Abstract:As the most prevailing two-factor authentication mechanism, smart-card-based password authentication has been a subject of intensive research in the past two decades, and hundreds of this type of schemes have wave upon wave been proposed. In most of these studies, there is no comprehensive and systematical metric available for schemes to be assessed objectively, and the authors present new schemes with assertions of the superior aspects over previous ones, while overlooking dimensions on which their schemes fare poorly. Unsurprisingly, most of them are far from satisfactory—either are found short of important security goals or lack of critical properties, especially being stuck with the security-usability tension. To overcome this issue, in this work we first explicitly define a security model that can accurately capture the practical capabilities of an adversary and then suggest a broad set of twelve properties framed as a systematic methodology for comparative evaluation, allowing schemes to be rated across a common spectrum. As our main contribution, a new scheme is advanced to resolve the various issues arising from user corruption and server compromise, and it is formally proved secure under the harshest adversary model so far. In particular, by integrating “honeywords”, traditionally the purview of system security, with a “fuzzy-verifier”, our scheme hits “two birds”: it not only eliminates the long-standing security-usability conflict that is considered intractable in the literature, but also achieves security guarantees beyond the conventional optimal security bound.

A Password-Authenticated Key Agreement Scheme with Perfect Forward Secrecy

Authentication scheme based on biometric encryption for pervasive computing environments

Password-based Authentication and Key Distribution Protocols with Perfect Forward Secrecy

Cryptanalysis and Improvement of Park Et Al.'s Remote User Authentication Protocol

Password-based Authenticated Key Agreement Scheme with Mutual Anonymity for Trusted Computation

A Security Enhanced Remote Password Authentication Scheme Using Smart Card

Further Cryptanalysis of A Password Authentication Scheme with Smart Cards

A DYNAMIC PASSWORD AUTHENTICATION FOR REMOTE USERS IN INSECURE CHANNEL

Security Analysis on an Improvement of RSA-Based Password Authenticated Key Exchange.

An Improved Secure and Efficient Password and Chaos-Based Two-Party Key Agreement Protocol

Security of A Remote User Authentication Scheme Using Smart Cards

Simple authenticated key agreement protocol resistant to password guessing attacks.

Cryptanalysis of Multi-Server Authenticated Key Agreement Scheme Based on Trust Computing Using Smart Cards and Biometrics

Weaknesses of a Password-Authenticated Key Exchange Protocol between Clients with Different Passwords

Cryptanalysis and Improvement of a Biometrics-Based Authentication and Key Agreement Scheme for Multi-Server Environments

A Robust Password-Based Multi-Server Authentication Scheme

AN EFFICIENT AND SECURE DYNAMIC PASSWORD AUTHENTICATION SCHEME

Two Birds with One Stone: Two-Factor Authentication with Security Beyond Conventional Bound.

A Novel Smart-Card Based Authentication Scheme Using Proactive Secret Sharing

Defending Secret-Key Based Authentication Protocols Against the Stolen-Secret Attack.

Three-party Encrypted Key Exchange