Efficient Biometric-Based Two-Factor AKE Scheme Against Malicious Adversaries

With a two-factor Authenticated Key Exchange (AKE) scheme, a client can use two authentication factors to help him/her set up a shared session key with a server. Taking biometric features as one factor makes the two-factor AKE not only have double-insurance security but also enjoy convenience. We design a framework of constructing a biometric-based two-factor AKE scheme <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\textsf {AKE}_{\textsf {2FA}}$</tex-math></inline-formula> from an IND-CPA secure KEM and a one-way CCA secure KEM. The resulting <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\textsf {AKE}_{\textsf {2FA}}$</tex-math></inline-formula> construction has three rounds and achieves both explicit authentication and perfect forward security in the Random Oracle (RO) model. Compared with other biometric-based two-factor AKE schemes, our <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\textsf {AKE}_{\textsf {2FA}}$</tex-math></inline-formula> supports better security since our security notions cover database leakage, robustness of two factors and KCI attacks. By plugging in Kyber in the building block of KEM, we immediately obtain a three-round Kyber-based <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\textsf {AKE}_{\textsf {2FA}}$</tex-math></inline-formula> scheme based on the module-LWE assumption. Our Kyber-based <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\textsf {AKE}_{\textsf {2FA}}$</tex-math></inline-formula> is very efficient ( <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$27.25\times \sim 98480\times$</tex-math></inline-formula> faster than existing biometric-based two-factor AKE schemes) and has an acceptable communication cost of several KBs. Besides, it has no requirement for the entropy rate of the biometric source. These features suggest our scheme is practical and easy to be deployed.