In the era of Internet of Things (IoT), the data generated by a large number of devices usually relies on cloud servers for processing, but the traditional cloud server architecture has problems such as high latency and bandwidth bottlenecks. Mobile Edge Computing (MEC) effectively enhances the real-time data processing capability by sinking computing power to the network edge. However, the heterogeneity of MEC devices brings complex security challenges, such as risks of information leakage and privacy infringement, and it is urgent to build an efficient identity authentication mechanism to ensure system security. Nevertheless, the existing identity-based and physical unclonable function-based identity verification protocols show limitations, such as inability to ensure anonymity and non-reproducibility, vulnerability to the impact of challenge responses pairs on leakage, and susceptibility to various attacks caused by temporary secret leakage and key leakage. To address these issues, this paper proposes a PUF-enhanced lightweight three-factor authentication and key agreement protocol named PUF3FAka tailored for MEC environments. For the first time, CRO-PUF resilient to machine learning attacks is integrated with a fuzzy-verification mechanism into a three-factor authentication framework. Without storing any challenge–response pairs (CRPs) on the server side, the protocol eliminates the risk of CRPs leakage attacks from the root. The design satisfies ten edge-computing security evaluation criteria and withstands various attacks such as offline password guessing, ephemeral-secret leakage attacks and key-compromise impersonation attacks. Performance evaluations demonstrate that PUF3FAka outperforms existing protocols by 82.86% in computational cost and 96.7% in communication overhead on average, making it well suited for resource-constrained IoT terminals and edge servers.

Mobile devices enable the widespread adoption of One-Time Passwords (OTPs) as a crucial component of Two-Factor Authentication (2FA). The impact of OTP leakage is relatively manageable compared to static passwords. However, existing OTP standards, such as S/key, HOTP, and TOTP are vulnerable to key-compromise impersonation attacks, desynchronization attacks, and “small n” attacks. These vulnerabilities allow adversaries to bypass 2FA by exploiting pre-shared symmetric keys once either the device or the server is compromised. Furthermore, asymmetric (chain-based) OTP schemes incur high computational overhead and require periodic initialization, which limits their usability. In this work, we propose HP-OTP, a challenge-response OTP scheme that achieves password hardening without modifying password-OTP implementation architectures. Password hardening on the device side allows the server to store only a non-reversible verification credential used to generate challenges. The device's response OTP integrates the candidate password, possession factor, and a random salt. By redefining the role of OTPs in 2FA from representing only the device to jointly representing both the password and the device, HP-OTP prevents adversaries from bypassing the possession factor or exploiting compromises of either the device or the server. Comprehensive security and performance evaluation demonstrate the security of HP-OTP, with verification taking less than 5 milliseconds.

Behavioral biometrics based continuous authentication has been proven to be an effective supplement to traditional one-time authentication schemes ( like passwords), and it can continuously authenticate users throughout the session. Currently, most continuous authentication models leverage deep learning techniques to learn smartphone users' behavioral patterns from behavioral biometric data, and have made remarkable progress. However, training deep learning based continuous authentication models requires enormous computing power, which leads to resource-constrained mobile platforms relying on powerful cloud servers. Cloud servers need access to behavioral biometric data for training and inference, as this mayraise privacy concerns. Existing deep learning based continuous authentication schemes pay more attention to authenticationperformance, but ignore theprotectionof behavioral biometric data. To solve this issue, we present a privacy-preserving continuous authentication scheme based on secret sharing secure multi-party computation (MPC). More specifically, we secretly share behavioral biometric data among two cloud servers that train continuous authentication systems on joint data using two-party computation (2 PC) without compromising data privacy. Further, we evaluate the practical feasibility of our proposed privacy-preserving scheme on two realistic privacy-preserving continuous authentication models, which are constructed with deep learning and traditional machine learning techniques, respectively. Extensive experiments demonstrate the effectiveness of our two privacy-preserving continuous authentication models.

As the first defense for system security, multi-factor authentication has been deployed in various security-critical applications with mobile devices (e.g., smart grid, e-health, and Industrial Internet of Things). After three decades of intensive research, the question of how to design a secure multi-factor authentication protocol is still unsettled. In recent years, the ephemeral secret leakage (ESL) attack, originally used to cryptanalyze the authenticated key exchange (AKE) schemes, has been introduced into the field of multi-factor authentication. Considerable efforts have been made to resist the ESL attack, and it has also been listed as one of the common attacks that a secure multi-factor authentication scheme should resist. As one of the capabilities of an ESL attacker, she can obtain the ephemeral secret of public-key techniques adopted by multi-factor authentication schemes. However, public-key techniques have been proven indispensable for password-based protocols to resist offline password guessing attacks. Now a question arises:Is it possible to build a secure password-based multi-factor authentication protocol resistant to ESL attacks and offline password guessing attacks?This paper aims to answer this fundamental question. More specifically, we first revisit more than 100 multi-factor authentication schemes involving ESL attacks and present a comprehensive cryptanalysis of three representative protocols. Then, we reveal the relationship between ESL attacks and the failure of each representative protocol. mikablue Finally, we conduct a large-scale comprehensive comparative measurement of 41 multi-factor authentication schemes. Comparison results show thatallthese multi-factor authentication schemes considering ESL attacks do not perform better than those not. The above comprehensive approach leads to the key insight: ESL attacks areunsuitable/unrealisticfor evaluating password-based multi-factor authentication schemes because the leaked ephemeral secrets will lead to unavoidable offline password guessing attacks launched by ESL attackers, and the security of all these schemes would be compromised. We further conclude that employing hardware-protected devices (e.g., smart cards) as possession-based authentication factors can naturally resist ESL attacks, as the premise for ESL attackers to obtain ephemeral secrets is blocked. mikablue We believe our findings are general and also provide valuable guidance for defending against ESL attacks in multi-factor authentication protocols for non-mobile device environments as well.

Keystroke dynamics-based authentication is a promising approach to enhance the security of personal identification number (PIN)-based authentication systems for mobile devices. While its effectiveness has been extensively studied, due to the limitations on the number of samples users can provide, most research struggles with the trade-off between system performance and user experience. Additionally, little effort has been devoted to quantifying the security of PIN keystroke dynamics. In this paper, we present StrokePIN, a user-friendly and efficient authentication system that utilizes multi-modality data. Specifically, we leverage a few-shot learning technique, called Siamese Network, which enables lightweight deployment of the system without retraining. To evaluate StrokePIN, we design a set of experiments and collect two new multi-modality datasets of keystroke dynamics of 20 PINs from 116 users. These datasets are the only publicly available resources of their kind to date, and we have made them accessible online. Furthermore, we quantify the security of keystroke dynamics of PINs with entropy, revealing its security boundaries. The evaluation results show that compared to the baselines, StrokePIN achieves state-of-the-art performance with False Acceptance Rate (FAR) of 2.2% and False Rejection Rate (FRR) of 1.9% on unseen users. For unseen PINs, StrokePIN achieves an FAR of 2.6% and an FRR of 1.4%. Additionally, by dynamically updating the template library, StrokePIN can mitigate the impact of user behavior drift over time, achieving the performance with FAR of 8.3% and FRR of 0.4%. Our security analysis results indicate that keystroke dynamics can provide 4.03-5.83 bits of security against 3 to 10 online guessing attacks.

Service providers inevitably store data online, and even if the data is encrypted, adversaries who compromise the service provider may still gain the same decryption advantages. Password Hardening (PH) encryption introduces an additional security layer by incorporating an external PH server to restrict unauthorized decryption. However, existing PH encryption schemes (at USENIX SEC’18, ACM CCS’20) have limitations in encryption/decryption efficiency, making them less suitable for handling large amounts of data. Additionally, these schemes still have privacy shortcomings, as the external PH server can infer user habits by learning authentication results.For the first time, we propose a brand-new PH encryption scheme named HPHE and a hash-based Puncturable Pseudo-random Function (PPRF), which together establish a hybrid PH encryption architecture. The architecture is extensible to other PH schemes and avoids key reuse by deriving high-entropy keys to achieve one-data-one-key. In comparisons with non-hybrid original PH schemes, HPHE achieves at least a 61% improvement in the efficiency of interactive PH encryption/decryption. In one-data-one-key scenarios, HPHE achieves approximately 450× higher encryption/decryption efficiency than original PHE (USENIX SEC’18) by replacing complex interaction with key derivation. Additionally, HPHE achieves irrecoverable secure deletion and access restrictions by puncturing keys.For the first time, the novel construction of our HPHE achieves theHidingof password verification results in PH. In addition, we formally define thePrivacysecurity attributes in PH encryption and demonstrate that HPHE meets the strictest security requirements. This work extends PH encryption towards efficient large-scale data processing and more comprehensive privacy protection.

