On the Security of a Key Agreement and Key Protection Scheme

We point out that the key agreement and key protection scheme (published in IEEE Transactions on Information Forensics and Security, doi: 10.1109/TIFS.2018.2850299) fails to achieve the two-factor security. We demonstrate that in the scheme, if an adversary can control the master device of a target user, he can impersonate the user to pass the server's authentication.