Paper 2022/1589
Cryptanalysis of a privacy-preserving behavior-oriented authentication scheme
Abstract
Continuous authentication has been proposed as a complementary security mechanism to password-based authentication for computer devices that are handled directly by humans, such as smart phones. Continuous authentication has some privacy issues as certain user features and actions are revealed to the authentication server, which is not assumed to be trusted. Wei et al. proposed in 2021 a privacy-preserving protocol for behavioral authentication that utilizes homomorphic encryption. The encryption prevents the server from obtaining sampled user features. In this paper, we show that the Wei et al. scheme is insecure regarding both an honest-but-curious server and an active eavesdropper. We present two attacks. The first attack enables the authentication server to obtain the secret user key, plaintext behavior template and plaintext authentication behavior data from encrypted data. The second attack enables an active eavesdropper to restore the plaintext authentication behavior data from the transmitted encrypted data.
Note: Preprint
Metadata
- Available format(s)
-
PDF
- Category
- Attacks and cryptanalysis
- Publication info
- Published elsewhere. SECRYPT 2022
- DOI
- 10.5220/0011141400003283
- Keywords
- Privacy-preserving authentication Homomorphic encryption Cryptanalysis
- Contact author(s)
-
sigurd @ nr no
baig @ nr no - History
- 2022-11-17: approved
- 2022-11-15: received
- See all versions
- Short URL
- https://ia.cr/2022/1589
- License
-
CC BY
BibTeX
@misc{cryptoeprint:2022/1589,
author = {Sigurd Eskeland and Ahmed Fraz Baig},
title = {Cryptanalysis of a privacy-preserving behavior-oriented authentication scheme},
howpublished = {Cryptology {ePrint} Archive, Paper 2022/1589},
year = {2022},
doi = {10.5220/0011141400003283},
url = {https://eprint.iacr.org/2022/1589}
}