Honeywords are plausible-looking decoy passwords associated with each user’s real password to timely detect password leakage. The more indistinguishable the honeywords are, the more secure a honeyword scheme is. However, honeyword schemes that externally generate honeywords can only approximate, but not equate, the distribution of user-chosen passwords, so they are unlikely to achieve the ideal indistinguishability. To address this issue, internally sampled honeyword schemes that sample honeywords from other users’ passwords have been proposed. In this work, we first reveal two critical security and two critical usability flaws in existing internally sampled honeyword schemes, i.e., Honeyindex (TDSC’16) and Superword (COSE’21). We then formalize agenericframework for sound internally sampled honeyword schemes, and propose variants for both Honeyindex and Superword. To principally evaluate the security of our framework, we propose Bayesian and intersection attack theories leading to attackers’ optimal distinguishing strategies, and evaluate them under three major attacker models each with varied capabilities (e.g., using leaked datasets and users’ personal information). Evaluation results show that, when 40 sweetwords are associated with each user (as recommended at IEEE S&P’22), with only one guess per account, the basic attacker’s success rate can reach 3.82%∼4.12%, and she can identify 4.31%∼5.04% of all real passwords with 104honeyword login attempts, breaking the ideal 2.50%(=1/40) security. Two more advanced attackers can identify 18.6%∼44.8% and 20.6%∼43.6% of all real passwords in 104honeyword login attempts, respectively. When multiple password files are available, the intersection attack alone identifies 18.3%∼18.6% of real passwords. We also explore the impacts of denial-of-service attacks. In all, this work reveals theinherentinsecurity of internally sampled honeyword schemes.

Multi-factor authentication (MFA) has been widely applied in various fields, including smart homes, autonomous driving, and mobile communication. Although a number of MFA schemes with different security goals and properties have been proposed, most of them are found to pay little attention to password forgetting and loss issues, which may lead to the permanent loss of the account. Additionally, little effort has been devoted to designing MFA schemes with fine-grained access control to perform authentication flexibly. Therefore, the above issues raise the question of “how to construct a MFA scheme with dynamic password recovery and fine-grained access control?”. In this paper, we, for the first time, introduce attributes and a dynamic password recovery method to propose a multi-factor authentication scheme with dynamic password recovery and fine-grained control, named MFA-DPRF. In MFA-DPRF, authentication succeeds only when a user provides both a valid password and a set of attributes satisfying the specified access policy, thereby enabling fine-grained access control. Particularly, flexible access control can be achieved by verifying if user’s attributes meet the specific access policy. Furthermore, a dynamic password recovery method based on secret questions and the secret sharing technique has been designed to address password forgetting and loss issues. Users can not only recover the original password, but also update secret values such as security questions to enhance security. The security of MFA-DPRF can be reduced to the computational Diffie-Hellman problem under the Random Oracle Model. In addition, we analyze the security of MFA-DPRF in the universally composable (UC) framework, which ensures desirable properties such as composable security. The informal analysis proves that MFA-DPRF is secure against known attacks. Compared with the state-of-the-art works, performance analysis shows that MFA-DPRF is superior in security and efficiency.

Password vaults enable a user to store multiple passwords with a single master password.Honey encryption (HE) protected password vaults (called honey vaults), are promising in resisting offline master password guessing attacks.Trial-decrypted with incorrect master passwords, honey vaults are designed to yield plausible-looking decoy vaults to confuse attackers, forcing them to perform online verifications to know whether a decrypted vault is the real one.In this paper, we demonstrate how to design secure honey vault schemes in a principled approach.We first identify three major types of vulnerabilities, and propose three critical design criteria based on rigorous theories, with each aiming to address one type of vulnerability.These criteria are: (1) Employing an accurate password probability model (PPM) in the natural language encoder (NLE, a key component of a honey vault) to resist distribution-aware distinguishing attacks; (2) Employing sequence-based PPMs for unique passwords, and sufficiently concise reuse models to resist encoding attacks (USENIX SEC'19); (3) Hiding a user's real-vault-related (i.e., adaptive) PPM to resist extraction attacks (USENIX SEC'21).To meet these key criteria, we propose VaultGuard with an innovative NLE and HE-Adaptive to honey-encrypt a user's real vault and the adaptive PPM, respectively.Our NLE eliminates the first and second vulnerabilities, while HE-Adaptive addresses the third.Security evaluations on real-world data reveal that our VaultGuard can significantly enhance honey vault security, forcing attackers to perform 1.10∼3.98times online verifications.We also provide an efficient proof-of-concept VaultGuard implementation on the client side.We believe this work provides general principles and actionable guidelines for designing secure honey vault schemes.

Password managers (PMs) are useful tools that help users manage their login credentials, alleviating the burden of memorizing an ever-increasing number of passwords. Master-password-protected password management (M3PM) protocols characterize the interaction between the client and the PM's server. In this protocol, the client uses the master password for authentication, and the server assists in retrieving credentials across devices. Given the ongoing PM data breaches and users' concerns about potential server misuse, it is crucial for the server to remain oblivious to both the master password and the credentials. The pivotal role of M3PM protocols underscores the need for a systematic and formal security analysis. In this paper, we, for the first time, present an extensive formal analysis of M3PM protocols. We identify the de facto M3PM protocols from 43 PMs in industry and academia by defining a methodology that includes documentation analysis, traffic analysis, and reverse engineering. To formalize the security properties of M3PM protocols, we propose a set of ideal functionalities within the universal composability (UC) framework. We categorize offline guessing attacks on master passwords into four types based on the knowledge of the adversary. Our analysis shows that 38 of the 43 PMs are vulnerable to at least one type of offline guessing attack, demonstrating the circumstances under which various M3PM protocols with single master password protection fail to resist such attacks. Additionally, we identify an oracle attack where a corrupted server can learn the encryption key of the well-known open-source Passbolt, and demonstrate that 1Password's dual-key mechanism provides strong protection for users' master passwords and credentials.

The understanding of password security highly relates to our knowledge of how adversaries guess passwords, and this makes the modeling of guessing attacks a pivotal task. To maximize guessing effectiveness, the adversary generally attempts to guess in descending order of likelihood, akin to the way generative retrieval learning-to-rank works in a recommendation system, which prioritizes information to targeted users based on predicted relevance. In this paper, we propose a password guessing framework based on adversarial ranking, named RankGuess. We regard the password creation process as sequential decision trajectories. In this context, the adversary is assumed to train an agent where the current state is represented by the password sequence generated up to that point. The action taken is to generate the next token, and the evaluation score assigned by the ranker serves as the reward signal received. Consequently, we frame the problem of password guessing as a Markov Decision Process and tackle it using adversarial ranking techniques. Due to the generality of our framework, RankGuess can be applicable to various guessing scenarios (i.e., trawling guessing, targeted password guessing based on personally identifiable information (PII), and conditional password guessing). By employing 12 large-scale password datasets and six PII datasets, we demonstrate that our models are effective: (1) RankGuess surpasses all current state-of-the-art models and outperforms GAN-based methods by 26.29%~43.69% (avg. 34.80%); (2) When the victim's PII at site$A$(namely PIIA) is known, RankGuess-PII for targeted password guessing based on PIIA, which guesses 58.21%~91.95% of common users within 1012guesses, outperforms its foremost counterparts by 6.32%~17.09%; (3) Within 107guesses, our RankGuess-Mask based on victims' partial passwords (e.g., d****1*02*), improves the password cracking success rates by 7.70%~14.85% (avg. 8.21%) compared to its state-of-the-art counterparts. The paper provides a new technical approach to a well-known challenge in the password-guessing field.

The rapid advancement of mobile cloud computing has prompted users and commercial entities to increasingly access and utilize cloud resources for executing resource-intensive operations, which requires strong three-factor authentication and key exchange (3FAKE) protocols to ensure secure interactions in cloud environments. However, the current 3FAKE protocols not only primarily rely on traditional public-key cryptosystems that are vulnerable to quantum attacks, but lack sufficient protection for sensitive information of cloud users as well. To this end, this paper proposes a post-quantum 3FAKE (PQ3FAKE) protocol employing identity-based oblivious pseudorandom function (IBOPRF). Specifically, an IBOPRF from module learning with errors is instantiated to achieve a better balance between efficiency and security. Next, PQ3FAKE is built upon this IBOPRF to protect password from server compromise. We conduct an extensive evaluation and comparison with existing typical protocols in terms of computational overhead and security, demonstrating that the proposed PQ3FAKE achieves higher security while maintaining expected performance.

Behavioral biometrics-based continuous authentication has proven to be an excellent supplement to one-time authentication schemes that applies behavioral biometrics to authenticate smartphone users’ identities throughout the session. However, it still has two key issues that need to be addressed: 1) Due to behavioral biometrics from attackers are not available a priori, continuous authentication models should be trained only with normal samples in an unsupervised manner rather than treated as binary or multi-class classification tasks; 2) Differences in behavioral biometrics between attackers and legitimate users are fine-grained, it is challenging to extract rich semantic information to model users’ behavioral patterns. To fill this gap, we propose a lightweight latent representation masked one-class autoencoder, which is trained only with legitimate users’ behavioral biometrics. It consists of two parts: masked latent representation generator (MLRG) and Reconstructor. First, we apply the MLRG to generate discriminative latent representation with low dimension and then as a mask to cover important parts of the latent representation generated from the Reconstructor. Second, we apply the Reconstructor to reconstruct input based on masked latent representation. Experimental results demonstrate that our approach achieves superior authentication performance of 0.68% EER, 0.94% EER, 2.14% EER, and 1.87% EER on four datasets, respectively.

