Anonymous Two-Factor Authentication in Distributed Systems: Certain Goals Are Beyond Attainment

Ding Wang, Debiao He, Ping Wang, Chao Hsien Chu

Research output: Contribution to journalArticlepeer-review

375 Scopus citations


Despite two decades of intensive research, it remains a challenge to design a practical anonymous two-factor authentication scheme, for the designers are confronted with an impressive list of security requirements (e.g., resistance to smart card loss attack) and desirable attributes (e.g., local password update). Numerous solutions have been proposed, yet most of them are shortly found either unable to satisfy some critical security requirements or short of a few important features. To overcome this unsatisfactory situation, researchers often work around it in hopes of a new proposal (but no one has succeeded so far), while paying little attention to the fundamental question: whether or not there are inherent limitations that prevent us from designing an "ideal" scheme that satisfies all the desirable goals? In this work, we aim to provide a definite answer to this question. We first revisit two foremost proposals, i.e. Tsai et al.'s scheme and Li's scheme, revealing some subtleties and challenges in designing such schemes. Then, we systematically explore the inherent conflicts and unavoidable trade-offs among the design criteria. Our results indicate that, under the current widely accepted adversarial model, certain goals are beyond attainment. This also suggests a negative answer to the open problem left by Huang et al. in 2014. To the best of knowledge, the present study makes the first step towards understanding the underlying evaluation metric for anonymous two-factor authentication, which we believe will facilitate better design of anonymous two-factor protocols that offer acceptable trade-offs among usability, security and privacy.

Original languageEnglish (US)
Article number6894170
Pages (from-to)428-442
Number of pages15
JournalIEEE Transactions on Dependable and Secure Computing
Issue number4
StatePublished - Jul 2015

All Science Journal Classification (ASJC) codes

  • Electrical and Electronic Engineering


Dive into the research topics of 'Anonymous Two-Factor Authentication in Distributed Systems: Certain Goals Are Beyond Attainment'. Together they form a unique fingerprint.

Cite this