Security enhancements of smart card-based remote user password authentication scheme with session key agreement

Smart card-based user authentication schemes have been proposed recently to improve the security drawbacks in user authentication scheme. Li et al., in 2013, proposed an enhanced smart card-based remote user password authentication scheme which can withstand the security drawbacks of Chen et al.´s scheme. In this paper, we show that Li et al.´s scheme is vulnerable to user impersonation attack, server masquerading attack, password guessing attack and does not provide mutual authentication between the user and the server. Also, we propose the enhanced scheme with session key agreement to overcome the security drawbacks of Li et al.´s scheme, even if the secret values stored in the smart card is revealed. As a result, the enhanced scheme is relatively more secure than the related scheme in terms of security.