Password file breaches expose billions of credentials and enable notorious credential stuffing attacks, where the attacker exploits the leaked password to maliciously log into the victim’s applications. To mitigate this threat, compromised credential checking (C3) services, like HaveIBeenPwned (the first C3 service) and Google Password Checkup proposed by Thomas et al. (USENIX Security’19) are widely used. A C3 service allows clients to query whether their credentials (username or/and password) are exposed, without revealing the password. However, in existing C3 services, clients may receive unreliable query results because they all assume that the C3 server is fully trusted, and overlook a crucial security property: the verifiability of query results. For example, a malicious C3 server may respond that an exposed account has not been breached. To fill this gap, we propose the notion of verifiable C3 service (VerC3 for short), which equips the current C3 service with the verifiability of query results. The key challenge lies in how to determine whether the C3 server has honestly responded to the client’s query and faithfully updated the breached password records.We reveal that the verifiability problem inherently cannot be solved in the single-server setting. Based on this finding, our VerC3 is built in the two-server setting. Breached password records are signed by the data owner and stored by the online server. We define VerC3 as a suite of protocols that meet 11 desirable properties and build a simple, secure, and efficient instance, called Have I Really Been Pwned (HIRBP). We develop a prototype of HIRBP to show its practicality: It takes the client 136.91 ms to finish a query on a common PC, with a total bandwidth of 86 KB. In particular, we provide so far the most comprehensive empirical evaluation of C3 services against both online guessing attacks and breach extraction attacks, using 1.4 billion real-world passwords. We believe this work takes a substantial step toward reliable C3 service.

In the era of Internet of Things (IoT), the data generated by a large number of devices usually relies on cloud servers for processing, but the traditional cloud server architecture has problems such as high latency and bandwidth bottlenecks. Mobile edge computing (MEC) effectively enhances the real-time data processing capability by sinking computing power to the network edge. However, the heterogeneity of MEC devices brings complex security challenges, such as risks of information leakage and privacy infringement, and it is urgent to build an efficient identity authentication mechanism to ensure system security. Nevertheless, the existing identity-based and physical unclonable function (PUF)-based identity verification protocols show limitations, such as an inability to ensure anonymity and nonreproducibility, vulnerability to the impact of challenge response pairs on leakage, and susceptibility to various attacks caused by temporary secret leakage and key leakage. To address these issues, this article proposes a PUF-enhanced lightweight three-factor authentication and key agreement protocol named PUF3FAka tailored for MEC environments. For the first time, a cross-ring oscillator (CRO)-PUF resilient to machine learning attacks is integrated with a fuzzy-verification mechanism into a three-factor authentication framework. Without storing any challenge-response pairs (CRPs) on the server side, the protocol eliminates the risk of CRP leakage attacks root. The design satisfies ten edge-computing security evaluation criteria and withstands various attacks such as offline password guessing, ephemeral-secret leakage attacks, and key-compromise impersonation attacks. Performance evaluations demonstrate that PUF3FAka outperforms existing protocols by 82.86% in computational cost and 96.7% in communication overhead on average, making it well-suited for resource-constrained IoT terminals and edge servers.

Multi-factor authentication (MFA) has been widely applied in various fields, including smart homes, autonomous driving, and mobile communication. Although a number of MFA schemes with different security goals and properties have been proposed, most of them are found to pay little attention to password forgetting and loss issues, which may lead to the permanent loss of the account. Additionally, little effort has been devoted to designing MFA schemes with fine-grained access control to perform authentication flexibly. Therefore, the above issues raise the question of "how to construct a MFA scheme with dynamic password recovery and fine-grained access control?". In this paper, we, for the first time, introduce attributes and a dynamic password recovery method to propose a multi-factor authentication scheme with dynamic password recovery and fine-grained control, named MFA-DPRF. In MFA-DPRF, authentication succeeds only when a user provides both a valid password and a set of attributes satisfying the specified access policy, thereby enabling fine-grained access control. Furthermore, a dynamic password recovery method based on secret questions and the secret sharing technique has been designed to address password forgetting and loss issues. Users can not only recover the original password locally, but also update secret values such as security questions to enhance security. The security of MFA-DPRF can be reduced to the computational Diffie-Hellman problem under the Random Oracle Model. We also analyze the security of MFA-DPRF in the universally composable framework to ensure composable security. The informal analysis proves that MFA-DPRF is secure against known attacks. Compared with the state-of-the-art works, performance analysis shows that MFA-DPRF is superior in security and efficiency.

