A Security Enhancement on a Remote User Authentication Scheme Based on the Rabin Cryptosystem with Secure Password Updating

User authentication plays an important role to ensure that only authorized users can access resources. Kim et al. proposed a remote user authentication scheme based on the Rabin cryptosystem to resist well-known attack such as offline password guessing attack, unlimited online password guessing attack and server impersonation. In their scheme, a user will be issued a smart card for authentication, and the computation load of the smart card is light. Although their scheme possesses superior properties, we find that it suffers from one fatal security flaw such that a legal user cannot access resources after password change phase. In this paper, we first show the security flaw and propose an improvement with secure password updating.