Multi-factor authentication systems analyzed for cryptographic security features
Analyzing Multi-Factor Authentication Through Cryptographic Security Properties
Cryptography and Security
Summary
Authentication systems check who you are to keep accounts safe, often using things like passwords or fingerprints. Over time, these systems started combining several ways to confirm identity, called multi-factor authentication (MFA). The paper looks closely at how MFA setups stop attackers from reusing stolen info, known as replay attacks. The authors analyze cryptographic security properties to understand how well MFA protects users.
What this means in practice
- •For security engineers: Design multi-factor authentication systems that better prevent replay attacks using insights from cryptographic security analysis.
- •For identity management teams: Evaluate existing MFA solutions by analyzing their cryptographic properties to understand and improve their security posture.
Authors
Ryan Tipping, Yousef Tahboub, Krishna Bodige
Abstract
Modern authentication systems use cybersecurity techniques to validate the identity of the person (or applications acting on behalf of the person) as a primary defense against unauthorized access. While initially built around single mechanisms such as usernames/passwords, physical tokens, or biometrics, current systems have evolved into multi-factor authentication (MFA) platforms that combine multiple mechanisms. Among them, several focus on strategies that prevent replay attacks (i.e. the reuse of a component that could have been potentially compromised).