Version 1
: Received: 18 January 2024 / Approved: 19 January 2024 / Online: 19 January 2024 (09:54:43 CET)
How to cite:
Oduguwa, T.; Arabo, A. Passwordless Authentication Using a Combination of Cryptography, Steganography, and Biometrics. Preprints2024, 2024011466. https://doi.org/10.20944/preprints202401.1466.v1
Oduguwa, T.; Arabo, A. Passwordless Authentication Using a Combination of Cryptography, Steganography, and Biometrics. Preprints 2024, 2024011466. https://doi.org/10.20944/preprints202401.1466.v1
Oduguwa, T.; Arabo, A. Passwordless Authentication Using a Combination of Cryptography, Steganography, and Biometrics. Preprints2024, 2024011466. https://doi.org/10.20944/preprints202401.1466.v1
APA Style
Oduguwa, T., & Arabo, A. (2024). Passwordless Authentication Using a Combination of Cryptography, Steganography, and Biometrics. Preprints. https://doi.org/10.20944/preprints202401.1466.v1
Chicago/Turabian Style
Oduguwa, T. and Abdullahi Arabo. 2024 "Passwordless Authentication Using a Combination of Cryptography, Steganography, and Biometrics" Preprints. https://doi.org/10.20944/preprints202401.1466.v1
Abstract
User-generated passwords often pose a security risk in authentication systems. However, providing a comparative substitute poses a challenge, given the common tradeoff between security and user experience. This paper integrates cryptographic methods (both asymmetric and symmetric), steganography, and a combination of physiological and behavioral biometrics to construct a prototype for a passwordless authentication system. We demonstrate the feasibility of scalable passwordless authentication while maintaining a balance between usability and security. We employed threat modeling techniques to pinpoint the security prerequisites for the system, along with choosing appropriate cryptographic protocols. In addition, a comparative analysis is conducted, examining the security impacts of the proposed system in contrast to that of traditional password-based systems. Results from the prototype indicate that authentication is possible within a timeframe similar to passwords (within 2 seconds), without imposing additional hardware costs on users to enhance security or compromising usability. Given the scalable nature of the system design and the elimination of shared secrets, the financial and efficiency burdens associated with password resets are alleviated. Furthermore, the risk of breaches is mitigated, as there is no longer a need to store passwords and/or their hashes. Differing from prior research, our study presents a pragmatic design and prototype that deserves consideration as a viable alternative for both password-based and passwordless authentication systems.
Computer Science and Mathematics, Security Systems
Copyright:
This is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.