Passwords are today’s dominant form of authentication, and password guessing is the most effective method for evaluating password strength. Most password guessing models (e.g., PCFG, Markov, and RFGuess) regard passwords as sequences composed of basic units (i.e., characters/segments), with the information flow being unidirectional (i.e., predicting the next unit based on the preceding units). However, modeling passwords in a single direction fails to capture users’ password creation behavior that is actually impacted by the full password context. Through an in-depth analysis of real-world passwords, we reveal that users often create passwords around a central keyword, like common words, names, or dates, and then embellish them with numbers or symbols. Based on this observation, we, for the first time, attempt to parse passwords as trees. Unlike existing sequence models, trees can reveal the semantic connections within passwords and the logical thought processes users follow when creating passwords. For instance, in the passwordiloveyou, the basic unitsiandyouare semantically dependent on the predicatelove, forming a natural tree structure.We propose a trawling guessing model called PassTree and a targeted guessing model based on personally identifiable information (PII), named PassTree-PII. Our extensive experiments demonstrate the effectiveness of our models: (1) PassTree outperforms its leading counterparts by 0.38%-2.51% when guessing numbers are below$10^{7}$107; (2) PassTree-PII achieves a cracking rate comparable to the state-of-the-art RFGuess-PII proposed in USENIX Security’23, but operates significantly more efficiently, using only 0.87% of the memory and being 16.60 times faster. Our work provides a new perspective on understanding user passwords and demonstrates a feasible technical route of applying tree structures to password guessing.

With the rapid development of sensors and communication technologies, the Internet of Things (IoT) paradigm has increasingly expanded to cover various daily, industrial, and military applications. As a core component of the IoT responsible for environmental sensing and data collection, wireless sensor networks (WSNs) face significant security threats. The design of multi-factor authentication schemes to secure real-time data transmission in WSNs has garnered considerable research efforts. However, a common trend in existing multi-factor authentication protocols is emphasizing performance and security benefits, while possible limitations are rarely subjected to thorough analysis. To fill this gap, we first select two representative multi-factor authentication schemes (i.e., Chaudhry et al.'s scheme at ACM ToIT'21 and Jabbari-Mohasef's scheme at IEEE TII'22) as case studies, and point out that both schemes are vulnerable to offline password guessing and node capture attacks, and fail to achieve forward secrecy. We then investigate the fundamental causes of these weaknesses underlying the schemes and propose corresponding solutions. After rethinking previous schemes, we present a new robust two-factor authentication scheme for WSNs and formally prove its security under the Random Oracle Model. Furthermore, we compare our scheme with 18 state-of-the-art protocols using the widely accepted evaluation framework. The comparison results show that our protocol outperforms its foremost counterparts.

One-Time Passwords (OTPs) play a crucial role in Two-Factor Authentication (2FA) and Multi-Factor Authentication (MFA) by adding an additional layer of security. OTPs effectively reduce the risk of static passwords being intercepted and reused. Nevertheless, both academic schemes and industrial solutions face security threats stemming from server/device compromises and OTP factor forgery. Chain-based asymmetric OTP schemes are a promising approach to addressing the problem of server compromise but still face threats from device compromise and pre-generated chain leakage. We emphasize that since devices directly store the OTP seed, OTP authentication is essentially equivalent to verifying device possession. This means that in existing OTP schemes, OTP forgery and device compromise remain prevalent and difficult to overcome. In this work, we propose a brand new scheme to address OTP factor forgery and server/device compromises. For the first time, our scheme constructs a tightly coupled architecture between the password factor and the OTP factor. The OTP seed is derived from a password and a device-stored salt, preventing OTP seed extraction and OTP forgery even in the event of a device compromise. Through the integration of “honeywords” with the tightly coupled OTP architecture, the server stores decoy OTP seeds generated by decoy passwords, providing resistance against server compromises and partial password guessing from devices. We conduct a comprehensive evaluation of our OTP schemes. The computational overhead is correlated with the number of honeywords, and with the recommended set size of 20, the total verification overhead is approximately$0.24~ms$. Additionally, we propose formal security properties and application metrics, and rigorously prove our scheme’s resistance against server/device compromise attacks and guessing attacks. Our scheme is the first to achieve comprehensive OTP security with low overhead.

Password managers (PMs) provide users with convenient and robust functionalities to manage their credentials, highly recommended by security experts and major standard bodies. One of the most popular features is the autofill functionality, with which users need a single click or a few clicks to fill in every field in web forms, facilitating the process of completing web forms. However, such indiscriminate autofill brings severe privacy threats. PMs may inadvertently fill data into wrong fields in web forms, even hidden fields, potentially leading to privacy leaks and credential theft.In this paper, we conduct an empirical study evaluating the effectiveness of 30 popular PMs in identifying and handling hiddenfields. We focus on the privacy threats posed by the autofill functionality, which fills data into hidden fields. We develop a semi-automated autofill testing tool and explore whether PMs autofill sensitive data into hidden fields across 15 concealment techniques and three web forms, including personal information, credit card, and login forms. Experimental results reveal that every PM autofills data into hidden fields in at least one web form, with an overall filled probability of 58.7% in 1032 scenarios. Further analysis reveals that login forms are the most vulnerable, with a 65.7% probability of hidden fields autofill. Hidden fields concealed by clip-path and content-visibility are filled with passwords by all PMs. Besides, built-in-browser PMs exhibit a 4.07 times higher likelihood of filling data into hidden fields than separately-installed PMs. Even more concerning, built-in-browser PMs, except Safari, autofill passwords into hidden fields under any concealment technique. 37.7% of autofill scenarios with insufficient user interaction pose heightened privacy threats, as users are unaware of autofill content. These privacy threats have been confirmed by popular PMs like LastPass.To mitigate the threats brought by the autofill functionality, we present two actionable recommendations for PM operators/developers: (1) providing fine-grained data types in rendered overlays before autofilling; (2) integrating visual language model techniques to accurately identify fillable fields and prevent data autofilling into hidden fields. We believe this work makes a substantial step toward understanding the security implications of the autofill functionality in PMs.

While the academic community has proposed dozens of probabilistic password guessing models to improve the success rate of password guessing, few studies have considered the speed of generating password guesses (which is a crucial factor in realistic password guessing scenarios). Real-world attackers often aim to crack more passwords in less time, and the speed of these models thus becomes a significant concern. Consequently, real-world attackers tend to prefer simple heuristic methods (such as Rule attack and Mask attack) and off-the-shelf password cracking tools (such as Hashcat and John the Ripper), over academic probabilistic password guessing models, despite the latter’s superior scientific flavor.

Honey encryption (HE) protected password vaults (called honey vaults) are promising tools that allow a user to store multiple passwords (called a password vault) and encrypt them with a master password using HE. In case password vaults are somehow leaked and the attackers launch offline password guessing, honey vaults can yield decoy password vaults for incorrect guesses, forcing an offline guessing attacker to interact with the authentication server to identify whether passwords in decrypted vaults are correct or not. Therefore, honey vaults transform the offline guessing attacker into an online guessing attacker, i.e., honey vault distinguishing attacker.In online guessing, attackers can adopt various attacks to perform multiple guesses against multiple vaults, but the existing theoretical message recovery (MR) security for HE only focuses on the advantage of one-time guess against a single vault, which cannot accurately model realistic attackers and thus can not provide practical advice for users’ vault security. To address this issue, we propose a theoretically-grounded optimal strategy for distinguishing attackers, and manage to derive a much tighter upper bound on the advantage against MR security. Particularly, we provide much tighter upper/lower bounds for advantage against HE-related cryptographic security games, i.e., the security of distribution transforming encoder (DTE), known message attack, and known side information attack. This provides a better understanding of the actual security of honey encryption.To better understand the security of honey vault systems, we instantiate our optimal strategy into three practical attacks and propose an encoding attack. Extensive experiments against two major honey vault systems demonstrate that our four attacks can improve the attack success rate by 1.15-4.35 times compared with their counterparts. For the intersection attack, we propose a feature attack against Cheng et al.’s incremental update mechanism (at USENIX SEC’21), and our attack can breach their mechanism with 87%-93% advantage.

The increasing use of multi-biometric authentication has raised concerns about the security of biometric templates. Many template protection methods based on convolutional neural network have been presented, but most involve a trade-off between authentication accuracy and template security. In this paper, we present a cancelable multi-biometric template protection scheme that combines deep hashing with cancelable distance-preserving encryption (CDPE), which provides high template security without degrading the authentication performance. Specifically, a deep hashing based architecture that minimizes the quantization loss is designed to map face and iris traits to binary codes. Next, CDPE is proposed to generate a protected template given the face binary code and a user-specific key obtained from the iris binary code, which preserves the distance between original templates in the protected domain to ensure authentication performance equivalent to unprotected systems. Digital lockers instead of the key are stored to further enhance the security, which can be unlocked with genuine biometric traits to get the correct key during authentication. Theoretical and experimental results on real face and iris datasets show that our scheme can achieve equal error rate of 0.23% and genuine accept rate of 97.54%, while guaranteeing irreversibility, revocability and unlinkability of protected templates.

