Off-Line Password-Guessing Attack to Yang´s and Huang´s Authentication Schemes for Session Initiation Protocol

The session initiation protocol (SIP) is an application-layer control protocol for creating, modifying, and terminating sessions with one or more participants in the IP-based telephony environment.Yang et al. and Huang et al. proposed a secure authentication scheme for session initiation protocol.Yang´s scheme is based on Deffi-Hellman key agreement scheme and a combination of hash functions. In 2006, Huang et al. pointed out that Yang´s scheme is insecure, and proposed an improved authentication scheme for SIP. In this paper, the secure of Yang´s and Huang´s scheme is analyzed. It is demonstrated that both schemes still have some weaknesses: it cannot withstand against the off-line password-guessing attack. Based on our analysis, we found the security problem with these schemes and, in addition, shows how to fix it.