# A Forward-secure Efficient Two-factor Authentication Protocol

arXiv: https://arxiv.org/abs/2208.02877 · HTML: https://mlsanity.com/paper/2208.02877/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 4 Aug 2022.

## Built on by (most cited first, 1 of 1)

- [Starlit: Privacy-Preserving Federated Learning to Enhance Financial Fraud Detection](https://mlsanity.com/paper/2401.10765/) (2024)

## Abstract (arXiv)

Two-factor authentication (2FA) schemes that rely on a combination of knowledge factors (e.g., PIN) and device possession have gained popularity. Some of these schemes remain secure even against strong adversaries that (a) observe the traffic between a client and server, and (b) have physical access to the client's device, or its PIN, or breach the server. However, these solutions have several shortcomings; namely, they (i) require a client to remember multiple secret values to prove its identity, (ii) involve several modular exponentiations, and (iii) are in the non-standard random oracle model. In this work, we present a 2FA protocol that resists such a strong adversary while addressing the above shortcomings. Our protocol requires a client to remember only a single secret value/PIN, does not involve any modular exponentiations, and is in a standard model. It is the first one that offers these features without using trusted chipsets. This protocol also imposes up to 40% lower communication overhead than the state-of-the-art solutions do.