Cryptanalysis of a robust and efficient smart card oriented remote user authentication protocol

Remote user authentication is an important part in electronic commerce to identify legitimate users over the Internet. Recently, Chang et al. proposed a robust and efficient smart card based remote user authentication scheme to provide user anonymity. However, in this paper we will show that Chang et al.´s scheme fails to protect user privacy in terms of anonymity and traceability. In addition, it is vulnerable to the server counterfeit attack and it does not provide perfect forward secrecy for session keys. Furthermore, if the smart card is lost, it will suffer from the offline password guessing attack as well as the user impersonation attack. Hence, the scheme cannot achieve mutual authentication.