In 2004, Kim, Huh, Hwang and Lee proposed an efficient key agreement protocol for secure authentication. In this paper, we shall show that their proposed protocol cannot resist the off-line password guessing attack and therefore present a modified protocol to avoid this attack.