Two-Factor Password-Authenticated Key Exchange with End-to-End Security

عن هذا البحث

الملخص

This paper develops a two-factor authentication framework that combines a user password with possession of a cryptographic device while providing end-to-end security against compromise of communication links and system components. The construction combines device-enhanced password-authenticated key exchange with short-authenticated-string mechanisms and is analyzed in a formal security model that captures online and offline attacks as well as partial compromise of servers, devices, and client terminals. The authors provide efficient TLS-based and PKI-free prototype implementations and evaluate several ways of validating possession of the second factor. A usability study compares the proposed interaction with traditional PIN-based two-factor authentication.