Anonymous Two-Factor Research Articles

Comments on “Provably Secure Dynamic Id-Based Anonymous Two-Factor Authenticated Key Exchange Protocol With Extended Security Model”

Password-based authenticated key exchange (PAKE) protocol has been widely used in practice, since it is convenient for users. However, the easy-to-remember property of the password also brings security problem. In this paper, we show there is an off-line dictionary attack in an efficient PAKE protocol when the smart card is lost. In order to resist the attack, we give a countermeasure to improve it. The countermeasure makes a simple change to the original protocol which does not affect the efficiency of the protocol.

Revisiting Anonymous Two-Factor Authentication Schemes for IoT-Enabled Devices in Cloud Computing Environments

Investigating the security pitfalls of cryptographic protocols is crucial to understand how to improve security. At ICCCS’17, Wu and Xu proposed an efficient smart-card-based password authentication scheme for cloud computing environments to cope with the vulnerabilities in Jiang et al.’s scheme. However, we reveal that Wu-Xu’s scheme actually is subject to various security flaws, such as offline password guessing attack and replay attack. Besides security, user friendly is also another great concern. In 2017, Roy et al. found that in most previous two-factor schemes a user has to manage different credentials for different services and further suggested a user-friendly scheme which is claimed to be suitable for multiserver architecture and robust against various attacks. In this work, we show that Roy et al.’s scheme fails to achieve truly two-factor security and shows poor scalability. At FGCS’18, Amin et al. pointed out that most of existing two-factor schemes are either insecure or inefficient for mobile devices due to the use of public-key techniques and thus suggested an improved protocol by using only light-weight symmetric key techniques. Almost at the same time, Wei et al. also observed this issue and proposed a new scheme based on symmetric key techniques with formal security proofs in the random oracle model. Nevertheless, we point out that both Amin et al.’s and Wei et al.’s schemes cannot achieve the claimed security goals (including the most crucial goal of “truly two-factor security”). Our results invalidate any use of the scrutinized schemes for cloud computing environments.

A Provably Secure Anonymous Two-Factor Authenticated Key Exchange Protocol for Cloud Computing

A Provably Secure Anonymous Two-Factor Authenticated Key Exchange Protocol for Cloud Computing

A Secure and Anonymous Two-Factor Authentication Protocol in Multiserver Environment

With the great development of network technology, the multiserver system gets widely used in providing various of services. And the two-factor authentication protocols in multiserver system attract more and more attention. Recently, there are two new schemes for multiserver environment which claimed to be secure against the known attacks. However, after a scrutinization of these two schemes, we found that (1) their description of the adversary’s abilities is inaccurate; (2) their schemes suffer from many attacks. Thus, firstly, we corrected their description on the adversary capacities to introduce a widely accepted adversary model and then summarized fourteen security requirements of multiserver based on the works of pioneer contributors. Secondly, we revealed that one of the two schemes fails to preserve forward secrecy and user anonymity and cannot resist stolen-verifier attack and off-line dictionary attack and so forth and also demonstrated that another scheme fails to preserve forward secrecy and user anonymity and is not secure to insider attack and off-line dictionary attack, and so forth. Finally, we designed an enhanced scheme to overcome these identified weaknesses, proved its security via BAN logic and heuristic analysis, and then compared it with other relevant schemes. The comparison results showed the superiority of our scheme.

Provably Secure Dynamic ID-Based Anonymous Two-Factor Authenticated Key Exchange Protocol With Extended Security Model

Authenticated key exchange (AKE) protocol allows a user and a server to authenticate each other and generate a session key for the subsequent communications. With the rapid development of low-power and highly-efficient networks, such as pervasive and mobile computing network in recent years, many efficient AKE protocols have been proposed to achieve user privacy and authentication in the communications. Besides secure session key establishment, those AKE protocols offer some other useful functionalities, such as two-factor user authentication and mutual authentication. However, most of them have one or more weaknesses, such as vulnerability against lost-smart-card attack, offline dictionary attack, de-synchronization attack, or the lack of forward secrecy, and user anonymity or untraceability. Furthermore, an AKE scheme under the public key infrastructure may not be suitable for light-weight computational devices, and the security model of AKE does not capture user anonymity and resist lost-smart-card attack. In this paper, we propose a novel dynamic ID-based anonymous two-factor AKE protocol, which addresses all the above issues. Our protocol also supports smart card revocation and password update without centralized storage. Further, we extend the security model of AKE to support user anonymity and resist lost-smart-card attack, and the proposed scheme is provably secure in extended security model. The low-computational and bandwidth cost indicates that our protocol can be deployed for pervasive computing applications and mobile communications in practice.

