Off-Line Password-Guessing Attack to Yang's and Huang's Authentication Schemes for Session Initiation Protocol
Heasuk Jo, Yoonho Lee, Mijin Kim, Seungjoo Kim, Dongho Won · 2009
The session initiation protocol (SIP) is an application-layer control protocol for creating, modifying, and terminating sessions with one or more participants in the IP-based telephony environment.Yang et al. and Huang et al. proposed a secure authentication scheme for session initiation protocol.Yang's scheme is based on Deffi-Hellman key agreement scheme and a combination of hash functions. In 2006, Huang et al. pointed out that Yang's scheme is insecure, and proposed an improved authentication scheme for SIP. In this paper, the secure of Yang's and Huang's scheme is analyzed. It is demonstrated that both schemes still have some weaknesses: it cannot withstand against the off-line password-guessing attack. Based on our analysis, we found the security problem with these schemes and, in addition, shows how to fix it.