Searchable encryption is a powerful tool that enables secure and private searches of encrypted data. It allows users to outsource their data to cloud servers while maintaining the confidentiality and privacy of their data. Password-authenticated symmetric searchable encryption (PASE) can help users avoid the complexity and security risks associated with key management while maintaining the advantages of searchable encryption. To the best of our knowledge, none of the existing PASE schemes can resist security threats in the post-quantum era, and there is an urgent need to design quantum-resistant solutions. However, post-quantum cryptography (e.g., lattice-based cryptography) varies significantly from traditional cryptography, and it is challenging to design a quantum-resistant PASE for cloud storage. In this work, we take the first step towards this challenge by proposing QPASE, a quantum-resistant password-authenticated symmetric searchable encryption for cloud storage. We employ lattice-based threshold oblivious pseudorandom function (TOPRF) to achieve password re-randomization and formally prove that QPASE is authentication secure and indistinguishability against chosen keyword attacks (IND-CKA) secure under quantum computers. QPASE can be extended to multi-keyword search and allows servers to update keys without affecting the users. The comparison results show that QPASE outperforms its foremost counterparts in security and computation overhead.

Two-factor authentication provides a strong defense against account compromise. However, traditional two-factor authentication schemes cannot provide users with much flexibility and fine-grained authorization. In this work, we present an efficient design ofAttribute-BasedPasswordAuthenticatedKeyExchange (AB-PAKE) protocol, ensuring that only two legitimate users with desired attributes and correct passwords can establish a shared session key. We, for the first time, tackle the problem of “how to enhance a peer-to-peer PAKE scheme by using a storage device (e.g., a smart-phone, a USB token, or a personal computer that the user logs in), such that even if ephemeral secret keys of two participants have been leaked, it still provides user privacy protection and truly two-factor security”. AB-PAKE works well in peer-to-peer (i.e., end-to-end) scenarios where the participants expect to hide their real identity information and the peer is enforced to satisfy the defined conditions (aka authentication policy). It achieves flexibility, privacy preservation, and dynamic access control lacking in prior authentication proposals. In addition, our work mitigates a practical threat in authenticated key exchange schemes, namely, the ephemeral secret leakage attack. We aim to increase the attack difficulty and limit password leakage even if the user’s long-term key or ephemeral key is leaked. The proposed protocol is also round-optimal, i.e., it is a single-round protocol consisting of only two message flows among the parties. Our new construction of AB-PAKE protocol reduces the number of pairing operations to be constant and supports richer policies. Provable security and practicality are demonstrated by comprehensive analysis.

Multi-factor authentication (MFA) is crucial for Wireless Sensor Networks (WSNs) to ensure secure communication in security-critical applications such as smart homes, industrial control, and military defense due to the open nature of WSNs. Considerable efforts have been made to propose various MFA schemes with varied security goals and desirable properties. However, little attention has been given to the property of dynamic password recovery, and it still remains a question of how to construct a robust MFA scheme with the desirable property of dynamic password recovery for WSNs. In this paper, we first review two representative multi-factor authentication schemes proposed by Li-Tian (at IEEE Syst J’22) and Fatima et al. (at ACM TOSN’23) as case studies, and reveal that these two schemes fail to resist some known attacks and pay little attention to password forgetting and leakage issues. Accordingly, we employ the techniques of the honeywords method, fuzzy-verifier technique, and public key cryptosystem to construct a novel MFA scheme. Particularly, we propose the first dynamic password recovery method for MFA to address password forgetting and leakage issues. Key rotation is implemented to ensure the security of the long-term secret key. Our scheme is provably secure under the Random Oracle Model. Comparison results show the superiority of our new scheme.

Cloud storage provides an efficient and convenient way to manage data, but it also poses significant challenges to data security. The central issue with cloud storage is to ensure the ability of the data owner to control and manage the outsourced data. The password-protected secret sharing (PPSS) integrates password authentication and secret sharing to offer a fresh approach to secure private data. Users can share the risk of device corruption with a well-designed PPSS scheme and manage outsourced data with only human-memorizable passwords. To the best of our knowledge, none of the existing PPSS schemes can resist security threats in the post-quantum era, and there is an urgent need to design quantum-resistant solutions. However, post-quantum cryptography varies significantly from traditional cryptography, and it is challenging to design a quantum-resistant password-protected secret-sharing scheme for cloud storage. In this work, we take the first substantial step towards this challenge by proposing QPause, a quantum-resistant password-protected data outsourcing scheme for cloud storage. We first design a basic quantum-resistant PPSS scheme based on the lattice secure against semi-honest adversaries with a secure channel. On this foundation, we propose a quantum-resistant round-optimal password-protected data outsourcing scheme against strong adversaries. In addition, we formally prove that our scheme is secure and robust under various attacks against adversaries with quantum computing capabilities. The comparison results show that our new scheme outperforms its foremost counterparts.

Cyber–physical system (CPS) provides a foundation for the Industrial Internet of Things (IIoT) that interconnects all types of devices. The integration of CPS with IIoT generates the large volumes of data forcing the development of artificial intelligence (AI) to extract information more precisely. Nevertheless, the increasing volume/variety of data traffic and the ever-growing number of IIoT devices bring great challenges for the host-centric communication model of the current Internet. In this work, we present a novel information-centric networking (ICN)-based system model in CPS, which enables processing data from IIoT devices closer to the edge as opposed to a content provider. Based on this ICN system model, we propose an edge-assisted authentication scheme in CPS, aiming to protect the system from unauthorized access and reduce workload for resource-constrained devices. The main features of our scheme include a delegation model of security operations and session handshake procedures through edge routers, addressing the rising challenges in managing and securing IIoT devices in the ICN. We formally prove the security of our scheme and conduct performance analysis to show its practicality.

Smart-card based password authentication has been the most widely used two-factor authentication (2FA) mechanism for security-critical applications (e.g., e-Health, smart grid and e-Commerce) in the past decades, and it is likely to hold its status in the foreseeable future. Hundreds of this type of 2FA schemes have been proposed, yet to our knowledge, most of them are built on the intractability of conventional hard problems (e.g., discrete logarithm problems and integer factoring problems) which are no longer hard in the quantum era. With the recent advancements in quantum computing, the design of secure and efficient smart-card based password authentication schemes against quantum attacks is becoming increasingly urgent. However, it is not as simple as it seems,how to design such a quantum-resistant 2FA scheme is challenging due to the demanding security requirements and the resource-constrained nature of mobile devices. In this work, we take the first step towards this issue by proposing Quantum2FA, a practical quantum-resistant smart-card-based password authentication scheme that employs Alkimet al.’s lattice-based key exchange and Wang-Wang’s “fuzzy-verifier + honeywords” technique (IEEE TDSC’18). Particularly, Quantum2FA can thwart the newly revealed key-reuse attack (ACISP’18, CT-RSA’19) against lattice-based key exchange schemes in two aspects: signal leakage attacks and key mismatch attacks. Specifically, it restricts the necessary conditions (i.e., the attacker must be the initiator of the key exchange) for an adversary to analyze the signal; It introduces honeywords to detect the key mismatches between the smart card and the server, and thus smart card loss attack can be thwarted. We formally prove the security of Quantum2FA under the random oracle model and demonstrate its efficiency through experiments on a 32 MHz 8-bit AVR Embedded Processor. Comparison results show that Quantum2FA is not only more secure but also offers better computation efficiency than the state-of-the-art conventional 2FA schemes.

As password distribution lays the foundation for various password research, accurately characterizing it receives considerable attention. At IEEE TIFS’17, Wang et al. proposed the CDF-Zipf distribution model with the golden-section-search (GSS) fitting method to find the optimal parameters. Their model has been adopted by over 120 password-related studies. In this paper, we address their remaining, fundamental goodness-of-fit issue of password distribution in a principled approach. First, we prove that the confidence level of the state-of-the-art Monte Carlo approach (MCA, for the goodness-of-fit test) converges asymptotically to 0. By experimenting on 228.92 million real-world passwords, we confirm Wang et al.’s conjecture on the effect of sample size that minor deviations would lead to statistical significance for large-scale datasets. We propose both absolute and relative deviation metrics, and find that 1% random deviations in both metrics suffice to reject CDF-Zipf. Second, we attempt to reduce the non-negligible gap between the empirical and fitted distributions (with the maximum deviation of cumulative distribution function (CDF) being 1.91% on average). We explore eight alternative distribution models in two coordinate systems, and find that three models are more accurate than CDF-Zipf, but none can pass MCA. Particularly, we reveal that stretched-exponential, a variant of CDF-Zipf, can on average reduce the maximum CDF deviation from 1.91% to 1.25%. Third, to replace MCA, we introduce a new goodness-of-fit measure based on log-likelihoods. We find that stretched-exponential constantly has a larger log-likelihood than its counterparts. In all, stretched-exponential fits passwords better and further supports Zipf’s law in passwords.

