QRAuth: A Secure and Accessible Web Authentication Alternative to FIDO2

Kemal Bicakci; Ahmet Drobi

doi:10.1109/ISCTrkiye61151.2023.10336164

QRAuth: A Secure and Accessible Web Authentication Alternative to FIDO2

Kemal Bicakci^*, Ahmet Drobi

^*Corresponding author for this work

Informatics Institute

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

A recently popular alternative being proposed to password-based web authentication is FIDO2 standard. Although phishing-resistant password-less authentication with FIDO2 is a step in the right direction, it falls short in numerous usability and accessibility aspects. FIDO2 protocols requiring specific hardware and software devices that must be "FIDO certified"could prevent it from reaching a wide audience. Furthermore, end-users' perception, acceptance, and usability concerns can potentially hinder widespread adoption. As an answer to these shortcomings, we present a QR-Code-based authentication protocol that offers the same security guarantees of public key cryptography coupled with more accessible infrastructure that can be easily integrated into existing systems.

Original language	English
Title of host publication	16th International Conference on Information Security and Cryptology, ISCTURKEY 2023 - Proceedings
Editors	Ali Aydin Selcuk, Oguz Yayla, Seref Sagiroglu, Cihangir Tezcan
Publisher	Institute of Electrical and Electronics Engineers Inc.
ISBN (Electronic)	9798350393996
DOIs	https://doi.org/10.1109/ISCTrkiye61151.2023.10336164
Publication status	Published - 2023
Event	16th International Conference on Information Security and Cryptology, ISCTURKEY 2023 - Ankara, Turkey Duration: 18 Oct 2023 → 19 Oct 2023

Publication series

Name	16th International Conference on Information Security and Cryptology, ISCTURKEY 2023 - Proceedings

Conference

Conference	16th International Conference on Information Security and Cryptology, ISCTURKEY 2023
Country/Territory	Turkey
City	Ankara
Period	18/10/23 → 19/10/23

Bibliographical note

Publisher Copyright:
© 2023 IEEE.

Keywords

authentication protocol
FIDO2
passwordless authentication
public-key cryptography
user authentication

Access to Document

10.1109/ISCTrkiye61151.2023.10336164

Cite this

Bicakci, K., & Drobi, A. (2023). QRAuth: A Secure and Accessible Web Authentication Alternative to FIDO2. In A. A. Selcuk, O. Yayla, S. Sagiroglu, & C. Tezcan (Eds.), 16th International Conference on Information Security and Cryptology, ISCTURKEY 2023 - Proceedings (16th International Conference on Information Security and Cryptology, ISCTURKEY 2023 - Proceedings). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/ISCTrkiye61151.2023.10336164

Bicakci, Kemal ; Drobi, Ahmet. / QRAuth : A Secure and Accessible Web Authentication Alternative to FIDO2. 16th International Conference on Information Security and Cryptology, ISCTURKEY 2023 - Proceedings. editor / Ali Aydin Selcuk ; Oguz Yayla ; Seref Sagiroglu ; Cihangir Tezcan. Institute of Electrical and Electronics Engineers Inc., 2023. (16th International Conference on Information Security and Cryptology, ISCTURKEY 2023 - Proceedings).

@inproceedings{4e7b30422eeb40f7a83e112a5e966726,

title = "QRAuth: A Secure and Accessible Web Authentication Alternative to FIDO2",

abstract = "A recently popular alternative being proposed to password-based web authentication is FIDO2 standard. Although phishing-resistant password-less authentication with FIDO2 is a step in the right direction, it falls short in numerous usability and accessibility aspects. FIDO2 protocols requiring specific hardware and software devices that must be {"}FIDO certified{"}could prevent it from reaching a wide audience. Furthermore, end-users' perception, acceptance, and usability concerns can potentially hinder widespread adoption. As an answer to these shortcomings, we present a QR-Code-based authentication protocol that offers the same security guarantees of public key cryptography coupled with more accessible infrastructure that can be easily integrated into existing systems.",

keywords = "authentication protocol, FIDO2, passwordless authentication, public-key cryptography, user authentication",

author = "Kemal Bicakci and Ahmet Drobi",

note = "Publisher Copyright: {\textcopyright} 2023 IEEE.; 16th International Conference on Information Security and Cryptology, ISCTURKEY 2023 ; Conference date: 18-10-2023 Through 19-10-2023",

year = "2023",

doi = "10.1109/ISCTrkiye61151.2023.10336164",

language = "English",

series = "16th International Conference on Information Security and Cryptology, ISCTURKEY 2023 - Proceedings",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

