Paper 2022/1682

Interactive Authentication

Deepak Maram, Cornell University, Mysten Labs
Mahimna Kelkar, Cornell University
Ittay Eyal, Technion – Israel Institute of Technology

Authentication is the first, crucial step in securing digital assets like cryptocurrencies and online services like banking. It relies on principals maintaining exclusive access to credentials like cryptographic signing keys, passwords, and physical devices. But both individuals and organizations struggle to manage their credentials, resulting in loss of assets and identity theft. In this work, we study mechanisms with back-and-forth \textit{interaction} with the principals. For example, a user receives an email notification about sending money from her bank account and is given a period of time to abort. We define \emph{the authentication problem}, where a \emph{mechanism} interacts with a user and an attacker. A mechanism's success depends on the scenario---which credentials each principal knows. The \emph{profile} of a mechanism is the set of scenarios in which it succeeds. The subset relation on profiles defines a partial order on mechanisms. We bound the profile size and discover three types of novel mechanisms that are \emph{maximally secure}. We show the efficacy of our model by analyzing existing mechanisms and make concrete improvement proposals: Using ``sticky'' messages for security notifications, prioritizing credentials when accessing one's bank account, and using one of our maximal mechanisms to improve a popular cryptocurrency wallet. We demonstrate the practicality of our mechanisms by implementing the latter.

Note: Significantly improved HDFC analysis + writing.

Available format(s)
Publication info
key managementauthentication
Contact author(s)
sm2686 @ cornell edu
2024-03-01: last of 3 revisions
2022-12-03: received
See all versions
Short URL
Creative Commons Attribution


      author = {Deepak Maram and Mahimna Kelkar and Ittay Eyal},
      title = {Interactive Authentication},
      howpublished = {Cryptology ePrint Archive, Paper 2022/1682},
      year = {2022},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.