  Advancement in communication technology provides a scalable platform for
various services where a remote user can access the server from anywhere
without moving from its place. It has provided a unique opportunity for online
services, such that the user need not physically present at the service center.
These services adopt authentication and key agreement protocols to ensure
authorized and secure access to resources. Most of the authentication schemes
support single server environment where the user has to register with each
server. If a user wishes to access multiple application servers, he requires to
register with each of the servers. Although multi-server authentication schemes
introduced a scalable platform such that a user can interact with any server
using single registration. Recently, Chuang and Chen proposed an efficient
multi-server authenticated key agreement scheme based on smart cards along with
password and biometrics. This is a lightweight authentication scheme which
requires the computation of only hash function. In this article, we present a
brief review of Chuang and Chen's scheme. We analyze Chuang and Chen's scheme
and identify that their scheme does not resist stolen smart card attack which
causes the user's impersonation attack, server spoofing attack and man-in-the
middle attack. Additionally, we show that their scheme has a weak key agreement
protocol, which does not ensure forward secrecy.
