It is proved that the HY-key authentication scheme proposed by (Horng and Yang, Computer Communications 19 (1996) 848-850) is vulnerable to the guessing attack. The user's password is obtained by the guessing attack, and then the user's public key can be forged or the user's private key can be recovered. In order to overcome this disadvantage, we propose a new improved HY-scheme. The attacker cannot recover the user's private key, even though he has obtained the user's password.