Abstract:Nowadays, cyberattacks are growing exponentially, causing havoc to Internet users. In particular, authentication attacks constitute the major attack vector where intruders impersonate legitimate users to maliciously access systems or resources. Traditional single-factor authentication (SFA) protocols are often bypassed by side-channel and other attack techniques, hence they are no longer sufficient to the current authentication requirements. To alleviate this problem, multi-factor authentication (MFA) protocols have been widely adopted recently, which helps to raise the security bar against imposters. Although MFA is generally considered more robust and secure than SFA, it may not always guarantee enhanced security and efficiency. This is because, critical security vulnerabilities and performance problems may still arise due to design or implementation flaws of the protocols. Such vulnerabilities are often left unnoticed until they are exploited by attackers. Therefore, the main objective of this work is identifying such vulnerabilities in existing MFA protocols by systematically analysing their designs and constructions. To this end, we first form a set of security evaluation criteria, encompassing both existing and newly introduced ones, which we believe are very critical for the security of MFA protocols. Then, we thoroughly review several MFA protocols across different domains. Subsequently, we revisit and thoroughly analyze the design and construction of the protocols to identify potential vulnerabilities. Consequently, we manage to identify critical vulnerabilities in ten of the MFA protocols investigated. We thoroughly discuss the identified vulnerabilities in each protocol and devise relevant mitigation strategies. We also consolidate the performance information of those protocols to show the runtime and storage cost when employing varying number of authentication factors.

How many FIDO protocols are needed? Analysing the technology, security and compliance

How many FIDO protocols are needed? Surveying the design, security and market perspectives

FIDO Gets Verified: A Formal Analysis of the Universal Authentication Framework Protocol

True2F: Backdoor-resistant authentication tokens

Challenges with Passwordless FIDO2 in an Enterprise Setting: A Usability Study

A Lightweight Three-Factor User Authentication Protocol for the Information Perception of IoT

Evaluation of Secure OpenID-Based RAAA User Authentication Protocol for Preventing Specific Web Attacks in Web Apps

A Security and Usability Analysis of Local Attacks Against FIDO2

Choosing the right MFA method for online systems: A comparative analysis

Lightweight Authentication Protocol Based on Physical Unclonable Function

An Anonymous Authentication Scheme Based on Blind Signatures for the FIDO Protocol

EAP-FIDO: A Novel EAP Method for Using FIDO2 Credentials for Network Authentication

Conceptual Design and Implementation of FIDO2 compatible Smart Card for Decentralized Financial Transaction System

A Novel Protocol Using Captive Portals for FIDO2 Network Authentication

Excavating Vulnerabilities Lurking in Multi-Factor Authentication Protocols: A Systematic Security Analysis

CTRAPS: CTAP Client Impersonation and API Confusion on FIDO2

That Depends -- Assessing User Perceptions of Authentication Schemes across Contexts of Use

"`They brought in the horrible key ring thing!" Analysing the Usability of Two-Factor Authentication in UK Online Banking

A Review of Password-less User Authentication Schemes

ASOP: A Sovereign and Secure Device Onboarding Protocol for Cloud-based IoT Services

An Extensive Formal Security Analysis of the OpenID Financial-grade API