Paper 2014/135

Anonymous Two-Factor Authentication in Distributed Systems: Certain Goals Are Beyond Attainment

Ding Wang, Debiao He, Ping Wang, and Chao-Hsien Chu


Despite two decades of intensive research, it remains a challenge to design a practical anonymous two-factor authentication scheme, for the designers are confronted with an impressive list of security requirements (e.g., resistance to smart card loss attack) and desirable attributes (e.g., local password update). Numerous solutions have been proposed, yet most of them are shortly found either unable to satisfy some critical security requirements or short of a few important features. To overcome this unsatisfactory situation, researchers often work around it in hopes of a new proposal (but no one has succeeded so far), while paying little attention to the fundamental question: whether or not there are inherent limitations that prevent us from designing an ``ideal'' scheme that satisfies all the desirable goals? In this work, we aim to provide a definite answer to this question. We first revisit two foremost proposals, i.e. Tsai et al.'s scheme and Li's scheme, revealing some subtleties and challenges in designing such schemes. Then, we systematically explore the inherent conflicts and unavoidable trade-offs among the design criteria. Our results indicate that, under the current widely accepted adversarial model, certain goals are beyond attainment. This also suggests a negative answer to the open problem left by Huang et al. in 2014. To the best of knowledge, the present study makes the first step towards understanding the underlying evaluation metric for anonymous two-factor authentication, which we believe will facilitate better design of anonymous two-factor protocols that offer acceptable trade-offs among usability, security and privacy.

Available format(s)
Cryptographic protocols
Publication info
Published elsewhere. Minor revision. IEEE Transactions on Dependable and Secure Computing
Two-factor authenticationUser anonymitySmart cardNon-tamper resistantSmart card loss attack.
Contact author(s)
wangdingg @ mail nankai edu cn
2014-09-11: last of 4 revisions
2014-02-24: received
See all versions
Short URL
Creative Commons Attribution


      author = {Ding Wang and Debiao He and Ping Wang and Chao-Hsien Chu},
      title = {Anonymous Two-Factor Authentication in Distributed  Systems: Certain Goals Are  Beyond Attainment},
      howpublished = {Cryptology ePrint Archive, Paper 2014/135},
      year = {2014},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.