TWO-FACTOR AUTHENTICATION PROTOCOL IN ACCESS CONTROL SYSTEMS
DOI:
https://doi.org/10.20535/2411-2976.22023.17-25Keywords:
authentication, zero-knowledge proof, cryptographic protocol, biometric cryptosystems, elliptic curve, supersingular elliptic curve, non-supersingular elliptic curve, elliptic curve discrete logarithm problemAbstract
Background. To ensure the protection of the biometric access control system used in unsecured communication channels, it is necessary to exclude the storage and transfer, transfer of biometric data as well as sequences generated on their basis. The paper proposes a cryptographic protocol of two-factor authentication with the zero-knowledge over the extended field GF(2m) on elliptic curves using biometric data and the private key of the user.
Objective. The aim of the article is to develop a cryptographic protocol for zero-knowledge two-factor authentication based on elliptic curves using biometric data and the user’s private key, which allows increasing cryptographic strength and reducing the duration of the authentication process.
Methods. The process of implementing zero-knowledge proof protocols is as follows: one user (proofer) can convince another user (verifier) that he has some secret without disclosing the secret itself.
Results. A cryptographic protocol for two-factor authentication with zero-knowledge over the extended field GF(2m) of elliptic curves using user biometric data is proposed, which significantly reduces the size of the protocol parameters and increases cryptographic strength (computational complexity of the breaking). There is no leakage of private key information and biometric data of the user during the execution of the zero-knowledge proof protocol.
Conclusions. The implementation of a cryptographic protocol with zero-knowledge proof two-factor authentication based on elliptic curves allows significantly reducing the size of protocol parameters and increasing the cryptographic strength (computational complexity of the breaking).
References
Goldwasser S., Micali S., Rackoff C. Knowledge Complexity of Interactive Proofs. STOC '85: Proceedings of the seventeenth annual ACM symposium on theory of computing. December 1985, pp. 291–304, https: //doi.org/10.1145/22145.22178
Goldwasser S., Micali S., Rackoff C. The knowledge complexity of interactive proof systems // SIAM Journal on Computing / M. Sudan – SIAM, 1989. Vol. 18, Iss. 1. pp. 186–208, https: //doi.org/ 10.1137/0218012
ISO/IEC 9798-5:2009. Information technology – Security techniques – Entity authentication – Part 5: Mechanisms using zero-knowledge technique. // Retrieved from: https://www.iso.org/standard/ 50456.html
Onatskiy A.V., Garova O.V. Cryptographic authentication protocol zero-knowledge secret on elliptic curves using public keys and random messages. Digital technologies. Odesa: ONAZ named after O.S. Popova, 2019. Issue 26. pp. 16–23.
Menezes A., van Oorschot P., Vanstone S. Handbook of Applied Cryptography. CRC Press, 1996. – 816 p.
Stavroulakis P., Stamp M. Handbook of Information and Communication Security. Berlin: Springer-Verlag, 2010. – 863 p.
Feige U., Fiat A., Shamir A. Zero knowledge proofs of identity. Journal of Cryptology, 1988. Vol. 1, pp. 77–94.
Fiat A., Shamir A. How to prove yourself: Practical solutions to identification and signature problems. Proc. Crypto '86, A.M. Odlyzko, Ed., Lecture Notes in Computer Science, 1987. Vol. 263. Advances in Cryptology, Berlin, Springer-Verlag, pp. 186–194.
Guillou L.C., Quisquater J.-J. A practical zero-knowledge protocol fitted to security microprocessor minimizing both transmission and memory. Proc. Eurocrypt '88, C.G. Günther, Ed., Lecture Notes in Computer Science, 1988. Vol. 330. Advances in Cryptology, Berlin, Springer-Verlag, pp. 123–128.
Schneier B. Applied Cryptography: Protocols, Algorithms and Source Code in C: 20th Anniversary Edition. Wiley, 2015. – 784 p.
Hankerson D., Menezes A., Vanstone S., Hankerson D. Guide to Elliptic Curve Cryptography. Springer-Verlag, 2004. – 358 p.
Horbenko I. D., Horbenko Yu. I. Applied cryptology. Theory. Practice: a monograph, Kharkiv: "Fort" Publishing House, 2012. - 880 p.
AVISPA. // Retrieved from: https://www.avispa-project.org/
Security Protocol Animator. // Retrieved from: https://www.irisa.fr/celtique/genet/ span/
FIPS 186-4. // Retrieved from: https://nvlpubs.nist. gov/nistpubs/FIPS/NIST.FIPS. 186-4.pdf
SEC 2: Recommended Elliptic Curve Domain Parameters. // Retrieved from: https://www.secg.org/ SEC2-Ver-1.0.pdf
DSTU 4145-2002. // Retrieved from: https://uk. wikipedia.org/wiki/ДСТУ_4145-2002
