Cryptanalysis of “a robust and effective smart card-based remote user authentication mechanism using hash function”

To safeguard trustworthy remote user authentication services, various user authentication schemes for internet based E-Commerce, M-Commerce applications has been proposed. These schemes are proposed with an intention to legalize only authorized access to remote server resources, so that critical information can be protected from misuse. Very recently, A.K Das et al. proposed a user remote user authentication scheme using a hash function, which they claimed to provide enhanced privacy and their scheme is light weight due to usage of efficient one way hash function and bitwise XOR operations. In this paper we will cryptanalyze and show that A.K das et al scheme is susceptible to privileged insider attack, on success of the attack, the attacker can perform all major cryptographic attacks.