Password-authenticated key exchange (PAKE) protocols tackle the important problem of how to enable two parties, who share a low-entropy password, to establish a cryptographically strong session key for secure data communication. Although considerable research efforts have been devoted to designing hundreds of PAKE protocols, to the best of our knowledge, there have been few systematic reviews. In this work, we provide a comprehensive overview of PAKE research. We first propose a list of 13 desirable properties of PAKE protocols in terms of security and usability, enabling PAKE protocols to be systematically rated across a common spectrum. We then provide a taxonomy for PAKE protocols, and classify them into seven types according to their underlying design strategies. For each type, we investigate the inner working mechanisms of various representative protocols, and identify their pros, and cons. We further classify existing PAKE protocols from five other key perspectives (i.e., symmetry, number of participants, hardness assumptions, security goals, and round complexity) and review their development history under each classification, aiming at providing an in-depth and thorough understanding of the status quo of PAKE research. Based on 13 properties and six perspectives, we conduct a large-scale comparative evaluation of 71 representative PAKE protocols in a systematic manner. Finally, we highlight a few potential directions for the future design of PAKE protocols.

Password managers (PMs) are highly recommended by security standards and experts to assist users in managing their login credentials. In response to the increasingly serious threat of credential leakages, more and more leading PMs start to leverage third-party compromised credential checking (C3) services, aiming to help users check whether their credentials in the vault have been leaked. C3 services (e.g., Have I Been Pwned) generally maintain extensive datasets of leaked credentials and provide APIs for compromised credential checking. Queries to C3 services comply with $k$-anonymity security properties, designed to limit information leakage about credentials. However, these queries are deterministic, indicating that identical credentials consistently generate the same query. We find that PMs exhibit identifiable query patterns, such as automatically checking all credentials associated with a single user, and periodically checking users' credentials. We, for the first time, demonstrate that the query patterns of PMs can be effectively exploited by an honest-but-curious C3 server to identify PM users and extract credentials. We propose a novel credential extraction attack framework based on query pattern leakage to C3 services, and implement attack algorithms targeting PMs' query patterns. Our empirical attacks successfully identify $\mathbf{8 3. 0 4 \%} \boldsymbol{\sim} \mathbf{8 7. 5 9 \%}$ of PM users. Furthermore, this query pattern leakage enables attackers to significantly increase the password guessing success rates by $15.42 \% \sim 30.43 \%$ with one guess, compared to attacks without leveraging this leakage. We evaluate 14 leading PMs, and find that 10 are vulnerable to our attacks. We have disclosed our findings along with recommendations to affected vendors for being aware of (and mitigating) these vulnerabilities.

As the first defense for system security, multi-factor authentication has been deployed in various security-critical applications with mobile devices (e.g., smart grid, e-health, and Industrial Internet of Things). After three decades of intensive research, the question of how to design a secure multi-factor authentication protocol is still unsettled. In recent years, the ephemeral secret leakage (ESL) attack, originally used to cryptanalyze the authenticated key exchange (AKE) schemes, has been introduced into the field of multi-factor authentication. Considerable efforts have been made to resist the ESL attack, and it has also been listed as one of the common attacks that a secure multi-factor authentication scheme should resist. As one of the capabilities of an ESL attacker, she can obtain the ephemeral secret of public-key techniques adopted by multi-factor authentication schemes. However, public-key techniques have been proven indispensable for password-based protocols to resist offline password guessing attacks. Now a question arises: Is it possible to build a secure password-based multi-factor authentication protocol resistant to ESL attacks and offline password guessing attacks? This paper aims to answer this fundamental question. More specifically, we first revisit 161 password-based multi-factor authentication schemes involving ESL attacks, and present a comprehensive cryptanalysis of three representative protocols. Then, we reveal the relationship between ESL attacks and the failure of each representative protocol. Finally, we conduct a large-scale comparative measurement of 41 representative multi-factor authentication schemes. Comparison results show that all these authentication schemes considering ESL attacks do not perform better than those that do not. The above comprehensive approach leads to the key insight: ESL attacks are unsuitable/unrealistic for evaluating password-based multi-factor authentication schemes, because the leaked ephemeral secrets will unavoidably lead to offline password guessing attacks, i.e., the security of all these 161 schemes would be compromised. We further conclude that employing hardware-protected devices (e.g., smart cards) as possession-based authentication factors can resist ESL attacks, because the premise for ESL attackers to obtain ephemeral secrets no longer exists. We believe that our findings are general and also provide valuable guidance for defending against ESL attacks against multi-factor authentication protocols for non-mobile device environments as well.

