Security Weaknesses of a Biometric-Based Remote User Authentication Scheme Using Smart Cards

To improve the security weaknesses in user authentication system, many biometrics-based user authentication schemes using smart cards have been proposed. Das in 2011, proposed an effective biometric-based remote user authentication scheme using smart cards that can provide strong authentication and mutual authentication, while eliminating the security flaws of Li-Hwang’s scheme. In this paper, we analyze the security of Das’s scheme, and we have shown that Das’s scheme is still insecure against the user impersonation attack, the server masquerading attack, the off-line password guessing attack, the man-in-the-middle attack and the insider attack. In addition, Das’s scheme does not provide mutual authentication between the user and the server.