Security Improvement on Smart Card-Based Remote User Authentication Scheme Using Hash Function

In 2012, Sonwanshi et al. proposed an efficient smart card based remote user authentication scheme using hash function. They claimed that the scheme resists most current possible attacks. However, in the following year, Das et al. found that Sonwanshi et al.'s scheme is vulnerable to offline password guessing attack. In this paper, we point out that there exist additional security defects such as impersonation attack, insider attack, and vulnerabilities for shared session key, absence of the revocation phase in Sonwanshi et al.'s scheme. Furthermore, we propose an improved scheme that preserves the similar properties and resolves all such security flaws.