Abstract:Nowadays, cyberattacks are growing exponentially, causing havoc to Internet users. In particular, authentication attacks constitute the major attack vector where intruders impersonate legitimate users to maliciously access systems or resources. Traditional single-factor authentication (SFA) protocols are often bypassed by side-channel and other attack techniques, hence they are no longer sufficient to the current authentication requirements. To alleviate this problem, multi-factor authentication (MFA) protocols have been widely adopted recently, which helps to raise the security bar against imposters. Although MFA is generally considered more robust and secure than SFA, it may not always guarantee enhanced security and efficiency. This is because, critical security vulnerabilities and performance problems may still arise due to design or implementation flaws of the protocols. Such vulnerabilities are often left unnoticed until they are exploited by attackers. Therefore, the main objective of this work is identifying such vulnerabilities in existing MFA protocols by systematically analysing their designs and constructions. To this end, we first form a set of security evaluation criteria, encompassing both existing and newly introduced ones, which we believe are very critical for the security of MFA protocols. Then, we thoroughly review several MFA protocols across different domains. Subsequently, we revisit and thoroughly analyze the design and construction of the protocols to identify potential vulnerabilities. Consequently, we manage to identify critical vulnerabilities in ten of the MFA protocols investigated. We thoroughly discuss the identified vulnerabilities in each protocol and devise relevant mitigation strategies. We also consolidate the performance information of those protocols to show the runtime and storage cost when employing varying number of authentication factors.

FIDO Gets Verified: A Formal Analysis of the Universal Authentication Framework Protocol

How many FIDO protocols are needed? Analysing the technology, security and compliance

ToAuth: Towards Automatic Near Field Authentication for Smartphones

UniID: Spoofing Face Authentication System by Universal Identity

True2F: Backdoor-resistant authentication tokens

A Security and Usability Analysis of Local Attacks Against FIDO2

How many FIDO protocols are needed? Surveying the design, security and market perspectives

Evaluation of Secure OpenID-Based RAAA User Authentication Protocol for Preventing Specific Web Attacks in Web Apps

An Anonymous Authentication Scheme Based on Blind Signatures for the FIDO Protocol

Towards Safer Connections: Secure Authentication in 5G Networks Leveraging Radio Frequency Fingerprinting

CTRAPS: CTAP Client Impersonation and API Confusion on FIDO2

An Extensive Formal Security Analysis of the OpenID Financial-grade API

Challenges with Passwordless FIDO2 in an Enterprise Setting: A Usability Study

EAP-FIDO: A Novel EAP Method for Using FIDO2 Credentials for Network Authentication

A Formal Analysis of 5G Authentication

A formal security analysis of the fast authentication procedure based on the security context in 5G networks

A Formal Verification of a Reputation Multi-Factor Authentication Mechanism for Constrained Devices and Low-Power Wide-Area Network Using Temporal Logic

Excavating Vulnerabilities Lurking in Multi-Factor Authentication Protocols: A Systematic Security Analysis

Formal-Guided Fuzz Testing: Targeting Security Assurance from Specification to Implementation for 5G and Beyond

A Lightweight Three-Factor User Authentication Protocol for the Information Perception of IoT

A Novel Protocol Using Captive Portals for FIDO2 Network Authentication