Abstract:Despite two decades of intensive research, it remains a challenge to design a practical anonymous two-factor authentication scheme, for the designers are confronted with an impressive list of security requirements (e.g., resistance to smart card loss attack) and desirable attributes (e.g., local password update). Numerous solutions have been proposed, yet most of them are shortly found either unable to satisfy some critical security requirements or short of a few important features. To overcome this unsatisfactory situation, researchers often work around it in hopes of a new proposal (but no one has succeeded so far), while paying little attention to the fundamental question: whether or not there are inherent limitations that prevent us from designing an “ideal” scheme that satisfies all the desirable goals? In this work, we aim to provide a definite answer to this question. We first revisit two foremost proposals, i.e. Tsai et al.'s scheme and Li's scheme, revealing some subtleties and challenges in designing such schemes. Then, we systematically explore the inherent conflicts and unavoidable trade-offs among the design criteria. Our results indicate that, under the current widely accepted adversarial model, certain goals are beyond attainment. This also suggests a negative answer to the open problem left by Huang et al. in 2014. To the best of knowledge, the present study makes the first step towards understanding the underlying evaluation metric for anonymous two-factor authentication, which we believe will facilitate better design of anonymous two-factor protocols that offer acceptable trade-offs among usability, security and privacy.

Efficient Dynamic k-Times Anonymous Authentication

Dynamic k-Times Anonymous Authentication

k-Times Anonymous Authentication with a Constant Proving Cost

Constant-Size Dynamic k-TAA

Constant-Size Dynamic $k$ -Times Anonymous Authentication

k-Times Anonymous Authentication

Fair k-times anonymous authentication scheme

k-Times Attribute-Based Anonymous Access Control for Cloud Computing

Dynamic Authentication with Sensory Information for the Access Control Systems.

Improving Network Security by using Software Defined Networking (SDN)

An Efficient Delegation-Based Anonymous Authentication Protocol

Password-based Authenticated Key Agreement Scheme with Mutual Anonymity for Trusted Computation

Certificate-free Ad Hoc Anonymous Authentication.

Efficient Authenticated Key Agreement Protocol for Dynamic Groups

Time-Assisted Authentication Protocol

Anonymous Two-Factor Authentication in Distributed Systems: Certain Goals Are Beyond Attainment

An Efficient (t, N) Threshold Authentication Scheme for Vehicular Ad Hoc Networks

Privacy-Preserving Remote User Authentication with k-Times Untraceability

Linkable and traceable anonymous authentication with fine-grained access control

Event-oriented linkable and traceable anonymous authentication and its application to voting

A Secure Two-factor Authentication Key Exchange Scheme