Cloud-assisted Internet of Things (IoT) overcomes the resource-constrained nature of the traditional IoT and is developing rapidly in such fields as smart grids and intelligent transportation. In a cloud-assisted IoT system, users can remotely control the IoT devices and send specific instructions to them. If the users’ identities are not verified, adversaries can pretend as legitimate users to send fake and malicious instructions to IoT devices, thereby compromising the security of the entire system. Thus, a sound authentication mechanism is indispensable to ensure security. At the same time, it should be noted that a gateway may connect to massive IoT devices with the exponential growth of interconnected devices in a cloud-assisted IoT system. The efficiency of authentication schemes is easily impacted by the computation capability of the gateway. Recently, several schemes have been designed for cloud-assisted IoT systems, but they have problems of one kind or another, making them not very suitable for cloud-assisted IoT systems. In this paper, we take a typical scheme (proposed at IEEE TDSC 2020) as an example to identify the common weaknesses and challenges of designing a user authentication scheme for cloud-assisted IoT systems. In addition, we propose a new secure user authentication scheme with lightweight computation on gateways. The proposed scheme provides secure access between remote users and IoT devices with many ideal attributions, such as forward secrecy and multi-factor security. Meanwhile, the security of this scheme is proved under the random-oracle model, heuristic analysis, the ProVerif tool and BAN logic. Compared with ten state-of-the-art schemes in security and performance, the proposed scheme achieves all the listed twelve security requirements with minimum computation and storage costs on gateways.

Multi-factor authentication is a promising way to enhance the security of password-based authenticated key exchange (PAKE) schemes. It is widely deployed in various daily applications for mobile devices (e.g., e-Bank, smart home, and cloud services) to provide the first line of defense for system security. However, despite intensive research, how to design a secure and efficient multi-factor authentication scheme is still a challenging problem. Hundreds of new schemes have been successfully proposed, and many are even equipped with a formal security proof. However, most of them have been shortly found to be insecure and cannot achieve the claimed security goals. Now a paradox arises: How can a multi-factor scheme that was “formally proven secure” later be found insecure? To answer this seemingly contradicting question, this paper takes a substantial first step towards systematically exploring the security proof failures in multi-factor authentication schemes for mobile devices. We first investigate the root causes of the “provable security” failure in vulnerable multi-factor authentication schemes under the random oracle model, and classify them into eight different types in terms of the five steps of conducting a formal security proof. Then, we elaborate on each type of these eight proof failures by examining three typical vulnerable protocols, and suggest corresponding countermeasures. Finally, we conduct a large-scale comparative measurement of 70 representative multi-factor authentication schemes under our extended evaluation criteria. The schemes we select range from 2009 to 2022, and the comparison results suggest that understanding failures in formal security proofs is helpful to design more secure multi-factor authentication protocols for mobile devices.

The identity authentication of most applications is based on a symbolic password. However, incidents of password leakage emerge one after another, which brings serious hidden danger to the users’ information security. For decades, various schemes have been proposed to solve the problem of information protection. However, most schemes neglect the timely detection of password leakage. The present paper introduces a password leak detection method based on zero-divisor graph sequences. Specifically, it is to construct an algorithm for generating honeywords with high smoothness. First, we introduce the concept of the zero-divisor graph and construct zero-divisor graph sequences by using the corresponding zero-divisor matrices. Second, the honeywords with high flatness are constructed by using the sequence of zero-divisor graphs. Third, the security analysis verifies the effectiveness of the scheme. Fourth, compared with other honeywords schemes, our scheme has more obvious advantages, in the aspects of honeywords generated flatness, DoS resistance, and storage resources occupied by honeywords.

Honeywords are decoy passwords associated with each user account to timely detect password leakage. The key issue lies in how to generate honeywords that are hard to be differentiated from real passwords. This security mechanism was first introduced by Juels and Rivest at CCS’13, and has been covered by hundreds of media and adopted in dozens of research domains. Existing research deals with honeywords primarily in an ad hoc manner, and it is challenging to develop a secure honeyword-generation method and well evaluate (attack) it. In this work, we tackle this problem in a principled approach. We first propose four theoretic models for characterizing the attacker $\mathcal{A}$’s best distinguishing strategies, with each model based on a different combination of information available to $\mathcal{A}$ (e.g., public datasets, the victim’s personal information and registration order). These theories guide us to design effective experiments with real-world password datasets to evaluate the goodness (flatness) of a given honeyword-generation method.Armed with the four best attacking theories, we develop the corresponding honeyword-generation method for each type of attackers, by using various representative probabilistic password guessing models. Through a series of exploratory investigations, we show the use of these password models is not straightforward, but requires creative and significant efforts. Both empirical experiments and user-study results demonstrate that our methods significantly outperform prior art. Besides, we manage to resolve several previously unexplored challenges that arise in the practical deployment of a honeyword method. We believe this work pushes the honeyword research towards statistical rigor.

As the most dominant authentication mechanism, password-based authentication suffers catastrophic offline password guessing attacks once the authentication server is compromised and the password database is leaked. Password hardening (PH) service, an external/third-party crypto service, has been recently proposed to strengthen password storage and reduce the damage of authentication server compromise. However, all existing schemes are unreliable in that they overlook the important restorable property: PH service opt-out. In existing PH schemes, once the authentication server has subscribed to a PH service, it must adopt this service forever, even if it wants to stop the external/third-party PH service and restore its original password storage (or subscribe to another PH service). To fill the gap, we propose a new PH service called PW-Hero that equips its PH service with an option to terminate its use (i.e., opt-out). In PW-Hero, password authentication is strengthened against offline attacks by adding external secret spices to password records. With the opt-out property, authentication servers can proactively request to end the PH service after successful authentications. Then password records can be securely migrated to their traditional salted hash state, ready for subscription to other PH services. Besides, PW-Hero achieves all existing desirable properties, such as comprehensive verifiability, rate limits against online attacks, and user privacy. We define PW-Hero as a suite of protocols that meet desirable properties and build a simple, secure, and efficient instance. Moreover, we develop a prototype implementation and evaluate its performance, establishing the practicality of our PW-Hero service.

Password authentication is the dominant form of access control for the Web and mobile devices, and its practicality and ubiquity is unlikely to be replaced by other authentication approaches in the foreseeable future. To guarantee the security of data communication and mitigate the problem of password-cracking, aPassword Authenticated Key Exchange($\mathsf {PAKE}$) system can be deployed between two peer participants. The main drawback of traditional$\mathsf {PAKE}$is that passwords are exposed in plaintext when the remote server is compromised. To overcome this limitation, it is recommended by industry standards (such as SRP family RFC 5054, RFC6628, RFC7914, OPAQUE,etc) to useasymmetric-$\mathsf {PAKE}$protocols, which enable the server to store a hash of the user's password with a random salt, providing guarantees that the user's password is never transmitted in plain-text to the server when login. However, most of the existingasymmetric-$\mathsf {PAKE}$protocols either are based on traditional hash functions under random oracles, or depend on non-quantum-secure hardness assumptions and become insecure in the quantum era. To bridge the gap betweenasymmetric-$\mathsf {PAKE}$and quantum-security, in this article, we resort tosmooth projective hash functions($\mathsf {SPHF}$) andcommitment-basedpassword-hashing schemes($\mathsf {PHS}$) over lattice-based cryptography, and construct an asymmetric$\mathsf {PAKE}$protocol secure against quantum attacks. Our construction eliminates the costly non-interactive zero-knowledge (NIZK) method, bypasses assumptions of the random oracle model, and achieves quantum resistance. We also show that our asymmetric-$\mathsf {PAKE}$protocol can achieve security and efficiency under the Bellare-Pointcheval-Rogaway (BPR) model. Finally, we develop a prototype implementation of our instantiation and use it to evaluate its performance in realistic settings.

Due to the limitations of symmetric-key techniques, authentication and key agreement (AKA) protocols based on public-key techniques have attracted much attention, providing secure access and communication mechanism for various application environments. Among these public-key techniques used for AKA protocols, chaotic-map is more effective than scalar multiplication and modular exponentiation, and it offers a list of desirable cryptographic properties such as un-predictability, un-repeatability, un-certainty, and higher efficiency than scalar multiplication and modular exponentiation. Furthermore, it is usually believed that three-factor AKA protocols can achieve a higher security level than single- and two-factor protocols. However, none of existing three-factor AKA protocols can meet all security requirements. One of the most prevalent problems is how to balance security and usability, and particularly how to achieve truly three-factor security while providing password change friendliness. To deal with this problem, in this article we put forward a provably secure three-factor AKA protocol based on extended chaotic-maps for mobile lightweight devices, by adopting the techniques of “Fuzzy-Verifiers” and “Honeywords”. We prove the security of the proposed protocol in the random oracle model, assuming the intractability of extended chaotic-maps Computational Diffie-Hellman problem. We also simulate the protocol by using the AVISPA tool. The security analysis and simulation results show that our protocol can meet all 13 evaluation criteria regarding security. We also assess the performance of our protocol by comparing with seven other related protocols. The evaluation results demonstrate that our protocol offers better balance between security and usability over state-of-the-art ones.

