Comments on two schemes of identity-based user authentication and key agreement for mobile client-server networks

In recent papers (J Supercomput 66(2):973-988, 2013; J Supercomput 69(1):395-411, 2014), the authors presented two efficient identity-based authenticated key agreement schemes for mobile client-server networks, respectively. In this letter, we show that there is a serious security flaw in the user registration phase of the two schemes: any authorized user can impersonate the server to generate an effective private key of any other user. We then present a suggestion to overcome the problem without losing any good features of the original schemes.