An anonymous two-factor authenticated key agreement scheme for session initiation protocol using elliptic curve cryptography

An anonymous two-factor authenticated key agreement scheme for session initiation protocol using elliptic curve cryptography

Design flaws of “an anonymous two-factor authenticated key agreement scheme for session initiation protocol using elliptic curve cryptography”

Recently, a two-factor authenticated key agreement scheme for session initiation protocol is published by Lu et al. in Multimedia Tools and Applications [doi:10.1007/s11042-015-3166-4]. I have examined this scheme and found some design flaws in it. Due to flaw in registration phase, the scheme is vulnerable to guessing attacks. However, flaws during key agreement phase hinder the functionality of the scheme in such a way that mutual authentication process between the user and the server is not viable.

An anonymous two-factor authenticated key agreement scheme for session initiation protocol using elliptic curve cryptography

The Session Initiation Protocol (SIP) is a signaling protocol widely applied in the world of multimedia communication. Numerous SIP authenticated key agreement schemes have been proposed with the purpose of ensuring security communication. Farash recently put forward an enhancement employing smart cards counted on Zhang et al.'s scheme. In this study, we observe that the enhanced scheme presented by Farash has also some security pitfalls, such as disclosure of user identity, lack of a pre-authentication in the smart card and vulnerability to key-compromise masquerading attack which results in an off-line guessing attack. We then propose an anonymous modified scheme with elliptic curve cryptography to eliminate the security leakages of the scheme proposed by Farash. We demonstrate that our scheme is immune to different kinds of attacks including attacks involved in Farash's scheme. We mention Burrows-Abadi-Needham logic for completeness of the proposed scheme. Also, we compare the performance of our scheme with its predecessor schemes and the comparative results shows that it perfectly satisfies the needs of SIP.

Anonymous Two-Factor Authentication in Distributed Systems: Certain Goals Are Beyond Attainment

Despite two decades of intensive research, it remains a challenge to design a practical anonymous two-factor authentication scheme, for the designers are confronted with an impressive list of security requirements (e.g., resistance to smart card loss attack) and desirable attributes (e.g., local password update). Numerous solutions have been proposed, yet most of them are shortly found either unable to satisfy some critical security requirements or short of a few important features. To overcome this unsatisfactory situation, researchers often work around it in hopes of a new proposal (but no one has succeeded so far), while paying little attention to the fundamental question: whether or not there are inherent limitations that prevent us from designing an “ideal” scheme that satisfies all the desirable goals? In this work, we aim to provide a definite answer to this question. We first revisit two foremost proposals, i.e. Tsai et al.'s scheme and Li's scheme, revealing some subtleties and challenges in designing such schemes. Then, we systematically explore the inherent conflicts and unavoidable trade-offs among the design criteria. Our results indicate that, under the current widely accepted adversarial model, certain goals are beyond attainment. This also suggests a negative answer to the open problem left by Huang et al. in 2014. To the best of knowledge, the present study makes the first step towards understanding the underlying evaluation metric for anonymous two-factor authentication, which we believe will facilitate better design of anonymous two-factor protocols that offer acceptable trade-offs among usability, security and privacy.

Robust Anonymous Two-Factor Authentication Scheme for Roaming Service in Global Mobility Network

Two-factor authentication scheme for roaming service in global mobility network enables the mobile user in possession of a password and a smart card to achieve mutual authentication and session key establishment with the foreign agent. In this paper, we first identify six properties of this type of schemes: (1) Anonymity and untraceability; (2) Robustness; (3) Authentication; (4) Session key security and fairness; (5) User friendliness; and (6) Efficiency, then propose a new scheme which satisfies all these requirements. Our result is validated applying the formal verification tool ProVerif based on applied pi calculus.