Despite decades of intensive research, it is still challenging to design a practical multi-factor user authentication scheme for wireless sensor networks (WSNs). This is because protocol designers are confronted with a long-standing “security versus efficiency” dilemma: sensor nodes are lightweight devices with limited storage and computation capabilities, while the security requirements are demanding as WSNs are generally deployed for sensitive applications. Hundreds of proposals have been proposed, yet most of them have been found to be problematic, and the same mistakes are repeated again and again. Two of the most common security failures are regarding smart card loss attacks and node capture attacks. The former has been extensively investigated in the literature, while little attention has been given to understanding the node capture attacks. To alleviate this undesirable situation, this article takes a substantial step towards systematically exploring node capture attacks against multi-factor user authentication schemes for WSNs. We first investigate the various causes and consequences of node capture attacks, and classify them into ten different types in terms of the attack targets, adversary’s capabilities and vulnerabilities exploited. Then, we elaborate on each type of attack through examining 11 typical vulnerable protocols, and suggest corresponding countermeasures. Finally, we conduct a large-scale comparative measurement of 61 representative user authentication schemes for WSNs under our extended evaluation criteria. We believe that such a systematic understanding of node capture attacks would help design secure user authentication schemes for WSNs.

Password-based authenticated key exchange($\mathsf {PAKE}$PAKE) protocol, a widely used authentication mechanism to realize secure communication, allows protocol participants to establish a high-entropy session key by pre-sharing a low-entropy password. An open challenge in$\mathsf {PAKE}$PAKEis how to design a quantum-resistant round-optimal$\mathsf {PAKE}$PAKE. To solve this challenge, lattice-based cryptography is a promising candidate for post-quantum cryptography. In addition, Katz and Vaikuntanathan (ASIACRYPT’09) design the firstthree-round$\mathsf {PAKE}$PAKEprotocol by leveraging the smooth projective hash function ($\mathsf {SPHF}$SPHF) over lattices. Subsequently, Zhang and Yu (AISACRYPT’17) optimized Katz-Vaikuntanathan’s approximate$\mathsf {SPHF}$SPHFvia a splittable public key encryption. They then constructed atwo-round$\mathsf {PAKE}$PAKEby using the simulation-sound non-interactive zero-knowledge (NIZK) proofs, but how to construct a lattice-based simulation-sound NIZK remains an open research question. In other words, how to design a one-round$\mathsf {PAKE}$PAKEvia an efficient lattice-based$\mathsf {SPHF}$SPHFstill remains a challenge. In this work, we attempt to fill this gap by proposing a lattice-based$\mathsf {SPHF}$SPHFwith adaptive smoothness. We then obtain aone-round$\mathsf {PAKE}$PAKEprotocol over lattices with rigorous security analysis by integrating the proposed$\mathsf {SPHF}$SPHFinto the one-round framework proposed by Katz and Vaikuntananthan (TCC’11). Furthermore, we explore the possibilities of achieving two-round$\mathsf {PAKE}$PAKEand universal composable (UC) security from our$\mathsf {SPHF}$SPHF, and show the potential application of our$\mathsf {PAKE}$PAKEin Internet of Things (IoTs) where communication cost is the main consideration.

Nowadays, as one of the key applications of Internet of Things, Industry IoT (IIoT) has recently received significant attention and has facilitated our life. In IIoT environments, an amount of data generally requires to be transmitted between the user and sensing devices in an open channel. In order to ensure safe transmission of these data, it is necessary for the user and sensing devices to authenticate each other and establish a secure channel between them. Recently, a multifactor authenticated key agreement scheme for IIoT was proposed, which aims to tackle this problem and provide solutions for user multiple sensing devices’ access. This work claims that the proposed scheme is secure against vario us attacks and has less communication and computational costs than other existing related schemes. Unfortunately, we find that this scheme cannot resist smart card attack and sensing device capture attack. Furthermore, we show that this scheme fails to provide forward secrecy, which is essential for a secure multifactor authentication scheme.

Fully Homomorphic Encryption ($\mathsf {FHE}$) allows computing over encrypted data without decrypting the corresponding ciphertexts, and it constitutes a promising cryptographic primitive to preserve data privacy in the big data computing environments. In general,$\mathsf {FHE}$schemes can be constructed by using the standard Learning with Errors ($\mathsf {LWE}$) assumption, and the current crux lies in how to achieve efficient multi-bit$\mathsf {FHE}$encryption while being leakage-resistent against attackers who may capture the information of cryptographic secret keys via side channel attacks. Based on Berkoff-Liu’s work at TCC’14, we aim to address this issue by giving a new structure of public key matrix with any number of$\mathsf {LWE}$instances, thereby avoiding the use of a straightforward composition to achieve multi-bit$\mathsf {FHE}$encryption under standard$\mathsf {LWE}$. Particularly, our scheme attains provable security.

Password strength meters (PSMs) are being widely used, but they often give conflicting, inaccurate and misleading feedback, which defeats their purpose. Except for fuzzyPSM, all PSMs assume passwords are newly constructed, which is not true in reality. FuzzyPSM considers password reuse, six major leet transformations and initial capitalization, and performs the best as evaluated by Golla and Dürmuth at ACM CCS’18. On the basis of fuzzyPSM, we propose a new PSM based onReuse,Leet andSeparation, namely RLS-PSM. First, we classify password reuse behaviors into capitalization and those that use special characters for leet or separation, and calculate the corresponding probabilities. Then, to balance efficiency and precision, we use Long Short-Term Memory to calculate the probabilities of alphanumeric strings. Besides, we propose to usebenchmark passwordsto show therelative strengthof a password. Due to the varied impacts of different service types and diversified economic value of websites, we consider parameter settings of RLS-PSM under six different service types. Finally, we use the Monte Carlo method and weighted Spearman coefficient to measure and compare the robustness and accuracy of RLS-PSM, leading PSMs (including Markov-based PSM, PCFG-based PSM, fuzzyPSM, RNN, and Zxcvbn), and password cracking tools (including JtR and Hashcat). We find that the robustness of RLS-PSM is significantly higher than all counterparts whenevaluating attempts> 104(e.g., on average, Fraction of Successfully Evaluated passwords of RLS-PSM is 18.9% higher than fuzzyPSM). The accuracy of RLS-PSM is also better than other mainstream PSMs used for comparison in this paper, except for fuzzyPSM.

The identity‐based signature (IBS) scheme is one of the most promising secure and widely used cryptographic primitives for electronic commerce applications. For example, ID‐based signing in a multi‐party setting, without ever revealing any private and secret information , has received considerable interest in distributed applications such as a global manufacturer. However, there is no practical solution for such a group setting (e.g. more than two parties). Therefore, in this study, the authors present the first distributed identity‐based signing protocol for the global electronic commerce system. Specifically, the authors’ designed protocol allows a group of parties to generate the signature in a decentralised and fair manner. They also prove that their proposed protocol is secure against a malicious adversary under the discrete logarithm and decisional Diffie–Hellman assumptions. Moreover, they implement the protocol using the MIRACL libraries on physical computing devices. Findings from the evaluations demonstrate the practical utility of their proposed protocol, in terms of achieving high level of security within a reasonable time framework (e.g. signing time (including communication latency and waiting delay) takes 311.86 ms for three parties, 558.2 ms for five parties, and 707.21 ms for seven parties, under a single‐thread implementation).

Identity‐based cryptography (IBC) is considered as a promising mechanism in the Internet of Things and ad‐hoc networks, providing lightweight authentication and powerful access control. However, it suffers from two inherent problems, i.e. key escrow and the requirement of a secure channel, which are not always good properties in many realistic scenarios. Thus, an efficient key issuing protocol in a distributed setting without the assumption of the secure channel is needed. In this study, the authors give special attention to the IBC standardised in IEEE P1363 and design a multi‐party setup and key issuing protocol for it. Their protocol is proven to be malicious secure by simulation under weaker assumptions. Contrast to prior works that rely on a trusted party for key distribution or the strong assumption of a secure channel, they provide the first practical solution for the distributed architectures.

Proxy re-encryption (PRE) is a fundamental cryptographic primitive in secure data sharing and e-mail forwarding, etc. To our knowledge, most existing efficient lattice-based PRE schemes focus on the construction of single-hop, key-private, multi-bit and chosen-ciphertext attack (CCA), etc. Few works of literature discussed the detailed multi-hop construction over lattices. Very recently, Chandran et al. (PKC'14) proposed a lattice-based PRE scheme that builds upon the key switching mechanism of Brakerski (CRYPTO'12), and pointed out that their scheme can achieve multi-hop PRE scheme by the ideal circuit family for a directed graph G. In this paper, we are still working along this line and achieving multi-hop PRE via the branching program (BP), which is one type of NC1 circuit and can be used to compute encrypted data. To our knowledge, we proposed the first multi-hop PRE scheme via BP which supports homomorphic evaluation. We also analyze the security of our scheme under decisional learning with errors (LWE) assumption.

