Cryptanalysis of a Biometric-based Multi-Server Authentication Scheme

Authentication and key agreement protocol becomes an important security issue for multi-server architecture. Combining biometrics with password enhances the level of security. Recently, Baruah et al. analyzed that Mishra et al.’s protocol has several drawbacks and proposed an improved biometric based multi-server authentication scheme. They claimed that their scheme satisfies all the required security attributes for a secure authentication. In this paper, we indicate that their scheme is not secure against key reveal attack, replay attack, and smart card forgery attack. Any registered user can retrieve the session key or launch the replay attack by eavesdropping on the communication channel. In addition, registered user can forge smart card when colluding with registered server.