On the design of Survivable Distributed Passwordless Authentication and Single Sign-On

Luca Ferretti; Federico Magnanini; Mauro Andreolini; Mattia Trabucco; Michele Colajanni

Paper 2026/028

On the design of Survivable Distributed Passwordless Authentication and Single Sign-On

Luca Ferretti

, University of Modena and Reggio Emilia

Federico Magnanini, University of Modena and Reggio Emilia

Mauro Andreolini, University of Modena and Reggio Emilia

Mattia Trabucco, University of Modena and Reggio Emilia

Michele Colajanni, University of Bologna

Abstract

Single Sign-On (SSO) protocols allow an identity provider to authenticate users and report the outcome by issuing identity attestations. Recent attacks show that breaching the identity provider infrastructure enables adversaries to issue arbitrary identity attestations and impersonate users. Survivable SSO protocols limit the risks of similar intrusions, but they have only been defined for password-based authentication, inheriting their limitations against powerful attacks such as credential phishing. While phishing-resistant passwordless authentication protocols have been standardized, they are not designed to guarantee intrusion tolerance. We initiate the research for Survivable Passwordless SSO (SPS) and propose a modular approach which includes the novel definition of Survivable Passwordless Challenge-response (SPC) protocols for authentication as a sub-routine of SSO. We give the first frameworks and game-based security definitions both for SPC and SPS which capture both novel attack classes, such as session injection attacks in a decentralized setting, and existing but not yet formalized attack classes, such as detection of cloned authenticators. The design of the models includes novel strategies to capture proactive security in survivable protocols within security definitions and to compose authentication and SSO through a modular approach. Our strategies and models may also be applied with minor modifications to non-survivable protocols, possibly providing a novel approach to assess the security of existing SSO protocols.

Note: The revision fixes an error within the Clone routine of Security Experiment 1.

Metadata

Available format(s): PDF
Category: Cryptographic protocols
Publication info: Published elsewhere. 39th IEEE Computer Security Foundations Symposium
Keywords: Authentication Challenge-response Single Sign-on Passwordless Proactive security Distributed protocols FIDO OIDC
Contact author(s): luca ferretti @ unimore it
mauro andreolini @ unimore it
mattia trabucco @ unimore it
michele colajanni @ unibo it
History: 2026-03-13: last of 2 revisions; 2026-01-07: received; See all versions
Short URL: https://ia.cr/2026/028
License: CC BY

BibTeX

@misc{cryptoeprint:2026/028,
      author = {Luca Ferretti and Federico Magnanini and Mauro Andreolini and Mattia Trabucco and Michele Colajanni},
      title = {On the design of Survivable Distributed Passwordless Authentication and Single Sign-On},
      howpublished = {Cryptology {ePrint} Archive, Paper 2026/028},
      year = {2026},
      url = {https://eprint.iacr.org/2026/028}
}