Conference Papers Year : 2024

Key Management Based on Ownership of Multiple Authenticators in Public Key Authentication

Kodai Hatakeyama
  • Function : Author
  • PersonId : 1509148
Daisuke Kotani
  • Function : Author
  • PersonId : 1509149
Yasuo Okabe
  • Function : Author
  • PersonId : 1509150

Abstract

Public key authentication (PKA) has been deployed in various services to provide stronger authentication to users. In PKA, a user manages private keys on her devices called authenticators, and registers public keys to services. To protect private keys, authenticators are usually designed not to export private keys outside. Nowadays, a user has multiple authenticators like PCs and smartphones, and struggles to manage multiple public keys in many services every time she starts to use new services and replaces some of her authenticators. To ease the burden, we propose a mechanism where users and services manage public keys based on the owner of authenticators and users can access services with PKA using any of their authenticators. We introduce a key pair called an Ownership Verification Key (OVK) consisting of the private key (OVSK) and the public key (OVPK). All authenticators owned by a user derive the same OVSK from the pre-shared secret. Services verify the ownership of the authenticators using the OVPK to decide whether binding the requested public key to her account. To protect user privacy, authenticators generate an unique OVK for each service. We implement the Proof-of-Concept, show that our proposal achieves some security goals, and discuss how to mitigate threats not completely handled.
Embargoed file
Embargoed file
1 10 10
Year Month Jours
Avant la publication
Friday, January 1, 2027
Embargoed file
Friday, January 1, 2027
Please log in to request access to the document

Dates and versions

hal-04953456 , version 1 (18-02-2025)

Licence

Identifiers

Cite

Kodai Hatakeyama, Daisuke Kotani, Yasuo Okabe. Key Management Based on Ownership of Multiple Authenticators in Public Key Authentication. 38th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), Jun 2023, Poznan, Poland. pp.361-375, ⟨10.1007/978-3-031-56326-3_26⟩. ⟨hal-04953456⟩
0 View
0 Download

Altmetric

Share

More