A New Parallel Session Attack to Khan-Zhang´s Authentication Scheme

In this paper we review Lin-Lai´ s authentication scheme and Khan-Zhang´ s improvement to Lin-Lai´ s scheme. We also review Rhee-Kwon-Lee´ s attack to Khan-Zhang´ s scheme. We find that Rhee-Kwon-Lee´ s attack can be realized but has to hazard the attack because the identity of the attacker may finally be recognized. We introduce a parallel session attack, which can also successfully impersonate a legal user, however, without having to hazard the possibility of exposing the attacker´ s identity. In addition, less information is required to lunch this attack. This illustrates the deeper vulnerability of Khan-Zhang´ s scheme.