentication is the most commonly accepted means for entity authentication. To meet the increasing need of preserving individual privacy, anonymous password authentication has been proposed recently, to augment password authentication with the protection of user privacy. In this paper, we analyze the weaknesses inherent to anonymous password authentication, which make it questionable for the practicality of anonymous password authentication in real applications. We also show that all the existing anonymous password authentication schemes may subject to undetectable on-line dictionary attacks.