It is challenging to design a secure and efficient multi-factor authentication scheme for real-time data access in wireless sensor networks. On the one hand, such real-time applications are generally security critical, and various security goals need to be met. On the other hand, sensor nodes and users’ mobile devices are typically of a resource-constrained nature, and expensive cryptographic primitives cannot be used. In this work, we first revisit four foremost multi-factor authentication schemes (i.e., those of Amin et al. (JNCA’18), Srinivas et al. (IEEE TDSC’18), Li et al. (JNCA’18), and Li et al. (IEEE TII’18)) and use them as case studies to reveal the difficulties and challenges in designing a multi-factor authentication scheme for wireless sensor networks correctly. We identify the root causes for their failures in achieving truly multi-factor security and forward secrecy. We further propose a robust multi-factor authentication scheme that makes use of the imbalanced computational nature of the RSA cryptosystem, particularly suitable for scenarios where sensor nodes (but not the user’s device) are the main energy bottleneck. Comparison results demonstrate the superiority of our scheme. As far as we know, it is the first two-factor authentication scheme for real-time data access in WSNs that can satisfy all 12 criteria of the state-of-the-art evaluation metric under the harshest adversary model so far.

Mobile device and application (app) security are increasingly important, partly due to the constant and fast-paced cyberthreat evolution. To ensure the security of communication (e.g., data-in-transit), a number of identity-based signature schemes have been designed to facilitate authorization identification and validation of messages. However, in many of these schemes, a user's private key may leak when a new signature is generated since the private keys are stored on the device. Seeking to improve the security of the private key, we propose the first two-party distributed signing protocol for the identity-based signature scheme in the IEEE P1363 standard. This protocol requires that two devices separately store one part of the user's private key, and allows these two devices to generate a valid signature without revealing the entire private key of the user. We formally prove that the security of the protocol in the random oracle model. Then, we implement the protocol using the MIRACL library and evaluate the protocol on two mobile devices. Compared with the protocol of Lindell (CRYPTO'17) that uses the zero-knowledge proof for its security, our protocol is more suitable for deployment in the mobile environment.

Investigating the security pitfalls of cryptographic protocols is crucial to understand how to improve security. At ICCCS’17, Wu and Xu proposed an efficient smart-card-based password authentication scheme for cloud computing environments to cope with the vulnerabilities in Jiang et al.’s scheme. However, we reveal that Wu-Xu’s scheme actually is subject to various security flaws, such as offline password guessing attack and replay attack. Besides security, user friendly is also another great concern. In 2017, Roy et al. found that in most previous two-factor schemes a user has to manage different credentials for different services and further suggested a user-friendly scheme which is claimed to be suitable for multiserver architecture and robust against various attacks. In this work, we show that Roy et al.’s scheme fails to achieve truly two-factor security and shows poor scalability. At FGCS’18, Amin et al. pointed out that most of existing two-factor schemes are either insecure or inefficient for mobile devices due to the use of public-key techniques and thus suggested an improved protocol by using only light-weight symmetric key techniques. Almost at the same time, Wei et al. also observed this issue and proposed a new scheme based on symmetric key techniques with formal security proofs in the random oracle model. Nevertheless, we point out that both Amin et al.’s and Wei et al.’s schemes cannot achieve the claimed security goals (including the most crucial goal of “truly two-factor security”). Our results invalidate any use of the scrutinized schemes for cloud computing environments.

Rapid advances in wireless communications, hardware/software, and Internet technologies have contributed to an exponential growth in the number of users accessing the Internet using mobile, wearable or other Internet of Things devices. Identity-based signature schemes have been widely applied to enforce user authorization and validate user messages in mobile wireless networks. However, the user’s private key used to generate signatures is prone to leakage because the key is being stored on the mobile device. Several (t, n) threshold secret sharing schemes have been proposed to address the issue. One limitation is that the private keys in most of those schemes have to be recovered on a single device when generating signatures, so that the user who holds the device can sign any message without the participation of other users. To address the recovery limitation, we propose an efficient and secure two-party distributed signing protocol for the identity-based signature scheme in the IEEE P1363 Standard, where two users can generate a valid signature without recovering the whole private key. We formally prove its security under a nonstandard assumption. We also implemented our proposed protocol using the MIRACL Cryptographic software development kit. The experimental results obtained show that the time it takes for two general Android devices to generate a signature is about 709.53 ms.

We are venturing into the new era of Internet of Everything (IoE) where smaller and smarter computing devices have begun to be integrated into our environments.Despite its great potential, IoE also exposes devices to new security and privacy threats, such as the exposure of devices to attacks emanating from the Internet.User authentication, as a first line of defense, has been widely deployed to prevent unauthorized access, and, in many cases, it is also the primary line of defense.However, conventional user authentication mechanisms are not capable of dealing with this new situation.Firstly, it is not possible to directly utilize Internet-centric security solutions because of the inherently heterogeneous characteristics of IoE devices (e.g., the limited computational capabilities and power supply).Secondly, constrained devices may lack conventional user interfaces, such as keyboard, mice, and touch screen.In summary, the subjects of authentication in IoE are compelling yet largely unexploited, as well as unexplored topics that are in need of more intense interest and research from both the industry and academia.This special issue aims to provide a forum for researchers to publish and exchange their recent research ideas and results about authentication in IoE.In response to the call for papers, after rigorous review and careful revision, the following 5 papers were included in this special issue, ranging from novel understanding of traditional textual passwords, new cryptographic primitives for user authentication, and privacy-preserving biometric authentication to interesting contemporary key users authentication in microblogging.

As the most prevailing two-factor authentication mechanism, smart-card-based password authentication has been a subject of intensive research in the past two decades, and hundreds of this type of schemes have wave upon wave been proposed. In most of these studies, there is no comprehensive and systematical metric available for schemes to be assessed objectively, and the authors present new schemes with assertions of the superior aspects over previous ones, while overlooking dimensions on which their schemes fare poorly. Unsurprisingly, most of them are far from satisfactory-either are found short of important security goals or lack of critical properties, especially being stuck with the security-usability tension. To overcome this issue, in this work we first explicitly define a security model that can accurately capture the practical capabilities of an adversary and then suggest a broad set of twelve properties framed as a systematic methodology for comparative evaluation, allowing schemes to be rated across a common spectrum. As our main contribution, a new scheme is advanced to resolve the various issues arising from user corruption and server compromise, and it is formally proved secure under the harshest adversary model so far. In particular, by integrating “honeywords”, traditionally the purview of system security, with a “fuzzy-verifier”, our scheme hits “two birds”: it not only eliminates the long-standing security-usability conflict that is considered intractable in the literature, but also achieves security guarantees beyond the conventional optimal security bound.

Dozens of two-factor authentication schemes have been proposed to secure real-time data access in industrial wireless sensor networks (WSNs). However, more often than not, the protocol designers advocate the merits of their scheme, but do not reveal (or unconsciously ignoring) the facets on which their scheme performs poorly. Such lack of an objective, comprehensive measurement leads to the unsatisfactory “break-fix-break-fix” cycle in this research area. In this paper, we make an attempt toward breaking this undesirable cycle by proposing a systematical evaluation framework for schemes to be assessed objectively, revisiting two foremost schemes proposed by Wu et al. (2017) and Srinivas et al. (2017) to reveal the challenges and difficulties in designing a sound scheme, and conducting a measurement of 44 representative schemes under our evaluation framework, thereby providing the missing evaluation for two-factor schemes in industrial WSNs. This work would help increase awareness of current measurement issues and improve the scientific process in our field.

With the rapid development of the Internet of Things (IoT), a lot of sensitive information in our daily lives are now digitalized and open to remote access. The provision of security and privacy of such data would incur comprehensive cryptographic services and has raised wide concern. Hybrid signcryption schemes could achieve various kinds of cryptographic services (e.g., confidentiality, authenticity, and integrity) with much lower cost than the combination of separate traditional cryptographic schemes with each providing a single cryptographic service. Thus, hybrid signcryption schemes are very suitable for IoT environments where resources are generally very constrained (e.g., lightweight sensors and mobile phones). To ensure that the overall hybrid signcryption scheme provides adequate cryptographic service (e.g., confidentiality, integrity, and authentication), its parts of KEM (key encryption mechanism) and DEM (data encryption mechanism) must satisfy some security requirements. Chosen‐ciphertext attack (CCA) security has been widely accepted as the golden standard requirement for general encryption schemes. However, CCA security appears too strong in some conditions. Accordingly, Canetti et al. (CRYPTO 2003) proposed the notion of replayable CCA security (RCCA) for encryption schemes, which is a strictly weaker security notion than CCA security and naturally more efficient. This new security notion has proved to be sufficient for most existing applications of CCA security, e.g., encrypted password authentication. This is particularly promising for IoT environments, where security is demanding, yet resources are constrained. In this paper, we examine the RCCA security of the well‐known SKEM+DEM style hybrid signcryption scheme by Dent at ISC 2005. Meanwhile, we also examine the RCCA security of the Tag‐SKEM+DEM style hybrid signcryption scheme by Bjorstad and Dent at PKC 2006. We rigorously prove that a hybrid signcryption scheme can achieve RCCA security if both its SKEM part and its DEM part satisfy some security assumptions.

