Paper 2014/135

Anonymous Two-Factor Authentication: Certain Goals Are Beyond Attainment

Ding Wang, Ping Wang, and Debiao He

Abstract

Despite a decade of intensive research, it still remains a challenge to design a practical dynamic id-based two-factor authentication scheme, for the designers are confronted with an impressive list of security requirements (e.g., resistance to mart card loss attack) and desirable attributes (e.g., local and secure password update). Dozens of solutions have been proposed, yet most of them are shortly found either unable to satisfy some security requirements or short of important features. To overcome this unsatisfactory situation, researchers often work around it in hopes of a new solution (but no one has succeeded so far), while paying little attention to the question: Whether or not there are inherent limitations (conflicts) that prevents us from designing an ideal scheme that satisfies all of these goals? In this work, we attempt to provide an answer to this question. We revisit two latest (and reprentative) proposals, i.e. Xie's scheme and Li's scheme, and explore some inherent conflicts and unavoidable trade-offs in designing such schemes. Our results highly indicate that, under the current widely accepted adversary model, certain goals are beyond attainment. To the best of knowledge, the present study makes the first step towards understanding the underlying evaluation metric for dynamic id-based two-factor authentication, which we believe will facilitate better design of two-factor protocols that offer acceptable trade-offs between usability, security and privacy.