An Extensive Formal Analysis of Multi-factor Authentication Protocols

Abstract

Passwords are still the most widespread means for authenticating users, even though they have been shown to create huge security problems. This motivated the use of additional authentication mechanisms used in so-called multifactor authentication protocols. In this paper we define a detailed threat model for this kind of protocols: while in classical protocol analysis attackers control the communication network, we take into account that many communications are performed over TLS channels, that computers may be infected by different kinds of malwares, that attackers could perform phishing, and that humans may omit some actions. We formalize this model in the applied pi calculus and perform an extensive analysis and comparison of several widely used protocols-variants of Google 2-step and FIDO's U2F. The analysis is completely automated, generating systematically all combinations of threat scenarios for each of the protocols and using the PROVERIF tool for automated protocol analysis. Our analysis highlights weaknesses and strengths of the different protocols, and allows us to suggest several small modifications of the existing protocols which are easy to implement, yet improve their security in several threat scenarios.

Distributed Authentication Model for Secure Network Connectivity in Network Separation Technology

“…Multi-factor authentication is a method that uses a combination of two or more authentications [7][8][9]. The conventional single authentication method involves security threats through the simple leakage of personal information or malicious hacking [10,11].…”

ESSM: Formal Analysis Framework for Protocol to Support Algebraic Operations and More Attack Capabilities

“…In recent years, formal analysis has been widely applied to different types of protocol security analyses [1,2], including 5G authentication and key agreement (AKA) protocol [3,4], transport-layer security (TLS) version 1.3 [5,6], Signal Messaging Protocol [7], Secure Forwarding Protocols [8], and Multifactor Authentication Protocols [9]. eoretical research on the formal analysis is under way, and great progress has been made in observation equivalencies [10] and equality theory [11].…”

Multifactor Authentication Methods: A Framework for Their Comparison and Selection

“…All of the mentioned techniques belong to distinct authentication factors. An authentication factor is a piece of information that can be used to verify the identity of a user [9]. There are three main groups or factors of authentication techniques [10,11]: (i) knowledge-based, that is, based on something that the user knows, such as text passwords; (ii) possession-based, that is, based on something that the user possesses, such as smart cards; and (iii) inherence-based, that is, something that the user is, such as biometrics.…”