A Privacy-Flexible Password Authentication Scheme for Multi-Server Environment

Since Kerberos suffers from KDC (Key Distribution Center) compromise and impersonation attack, a multi-server password authentication protocol which highlights no verification table in the server end could therefore be an alternative. Typically, there are three roles in a multi-server password authentication protocol: clients, servers, and a register center which plays the role like KDC in Kerberos. In this paper, the authors exploit the theoretical basis for implementing a multi-server password authentication system under two constraints: no verification table and user privacy protection.