Cancelable Biometrics and Quantum-Resistant Two-Factor Authenticated Key Agreement for Mobile Device

As mobile devices are pervasively used, they face many security issues, including forgery and data tampering attacks during communications. To encrypt the communication messages, the Authenticated Key Agreement (AKA) method exploits user-owned credentials (such as smart cards and passwords) for agreeing on symmetric keys. However, such credentials are more prone to be lost or forged by adversaries than the user's intrinsic credentials, such as biometrics. Additionally, many AKA methods rely on classical algorithms, such as RSA and ECC, and are not resistant to quantum attacks. To this end, we propose a cancelable biometrics and quantum-resistant two-factor authenticated key agreement (CQT-AKA) scheme. The static private key of the device in the AKA is a cancellable biometric-derived value from combining the user's biometrics with the password. In case that an adversary obtains the user's cancellable biometric feature, the device can obtain a new password during the key update stage to calculate a new cancellable biometrics. The deployment cost and communication latency of the CQT-AKA scheme is lower than that of multi-factor authentication because it utilizes two-factor. Moreover, based on the RLWE assumption, the scheme requires less storage, making it suitable for resource-constrained devices and providing post-quantum communication security. The security analysis demonstrates the high level of security in the CQT-AKA scheme, and the performance evaluation results showcase its efficiency.