Robust Two-factor smart card authentication

Abstract

Being very resilient devices, smart cards have been commonly used for two-factor authentication schemes. However, the possibility of side-channel attacks renders private data stored in the cards vulnerable to compromise. With this in mind, we propose an authentication protocol that incorporates a second factor, which is as a password, in addition to the smart card. The scheme is aimed to withstand most common security breaches as well as compromised smart card scenarios and offline dictionary attacks on the passwords. Details of a reference implementation are also given along with performance evaluation of the proposed protocol comparing to the literature. Performance analyses show that the proposed protocol outperforms existing solutions in the literature. Moreover, the computational cost of the proposed protocol is less than 2 seconds on our reference implementation that uses commercially available smart cards.