Cryptanalysis of the end-to--end security for mobile communications with end-user identification/authentication

This letter shows that the end-to-end security protocol for mobile communications with end-user identification/authentication due to Chang et al., (2004) has a serious security flaw. We demonstrate this by presenting a simple but powerful impersonation attack against the protocol so that the protocol is insecure against impersonation attack. Hence, the protocol cannot achieve the claimed security. To overcome such a security flaw, a modification is presented.