AUTHORS
Dr. Deepak Maram
Cornell Univ., USA
Mr. Mahimna Kelkar
Cornell Univ., USA
Dr. Ittay Eyal
Technion Univ., Israel
ABSTRACT
Authentication is the first, crucial step in securing digital assets like cryptocurrencies and online services like banking. It relies on principals maintaining exclusive access to credentials like cryptographic signing keys, passwords, and physical devices. But both individuals and organizations struggle to manage their credentials, resulting in loss of assets and identity theft. In this work, we study mechanisms with back-and-forth interaction with the principals. For example, a user receives an emailnotification about sending money from her bank account and is given a period of time to abort. We define the authentication problem, where a mechanism interacts with a user and an attacker. A mechanism’s success depends on the scenario—which credentials each principal knows. The profile of a mechanism is the set of scenarios in which it succeeds. The subset relation on profiles defines a partial order on mechanisms. We bound the profile size and discover three types of novel mechanismsthat are maximally secure. We show the efficacy of our model by analyzing existing mechanisms and make concrete improvement proposals: Using “sticky” messages for security notifications, prioritizing credentials when accessing one’s bank account, and using one of our maximal mechanisms to improve a popular cryptocurrency wallet. We demonstrate the practicality of our mechanisms by implementing the latter.
CCS CONCEPTS
- Security and privacy → Multi-factor authentication; Formal security models.
KEYWORDS
authentication, interactive protocols, synchronous networks
ACM Reference Format:
Deepak Maram, Mahimna Kelkar, and Ittay Eyal. 2024. Interactive MultiCredential Authentication. In Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security (CCS ’24), October 14–18, 2024, Salt Lake City, UT, USA. ACM, New York, NY, USA, 23 pages.
Full Text: https://doi.org/10.1145/3658644.3670378