Recently, Yeh, Shen, and Hwang proposed a smartcard-based one-time password authentication scheme as an improved version of S/KEY, and claimed that their scheme is superior to other similar schemes in security and efficiency. In this letter, we show that Yeh-Shen-Hwang's scheme is still vulnerable to a stolen-verifier attack that may cause serious security problems.

In 2003, Wu and Chieu proposed a scheme that was claimed to be an enhanced version of Sun's password authentication scheme. Recently, Wu and Chieu themselves showed that their scheme is vulnerable to a forgery attack and then proposed an improved scheme. Herein, we demonstrate that Wu-Chieu's improved scheme is still vulnerable to several attacks.