Mobile devices enable the widespread adoption of One-Time Passwords (OTPs) as a crucial component of Two-Factor Authentication (2FA). The impact of OTP leakage is often considered less severe than that of static passwords. However, existing OTP standards, such as S/key, HOTP, and TOTP are vulnerable to key-compromise impersonation attacks, desynchronization attacks, and "small n" attacks. These vulnerabilities allow adversaries to bypass 2FA by exploiting pre-shared symmetric keys once either the device or the server is compromised. Furthermore, asymmetric (chain-based) OTP schemes incur high computational overhead and require periodic initialization, which limits their usability. In this work, we propose HP-OTP, a challenge-response OTP scheme that achieves password hardening without modifying password-OTP implementation architectures. Password hardening on the device side allows the server to store only a non-reversible verification credential used to generate challenges. The device's response OTP integrates the candidate password, possession factor, and a random salt. By redefining OTPs in 2FA from a standalone possession factor to a joint function of the password and the device, HP-OTP prevents adversaries from bypassing the possession factor or exploiting compromises of either the device or the server. Comprehensive security and performance evaluation results demonstrate the security and efficiency of HP-OTP, with verification taking less than 5 milliseconds.

Password creation policy designs (PCPDs) are the design of site interfaces for user password registration. Much attention has been paid to the security of password policies, but there is a lack of research on the presentation of PCPDs (i.e., password rule (PR), password registration error message (PREM), and password strength meter (PSM)). To fill this gap, we, for the first time, evaluate the user-friendliness of PCPDs across 163 Chinese and 202 U.S. websites. We define two key criteria for PCPD user-friendliness: friendly timing and friendly explanation. Our results present a concerning picture: only 8.6

Honeywords are plausible-looking decoy passwords associated with each user's real password to timely detect password leakage. The more indistinguishable the honeywords are, the more secure a honeyword scheme is. However, honeyword schemes that externally generate honeywords can only approximate, but not equate, the distribution of user-chosen passwords, so they are unlikely to achieve the ideal indistinguishability. To address this issue, internally sampled honeyword schemes that sample honeywords from other users' passwords have been proposed. In this work, we first reveal two critical security and two critical usability flaws in existing internally sampled honeyword schemes, i.e., Honeyindex (TDSC'16) and Superword (COSE'21). We then formalize a generic framework for sound internally sampled honeyword schemes, and propose variants for both Honeyindex and Superword. To principally evaluate the security of our framework, we propose Bayesian and intersection attack theories leading to attackers' optimal distinguishing strategies, and evaluate them under three major attacker models each with varied capabilities (e.g., using leaked datasets and users' personal information). Evaluation results show that, when 40 sweetwords are associated with each user (as recommended at IEEE S&P'22), with only one guess per account, the basic attacker's success rate can reach 3.82%-4.12%, and she can identify 4.31%-5.04% of all real passwords with 10(4) honeyword login attempts, breaking the ideal 2.50%(= 1/40) security. Two more advanced attackers can identify 18.6%similar to 44.8% and 20.6%similar to 43.6% of all real passwords in 10(4) honeyword login attempts, respectively. When multiple password files are available, the intersection attack alone identifies 18.3%-18.6% of real passwords. We also explore the impacts of denial-of-service attacks. In all, this work reveals the inherent insecurity of internally sampled honeyword schemes.

Behavioral biometrics based continuous authentication has been proven to be an effective supplement to traditional one-time authentication schemes ( like passwords), and it can continuously authenticate users throughout the session. Currently, most continuous authentication models leverage deep learning techniques to learn smartphone users' behavioral patterns from behavioral biometric data, and have made remarkable progress. However, training deep learning based continuous authentication models requires enormous computing power, which leads to resource-constrained mobile platforms relying on powerful cloud servers. Cloud servers need access to behavioral biometric data for training and inference, as this may raise privacy concerns. Existing deep learning based continuous authentication schemes pay more attention to authentication performance, but ignore the protection of behavioral biometric data. To solve this issue, we present a privacy-preserving continuous authentication scheme based on secret sharing secure multi-party computation (MPC). More specifically, we secretly share behavioral biometric data among two cloud servers that train continuous authentication systems on joint data using two-party computation (2 PC) without compromising data privacy. Further, we evaluate the practical feasibility of our proposed privacy-preserving scheme on two realistic privacy-preserving continuous authentication models, which are constructed with deep learning and traditional machine learning techniques, respectively. Extensive experiments demonstrate the effectiveness of our two privacy-preserving continuous authentication models.

