Authentication Protocols Based on One-Time Passwords

Babkin, Sergey; Epishkina, Anna

doi:10.1109/eiconrus.2019.8656839

Cited by 13 publications

(12 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Besides, we compare MOTP with recent works, i.e., T/Key and SmartOTPs. We refer to [ 26 ] for the four properties of comparison, and Table 6 shows a property comparison between five schemes. + represents that the scheme supports the property, and − means that the scheme does not support it.…”

Section: Resultsmentioning

confidence: 99%

An Efficient Two-Factor Authentication Scheme Based on the Merkle Tree

Yin

Guo

et al. 2020

Sensors

View full text Add to dashboard Cite

The Time-based One-Time Password (TOTP) algorithm is commonly used for two-factor authentication. In this algorithm, a shared secret is used to derive a One-Time Password (OTP). However, in TOTP, the client and the server need to agree on a shared secret (i.e., a key). As a consequence, an adversary can construct an OTP through the compromised key if the server is hacked. To solve this problem, Kogan et al. proposed T/Key, an OTP algorithm based on a hash chain. However, the efficiency of OTP generation and verification is low in T/Key. In this article, we propose a novel and efficient Merkle tree-based One-Time Password (MOTP) algorithm to overcome such limitations. Compared to T/Key, this proposal reduces the number of hash operations to generate and verify the OTP, at the cost of small server storage and tolerable client storage. Experimental analysis and security evaluation show that MOTP can resist leakage attacks against the server and bring a tiny delay to two-factor authentication and verification time.

show abstract

Section: Resultsmentioning

confidence: 99%

An Efficient Two-Factor Authentication Scheme Based on the Merkle Tree

Yin

Guo

et al. 2020

Sensors

View full text Add to dashboard Cite

show abstract

“…They also often intersect with smart-card based technology [ 32 ] rather than being applied independently in a widely deployable manner for evolution of current paradigms. Various methods which have adopted hash-chains exist, including [ 33 , 34 , 35 ]. These proposals have largely implemented hash-chains for the purpose of producing one-time passwords as described above and detailed in [ 33 ], or for helping facilitate secure methods of peer-to-peer communication outside of centrally signed authorities [ 35 ].…”

Section: Related Work and Significance Of This Studymentioning

confidence: 99%

“…In [ 33 ], multiple hash chain protocols are compared next to typical hash authentication means. These include Lamport’s Hash Chain protocol, YSH protocol, the Bicakci Protocol, and the HOTP and TOTP protocols among others.…”

Section: Related Work and Significance Of This Studymentioning

confidence: 99%

“…These include Lamport’s Hash Chain protocol, YSH protocol, the Bicakci Protocol, and the HOTP and TOTP protocols among others. It was shown that protocols that used hash-chains, such as Lamport’s Protocol, were extremely resistant to eavesdropping and impersonation-based attacks [ 33 ]. Hash-chains proved to be notable in their resistance to these attacks.…”

Section: Related Work and Significance Of This Studymentioning

confidence: 99%

“…However, issues were present in many of these protocols; for example, almost all studied protocols only provided one-way authentication, rather than two-way. Those which did manage to implement two-way authentication suffered from other issues, such as high computational complexity [ 33 ]. Furthermore, not all schemes actually incorporated cryptographic security, some only provided logical protections.…”

Section: Related Work and Significance Of This Studymentioning

confidence: 99%

See 2 more Smart Citations

A Hybrid Dynamic Encryption Scheme for Multi-Factor Verification: A Novel Paradigm for Remote Authentication

Obaidat

Brown

Obeidat

et al. 2020

Sensors

View full text Add to dashboard Cite

A significant percentage of security research that is conducted suffers from common issues that prevent wide-scale adoption. Common snags of such proposed methods tend to include (i) introduction of additional nodes within the communication architecture, breaking the simplicity of the typical client–server model, or fundamental restructuring of the Internet ecosystem; (ii) significant inflation of responsibilities or duties for the user and/or server operator; and (iii) adding increased risks surrounding sensitive data during the authentication process. Many schemes seek to prevent brute-forcing attacks; they often ignore either partially or holistically the dangers of other cyber-attacks such as MiTM or replay attacks. Therefore, there is no incentive to implement such proposals, and it has become the norm instead to inflate current username/password authentication systems. These have remained standard within client–server authentication paradigms, despite insecurities stemming from poor user and server operator practices, and vulnerabilities to interception and masquerades. Besides these vulnerabilities, systems which revolve around secure authentication typically present exploits of two categories; either pitfalls which allow MiTM or replay attacks due to transmitting data for authentication constantly, or the storage of sensitive information leading to highly specific methods of data storage or facilitation, increasing chances of human error. This paper proposes a more secure method of authentication that retains the current structure of accepted paradigms, but minimizes vulnerabilities which result from the process, and does not inflate responsibilities for users or server operators. The proposed scheme uses a hybrid, layered encryption technique alongside a two-part verification process, and provides dynamic protection against interception-based cyber-attacks such as replay or MiTM attacks, without creating additional vulnerabilities for other attacks such as bruteforcing. Results show the proposed mechanism outperforms not only standardized methods, but also other schemes in terms of deployability, exploit resilience, and speed.

show abstract