Abstract
Recently, Yoon and Yoo proposed a new authentication protocol based on a one-way hash function and Diffie-Hellman key exchange, which is based on the protocol by Wu-Chieu and Lee-Lin-Chang. They claim that their protocol is secure, but we show it is susceptible to password guessing if an adversary gains possession of the smart card. Additionally, we propose an improved protocol which can withstand the presented attack.