A New Parallel Session Attack to Khan-Zhang's Authentication Scheme

In this paper we review Lin-Lai' s authentication scheme and Khan-Zhang' s improvement to Lin-Lai' s scheme. We also review Rhee-Kwon-Lee' s attack to Khan-Zhang' s scheme. We find that Rhee-Kwon-Lee' s attack can be realized but has to hazard the attack because the identity of the attacker may finally be recognized. We introduce a parallel session attack, which can also successfully impersonate a legal user, however, without having to hazard the possibility of exposing the attacker' s identity. In addition, less information is required to lunch this attack. This illustrates the deeper vulnerability of Khan-Zhang' s scheme.