Keystroke dynamics-based authentication is a promising approach to enhance the security of personal identification number (PIN)-based authentication systems for mobile devices. While its effectiveness has been extensively studied, due to the limitations on the number of samples users can provide, most research struggles with the trade-off between system performance and user experience. Additionally, little effort has been devoted to quantifying the security of PIN keystroke dynamics. In this paper, we present StrokePIN, a user-friendly and efficient authentication system that utilizes multi-modality data. Specifically, we leverage a few-shot learning technique, called Siamese Network, which enables lightweight deployment of the system without retraining. To evaluate StrokePIN, we design a set of experiments and collect two new multi-modality datasets of keystroke dynamics of 20 PINs from 116 users. These datasets are the only publicly available resources of their kind to date, and we have made them accessible online. Furthermore, we quantify the security of keystroke dynamics of PINs with entropy, revealing its security boundaries. The evaluation results show that compared to the baselines, StrokePIN achieves state-of-the-art performance with False Acceptance Rate (FAR) of 2.2% and False Rejection Rate (FRR) of 1.9% on unseen users. For unseen PINs, StrokePIN achieves an FAR of 2.6% and an FRR of 1.4%. Additionally, by dynamically updating the template library, StrokePIN can mitigate the impact of user behavior drift over time, achieving the performance with FAR of 8.3% and FRR of 0.4%. Our security analysis results indicate that keystroke dynamics can provide 4.03-5.83 bits of security against 3 to 10 online guessing attacks.

Rail transportation has emerged as a critical component of modern land transportation. With the development of informatization and intelligence, rail control systems have shifted from traditional closed environments to open networked environments. While interconnectivity offers operational benefits, it also exposes systems to severe security risks. As a safety-critical infrastructure, train operations rely on robust security mechanisms, among which user access authentication and train handover authentication are indispensable. However, despite the considerable research devoted to the latter, the former has been largely neglected. Moreover, although industry standards emphasize the deployment of multi-factor authentication (MFA) in industrial control systems or railway systems, no practical MFA scheme tailored for rail control systems has been developed. This gap stems from two challenges: (1) The inherent difficulty of designing protocols that can simultaneously withstand powerful adversaries and satisfy multiple security goals; (2) The deployment complexities arising from the heterogeneous, distributed, and large-scale nature of rail control systems, together with the large number of concurrently operating subsystems. To address these challenges, this paper analyzes two state-of-the-art MFA protocols and shows that neither ensures multi-factor security nor forward security. We then propose the first MFA scheme for rail control systems, built on a wireless sensor network architecture, and prove its security within the universal composability framework. A comparative evaluation with 68 representative MFA schemes reveals shows that our protocol achieves strong security. Furthermore, experiments performed on a laptop with an AMD Ryzen 7 5800H processor validate the high efficiency of the proposed scheme.

More and more sensitive data is made online, and even when the data is encrypted on the server, adversaries who compromise the server can obtain the decryption key and thus decrypt the data, because the key is generally stored on the same server as the data. Password Hardening (PH) encryption introduces an additional security layer by incorporating an external PH server to restrict unauthorized decryption. However, leading PH encryption schemes (at USENIX SEC'18 and ACM CCS'20) suffer from substantial encryption/decryption inefficiency, making them unsuitable for large-scale data processing. Additionally, these schemes still have privacy shortcomings, as the external PH server can infer user habits by learning authentication results. For the first time, we propose a brand-new PH encryption scheme named HPHE and a hash-based puncturable pseudorandom function, which together form a hybrid PH encryption architecture. The architecture is extensible to other PH schemes and avoids key reuse by deriving high-entropy keys to achieve one-data-one-key. Compared with non-hybrid original PH schemes, HPHE achieves at least a 61% improvement in the efficiency of interactive PH encryption/decryption. In one-data-one-key scenarios, HPHE achieves approximately 450 times higher encryption/decryption efficiency than original PHE (USENIX SEC'18) by replacing multi-round interaction with key derivation. Additionally, HPHE achieves irrecoverable secure deletion and access restrictions by puncturing keys. For the first time, the novel construction of our HPHE achieves the Hiding of password verification results in PH. In addition, we formally define the Privacy security attributes in PH encryption and show that HPHE satisfies the strongest security guarantees. This work extends PH encryption to efficient large-scale data processing and more comprehensive privacy protection.

