Abstract:Despite two decades of intensive research, it remains a challenge to design a practical anonymous two-factor authentication scheme, for the designers are confronted with an impressive list of security requirements (e.g., resistance to smart card loss attack) and desirable attributes (e.g., local password update). Numerous solutions have been proposed, yet most of them are shortly found either unable to satisfy some critical security requirements or short of a few important features. To overcome this unsatisfactory situation, researchers often work around it in hopes of a new proposal (but no one has succeeded so far), while paying little attention to the fundamental question: whether or not there are inherent limitations that prevent us from designing an “ideal” scheme that satisfies all the desirable goals? In this work, we aim to provide a definite answer to this question. We first revisit two foremost proposals, i.e. Tsai et al.'s scheme and Li's scheme, revealing some subtleties and challenges in designing such schemes. Then, we systematically explore the inherent conflicts and unavoidable trade-offs among the design criteria. Our results indicate that, under the current widely accepted adversarial model, certain goals are beyond attainment. This also suggests a negative answer to the open problem left by Huang et al. in 2014. To the best of knowledge, the present study makes the first step towards understanding the underlying evaluation metric for anonymous two-factor authentication, which we believe will facilitate better design of anonymous two-factor protocols that offer acceptable trade-offs among usability, security and privacy.

k-Times Anonymous Authentication

k-Times Anonymous Authentication with a Constant Proving Cost

Dynamic k-Times Anonymous Authentication

Efficient Dynamic k-Times Anonymous Authentication

Periodic $K$ -Times Anonymous Authentication With Efficient Revocation of Violator’s Credential

Constant-Size Dynamic $k$ -Times Anonymous Authentication

Anonymous authorization in trust management

Fair k-times anonymous authentication scheme

Privacy-Preserving Remote User Authentication with k-Times Untraceability

k-Times Attribute-Based Anonymous Access Control for Cloud Computing

Password-based Authenticated Key Agreement Scheme with Mutual Anonymity for Trusted Computation

Constant-Size Dynamic k-TAA

Anonymous Single-Sign-On for n designated services with traceability

PkT-SIN: A Secure Communication Protocol for Space Information Networks With Periodic k-Time Anonymous Authentication

A Novel Anonymous Authentication Scheme Without Cryptography

Improving Network Security by using Software Defined Networking (SDN)

Anonymous Signature Schemes

An Identity-Based One-Time Password Scheme with Anonymous Authentication

An Improved Anonymous Remote User Authentication Scheme with Key Agreement Based on Dynamic Identity

Anonymous Two-Factor Authentication in Distributed Systems: Certain Goals Are Beyond Attainment

Certificate-free Ad Hoc Anonymous Authentication.