editor = "Selcuk, {Ali Aydin} and Oguz Yayla and Seref Sagiroglu and Cihangir Tezcan",

booktitle = "16th International Conference on Information Security and Cryptology, ISCTURKEY 2023 - Proceedings",

address = "United States",

}

Bicakci, K & Drobi, A 2023, QRAuth: A Secure and Accessible Web Authentication Alternative to FIDO2. in AA Selcuk, O Yayla, S Sagiroglu & C Tezcan (eds), 16th International Conference on Information Security and Cryptology, ISCTURKEY 2023 - Proceedings. 16th International Conference on Information Security and Cryptology, ISCTURKEY 2023 - Proceedings, Institute of Electrical and Electronics Engineers Inc., 16th International Conference on Information Security and Cryptology, ISCTURKEY 2023, Ankara, Turkey, 18/10/23. https://doi.org/10.1109/ISCTrkiye61151.2023.10336164

QRAuth: A Secure and Accessible Web Authentication Alternative to FIDO2. / Bicakci, Kemal; Drobi, Ahmet.
16th International Conference on Information Security and Cryptology, ISCTURKEY 2023 - Proceedings. ed. / Ali Aydin Selcuk; Oguz Yayla; Seref Sagiroglu; Cihangir Tezcan. Institute of Electrical and Electronics Engineers Inc., 2023. (16th International Conference on Information Security and Cryptology, ISCTURKEY 2023 - Proceedings).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - QRAuth

T2 - 16th International Conference on Information Security and Cryptology, ISCTURKEY 2023

AU - Bicakci, Kemal

AU - Drobi, Ahmet

PY - 2023

Y1 - 2023

N2 - A recently popular alternative being proposed to password-based web authentication is FIDO2 standard. Although phishing-resistant password-less authentication with FIDO2 is a step in the right direction, it falls short in numerous usability and accessibility aspects. FIDO2 protocols requiring specific hardware and software devices that must be "FIDO certified"could prevent it from reaching a wide audience. Furthermore, end-users' perception, acceptance, and usability concerns can potentially hinder widespread adoption. As an answer to these shortcomings, we present a QR-Code-based authentication protocol that offers the same security guarantees of public key cryptography coupled with more accessible infrastructure that can be easily integrated into existing systems.

AB - A recently popular alternative being proposed to password-based web authentication is FIDO2 standard. Although phishing-resistant password-less authentication with FIDO2 is a step in the right direction, it falls short in numerous usability and accessibility aspects. FIDO2 protocols requiring specific hardware and software devices that must be "FIDO certified"could prevent it from reaching a wide audience. Furthermore, end-users' perception, acceptance, and usability concerns can potentially hinder widespread adoption. As an answer to these shortcomings, we present a QR-Code-based authentication protocol that offers the same security guarantees of public key cryptography coupled with more accessible infrastructure that can be easily integrated into existing systems.

KW - authentication protocol

KW - FIDO2

KW - passwordless authentication

KW - public-key cryptography

KW - user authentication

UR - http://www.scopus.com/inward/record.url?scp=85181767027&partnerID=8YFLogxK

U2 - 10.1109/ISCTrkiye61151.2023.10336164

DO - 10.1109/ISCTrkiye61151.2023.10336164

M3 - Conference contribution

AN - SCOPUS:85181767027

T3 - 16th International Conference on Information Security and Cryptology, ISCTURKEY 2023 - Proceedings

BT - 16th International Conference on Information Security and Cryptology, ISCTURKEY 2023 - Proceedings

A2 - Selcuk, Ali Aydin

A2 - Yayla, Oguz

A2 - Sagiroglu, Seref

A2 - Tezcan, Cihangir

PB - Institute of Electrical and Electronics Engineers Inc.

Y2 - 18 October 2023 through 19 October 2023

ER -

Bicakci K, Drobi A. QRAuth: A Secure and Accessible Web Authentication Alternative to FIDO2. In Selcuk AA, Yayla O, Sagiroglu S, Tezcan C, editors, 16th International Conference on Information Security and Cryptology, ISCTURKEY 2023 - Proceedings. Institute of Electrical and Electronics Engineers Inc. 2023. (16th International Conference on Information Security and Cryptology, ISCTURKEY 2023 - Proceedings). doi: 10.1109/ISCTrkiye61151.2023.10336164

QRAuth: A Secure and Accessible Web Authentication Alternative to FIDO2

Abstract

Publication series

Conference

Bibliographical note

Keywords

Access to Document

Other files and links

Fingerprint

Cite this