Cryptanalysis of DS-SIP Authentication Scheme Using ECDH

Session initiation protocol (SIP) is widely used in the current Internet protocols such as hyper text transport protocol (HTTP) and simple mail transport protocol (SMTP). In 2005, and proposed an authentication scheme using elliptic curve Diffie-Hellman (ECDH) problem for SIP called DS-SIP. However, this paper demonstrates that DS-SIP authentication scheme is still vulnerable to Denning-Sacco attack which an attacker can easily find a legal user´s secret password when SIP client or SIP server compromises an old shared session key. In addition, we show that it can not resist the stolen-verifier attack where if an attacker has the ability to get the stored password verifier someway then it can be used to masquerade as the original user. In addition, this paper also proposes an enhanced DS-SIP (called EDS-SIP) authentication scheme based on ECDH in order to overcome such a security problem. As a result, the proposed EDS-SIP authentication scheme is more secure and has same efficient compare with Durlanik and Sogukpinar´s DS-SIP authentication scheme.