Personal Identification Numbers (PINs) are ubiquitously used in embedded computing systems where user input interfaces are constrained. Yet, little attention has been paid to this important kind of authentication credentials, especially for 6-digit PINs which dominate in Asian countries and are gaining popularity worldwide. Unsurprisingly, many fundamental questions (e.g., what's the distribution that human-chosen PINs follow?) remain as intact as about fifty years ago when they first arose. In this work, we conduct a systematic investigation into the characteristics, distribution and security of both 4-digit PINs and 6-digit PINs that are chosen by English users and Chinese users. Particularly, we, for the first time, perform a comprehensive comparison of the PIN characteristics and security between these two distinct user groups. Our results show that there are great differences in PIN choices between these two groups of users, a small number of popular patterns prevail in both groups, and surprisingly, over 50% of every PIN datasets can be accounted for by just the top 5%~8% most popular PINs. What's disturbing is the observation that, as online guessing is a much more serious threat than offline guessing in the current PIN-based systems, longer PINs only attain marginally improved security: human-chosen 4-digit PINs can offer about 6.6 bits of security against online guessing and 8.4 bits of security against offline guessing, and this figure for 6-digit PINs is 7.2 bits and 13.2 bits, respectively. We, for the first time, reveal that Zipf's law is likely to exist in PINs. Despite distinct language/cultural backgrounds, both user groups choose PINs with almost the same Zipf distribution function, and such Zipf PIN-distribution from one source (about which we may know little information) can be well predicted by real-world attackers by running Markov-Chains with PINs from another known source. Our Zipf theory would have foundational implications for analyzing PIN-based protocols and for designing PIN creation policies, while our security measurements provide guidance for bank agencies and financial authorities that are planning to conduct PIN migration from 4-digits to 6-digits.

Despite three decades of intensive research efforts, it remains an open question as to what is the underlying distribution of user-generated passwords. In this paper, we make a substantial step forward toward understanding this foundational question. By introducing a number of computational statistical techniques and based on 14 large-scale data sets, which consist of 113.3 million real-world passwords, we, for the first time, propose two Zipf-like models (i.e., PDF-Zipf and CDF-Zipf) to characterize the distribution of passwords. More specifically, our PDF-Zipf model can well fit the popular passwords and obtain a coefficient of determination larger than 0.97; our CDF-Zipf model can well fit the entire password data set, with the maximum cumulative distribution function (CDF) deviation between the empirical distribution and the fitted theoretical model being 0.49%~4.59% (on an average 1.85%). With the concrete knowledge of password distributions, we suggest a new metric for measuring the strength of password data sets. Extensive experimental results show the effectiveness and general applicability of the proposed Zipf-like models and security metric.

Despite over two decades of continuous efforts, how to design a secure and efficient two-factor authentication scheme remains an open issue. Hundreds of new schemes have wave upon wave been proposed, yet most of them are shortly found unable to achieve some important security goals (e.g., truly two-factor security) and desirable properties (e.g., user anonymity), falling into the unsatisfactory "break-fix-break-fix" cycle. In this vicious cycle, protocol designers often advocate the superiorities of their improved scheme, but do not illustrate (or unconsciously overlooking) the aspects on which their scheme performs poorly. In this paper, we first use a series of "improved schemes" over Xu et al.'s 2009 scheme as case studies to highlight that, if there are no improved measurements, more "improved schemes" generally would not mean more advancements. To figure out why the measurement of existing schemes is invariably insufficient, we further investigate into the state-of-the-art evaluation criteria set (i.e., Madhusudhan-Mittal's set). Besides reporting its ambiguities and redundancies, we propose viable fixes and refinements. To our knowledge, we for the first time show that there are at least seven different attacking scenarios that may lead to the failure of a scheme in achieving truly two-factor security. Finally, we conduct a large-scale comparative evaluation of 26 representative two-factor schemes, and our results outline the request for better measurement when assessing new schemes.

While trawling online/offline password guessing has been intensively studied, only a few studies have examined targeted online guessing, where an attacker guesses a specific victim's password for a service, by exploiting the victim's personal information such as one sister password leaked from her another account and some personally identifiable information (PII). A key challenge for targeted online guessing is to choose the most effective password candidates, while the number of guess attempts allowed by a server's lockout or throttling mechanisms is typically very small. We propose TarGuess, a framework that systematically characterizes typical targeted guessing scenarios with seven sound mathematical models, each of which is based on varied kinds of data available to an attacker. These models allow us to design novel and efficient guessing algorithms. Extensive experiments on 10 large real-world password datasets show the effectiveness of TarGuess. Particularly, TarGuess I~IV capture the four most representative scenarios and within 100 guesses: (1) TarGuess-I outperforms its foremost counterpart by 142% against security-savvy users and by 46% against normal users; (2) TarGuess-II outperforms its foremost counterpart by 169% on security-savvy users and by 72% against normal users; and (3) Both TarGuess-III and IV gain success rates over 73% against normal users and over 32% against security-savvy users. TarGuess-III and IV, for the first time, address the issue of cross-site online guessing when given the victim's one sister password and some PII.

To provide timely feedbacks to users, nearly every respectable Internet service now imposes a password strength meter (PSM) upon user registration or password change. It is a rare bit of good news in password research that well-designed PSMs do help improve the strength of user-chosen passwords. However, leading PSMs in the industrial world (e.g., Zxcvbn, KeePSM and NIST PSM) are mainly composed of simple heuristic rules and found to be highly inaccurate, while state-of-the-art PSMs from academia (e.g., probabilistic context-free grammar based ones and Markov-based ones) are still far from satisfactory, especially incompetent at gauging weak passwords. As preventing weak passwords is the primary goal of any PSM, this means that existing PSMs largely fail to serve their purpose. To fill this gap, in this paper we propose a novel PSM that is grounded on real user behavior. Our user survey reveals that when choosing passwords for a new web service, most users (77.38%) simply retrieve one of their existing passwords from memory and then reuse (or slightly modify) it. This is in vast contrast to the seemingly intuitive yet unrealistic assumption (often implicitly) made in most of the existing PSMs that, when user registers, a whole new password is constructed by mixing segments of letter, digit and/or symbol or by combining n-grams. To model users' realistic behaviors, we use passwords leaked from a less sensitiveservice as our base dictionary and another list of relatively strong passwords leaked from a sensitive service as our training dictionary, and determine how mangling rules are employed by users to construct passwords for new services. This process automatically creates a fuzzy probabilistic context-free grammar (PCFG) and gives rise to our fuzzy-PCFG-based meter, fuzzyPSM. It can react dynamically to changes in how users choose passwords and is evaluated by comparisons with five representative PSMs. Extensive experiments on 11 real-world password lists show that fuzzyPSM, in general, outperforms all its counterparts, especially accurate in telling apart weak passwords and suitable for services where online guessing attacks prevail.

Despite two decades of intensive research, it remains a challenge to design a practical anonymous two-factor authentication scheme, for the designers are confronted with an impressive list of security requirements (e.g., resistance to smart card loss attack) and desirable attributes (e.g., local password update). Numerous solutions have been proposed, yet most of them are shortly found either unable to satisfy some critical security requirements or short of a few important features. To overcome this unsatisfactory situation, researchers often work around it in hopes of a new proposal (but no one has succeeded so far), while paying little attention to the fundamental question: whether or not there are inherent limitations that prevent us from designing an “ideal” scheme that satisfies all the desirable goals? In this work, we aim to provide a definite answer to this question. We first revisit two foremost proposals, i.e. Tsai et al.'s scheme and Li's scheme, revealing some subtleties and challenges in designing such schemes. Then, we systematically explore the inherent conflicts and unavoidable trade-offs among the design criteria. Our results indicate that, under the current widely accepted adversarial model, certain goals are beyond attainment. This also suggests a negative answer to the open problem left by Huang et al. in 2014. To the best of knowledge, the present study makes the first step towards understanding the underlying evaluation metric for anonymous two-factor authentication, which we believe will facilitate better design of anonymous two-factor protocols that offer acceptable trade-offs among usability, security and privacy.

User authentication is an important security mechanism that allows mobile users to be granted access to roaming service offered by the foreign agent with assistance of the home agent in mobile networks. While security-related issues have been well studied, how to preserve user privacy in this type of protocols still remains an open problem. In this paper, we revisit the privacy-preserving two-factor authentication scheme presented by Li et al. at WCNC 2013. We show that, despite being armed with a formal security proof, this scheme actually cannot achieve the claimed feature of user anonymity and is insecure against offline password guessing attacks, and thus, it is not recommended for practical applications. Then, we figure out how to fix these identified drawbacks, and suggest an enhanced scheme with better security and reasonable efficiency. Further, we conjecture that under the non-tamper-resistant assumption of the smart cards, only symmetric-key techniques are intrinsically insufficient to attain user anonymity.