Ferroelectric field-effect transistors (FeFETs) integrating logic and memory at the single-device level can help close the gap between processor speed and memory bandwidth. Existing FeFETs, based on ferroelectric oxides with silicon-or oxide-based channels, are unsuitable for high-temperature environments like avionics, space exploration, and energy harvesting. Scandium aluminum nitride (ScAlN), known for its thermal stability at up to 1,100 degrees C and compatibility with GaN platforms, provides a viable alternative. This study presents ScAlN/AlGaN/GaN high-electron-mobility transistors (HEMTs) with enhanced logic-memory performance: an on-off current ratio of >108, an on current of 474 mA/mm, transconductance of 140 mS/mm, and a memory window of similar to 4 V. The devices demonstrate endurance over 300 direct-current (DC) switching cycles, with retention exceeding 10 years and multi-bit capability at room temperature. The devices also maintain stable performance at 250 degrees C and remain functional at 350 degrees C.

Behavioral biometrics-based continuous authentication has proven to be an excellent supplement to one-time authentication schemes that applies behavioral biometrics to authenticate smartphone users' identities throughout the session. However, it still has two key issues that need to be addressed: 1) Due to behavioral biometrics from attackers are not available a priori, continuous authentication models should be trained only with normal samples in an unsupervised manner rather than treated as binary or multi-class classification tasks; 2) Differences in behavioral biometrics between attackers and legitimate users are fine-grained, it is challenging to extract rich semantic information to model users' behavioral patterns. To fill this gap, we propose a lightweight latent representation masked one-class autoencoder, which is trained only with legitimate users' behavioral biometrics. It consists of two parts: masked latent representation generator (MLRG) and Reconstructor. First, we apply the MLRG to generate discriminative latent representation with low dimension and then as a mask to cover important parts of the latent representation generated from the Reconstructor. Second, we apply the Reconstructor to reconstruct input based on masked latent representation. Experimental results demonstrate that our approach achieves superior authentication performance of 0.68% EER, 0.94% EER, 2.14% EER, and 1.87% EER on four datasets, respectively.

Trusted relay quantum key distribution networks (TR-QKDNs) have emerged as one of the most practical solutions for implementing large-scale QKDNs. The development of efficient routing algorithms is crucial to ensure adaptability to diverse network parameters and topologies. However, current approaches suffer from multiple limitations, including insufficient consideration of key influencing factors, excessive reliance on manually configured parameters, and scalability bottlenecks caused by the exponential complexity of classical algorithms. In this paper, we propose a quantum reinforcement learning-based routing algorithm, named hybrid quantum deep deterministic policy gradient (HQ-DDPG) that integrates a custom-designed quantum neural network (QNN) with the deep deterministic policy gradient (DDPG), to intelligently balance multiple influencing factors and dynamically optimize routing decisions in TR-QKDNs. To reduce computational complexity, we further utilize a quantum single-source shortest path (QSSP) algorithm to compute the optimal routing path. Training results demonstrate that the proposed HQ-DDPG outperforms DDPG in terms of performance metrics, achieving nearly double the training convergence speed while reducing resource requirements by approximately 45 times and exhibiting superior network expressiveness. In typical network topology tests, the proposed algorithm consistently maintains a quantum key delivery ratio above 91.35% under high-load demand, significantly surpassing both DDPG and optimized link state routing (OLSR). Finally, leveraging distributed quantum computing, the proposed QNN enables efficient solutions for large-scale TR-QKDN problems with fewer quantum resources.

One-Time Passwords (OTPs) play a crucial role in Two-Factor Authentication (2FA) and Multi-Factor Authentication (MFA) by adding an additional layer of security. OTPs effectively reduce the risk of static passwords being intercepted and reused. Nevertheless, both academic schemes and industrial solutions face security threats stemming from server/device compromises and OTP factor forgery. Chain-based asymmetric OTP schemes are a promising approach to addressing the problem of server compromise but still face threats from device compromise and pre-generated chain leakage. We emphasize that since devices directly store the OTP seed, OTP authentication is essentially equivalent to verifying device possession. This means that in existing OTP schemes, OTP forgery and device compromise remain prevalent and difficult to overcome. In this work, we propose a brand new scheme to address OTP factor forgery and server/device compromises. For the first time, our scheme constructs a tightly coupled architecture between the password factor and the OTP factor. The OTP seed is derived from a password and a device-stored salt, preventing OTP seed extraction and OTP forgery even in the event of a device compromise. Through the integration of "honeywords" with the tightly coupled OTP architecture, the server stores decoy OTP seeds generated by decoy passwords, providing resistance against server compromises and partial password guessing from devices. We conduct a comprehensive evaluation of our OTP schemes. The computational overhead is correlated with the number of honeywords, and with the recommended set size of 20, the total verification overhead is approximately 0.24 ms. Additionally, we propose formal security properties and application metrics, and rigorously prove our scheme's resistance against server/device compromise attacks and guessing attacks. Our scheme is the first to achieve comprehensive OTP security with low overhead.