Department of Electronic and Electrical Engineering, Pohang University of Science and Technology
Jong Hoon SHIN
Department of Electronic and Electrical Engineering, Pohang University of Science and Technology
Pil Joong LEE
Department of Electronic and Electrical Engineering, Pohang University of Science and Technology The Institute of Electronics, Information and Communication Engineers
Yeh and Tsai recently proposed an enhanced mobile commerce security mechanism. They modified the lightweight security mechanism due to Lam, Chung, Gu, and Sun to relieve the burden of mobile clients. However, this article shows that a malicious WAP gateway can successfully obtain the mobile client's PIN by sending a fake public key of a mobile commerce server and exploiting information leakage caused by addition operation. We also present a countermeasure against the proposed attack.
