Abstract:Nowadays, cyberattacks are growing exponentially, causing havoc to Internet users. In particular, authentication attacks constitute the major attack vector where intruders impersonate legitimate users to maliciously access systems or resources. Traditional single-factor authentication (SFA) protocols are often bypassed by side-channel and other attack techniques, hence they are no longer sufficient to the current authentication requirements. To alleviate this problem, multi-factor authentication (MFA) protocols have been widely adopted recently, which helps to raise the security bar against imposters. Although MFA is generally considered more robust and secure than SFA, it may not always guarantee enhanced security and efficiency. This is because, critical security vulnerabilities and performance problems may still arise due to design or implementation flaws of the protocols. Such vulnerabilities are often left unnoticed until they are exploited by attackers. Therefore, the main objective of this work is identifying such vulnerabilities in existing MFA protocols by systematically analysing their designs and constructions. To this end, we first form a set of security evaluation criteria, encompassing both existing and newly introduced ones, which we believe are very critical for the security of MFA protocols. Then, we thoroughly review several MFA protocols across different domains. Subsequently, we revisit and thoroughly analyze the design and construction of the protocols to identify potential vulnerabilities. Consequently, we manage to identify critical vulnerabilities in ten of the MFA protocols investigated. We thoroughly discuss the identified vulnerabilities in each protocol and devise relevant mitigation strategies. We also consolidate the performance information of those protocols to show the runtime and storage cost when employing varying number of authentication factors.

Cryptanalysis of Anonymous Three Factor-Based Authentication Schemes for Multi-server Environment

Understanding Security Failures of Multi-Factor Authentication Schemes for Multi-Server Environments

Cryptanalysis and Improvement of a Biometrics-Based Authentication and Key Agreement Scheme for Multi-Server Environments

Crytanalysis of Three Anonymous Authentication Schemes for Multi-Server Environment

Design and Analysis of a Secure Three Factor User Authentication Scheme Using Biometric and Smart Card

Revisiting Anonymous Two-Factor Authentication Schemes for Multi-server Environment

Cryptanalysis and Improvement of Park Et Al.'s Remote User Authentication Protocol

Cryptanalysis And Improvement Of A Biometric-Based Multi-Server Authentication And Key Agreement Scheme

An efficient dynamic ID based remote user authentication scheme using self-certified public keys for multi-server environment

An Efficient Delegation-Based Anonymous Authentication Protocol

Revisiting Anonymous Two-Factor Authentication Schemes for IoT-Enabled Devices in Cloud Computing Environments.

Cryptanalysis of Multi-Server Authenticated Key Agreement Scheme Based on Trust Computing Using Smart Cards and Biometrics

Breaking Three Remote User Authentication Systems for Mobile Devices

SUAA: A Secure User Authentication Scheme with Anonymity for the Single & Multi-server Environments.

Revisiting anonymous two-factor authentication schemes for cloud computing

Cryptanalysis and improvement of a user authentication scheme preserving uniqueness and anonymity for connected health care

A Robust Password-Based Multi-Server Authentication Scheme

Cryptanalysis and Improvement of Jiang et al.'s Smart Card Based Remote User Authentication Scheme

Weaknesses of a dynamic identity based authentication protocol for multi-server architecture

Excavating Vulnerabilities Lurking in Multi-Factor Authentication Protocols: A Systematic Security Analysis

Password-based Authenticated Key Agreement Scheme with Mutual Anonymity for Trusted Computation