Practical and Veritable Threshold Multi-Factor Authentication for Mobile Devices

Multi-factor authentication (MFA) is extensively employed in mobile applications to enhance security, including Internet of Vehicles, healthcare systems, smart homes, etc. Traditional MFA requires users to present specific factors, which can be inconvenient if certain factors are unavailable. To address this, $ (t, n) $-threshold MFA (T-MFA) allows users to select any $ t $ out of $ n $ registered factors for authentication. However, existing T-MFA solutions face four key issues: (i) reliance on $ n-1 $ devices, which may be impractical; (ii) susceptibility to denial of service when the mandatory factor fails; (iii) limited factor types, reducing user flexibility; and (iv) increasing client-side computational costs with higher $ t $. In this work, we propose a veritable $ (t, n) $-threshold multi-factor authenticated key exchange protocol that addresses these challenges. Utilizing oblivious programmable pseudorandom functions (OPPRF) as main tools, we eliminate dependence on multiple devices, mandatory factors, and restricted factor types, achieving what we called veritable. We present a new construction of batched OPPRF to reduce client-side costs from $ O(t) $ to $ O(1) $, with 2 exponentiations cost by the client and $ t+1 $ by the server. We implement it with JavaScript to validate its flexibility and efficiency, making it highly suitable for mobile device applications.