Cryptanalysis of a privacy-preserving authentication scheme based on private set intersection

1 Introduction

Continuous authentication, sometimes referred to as implicit authentication, has been proposed as a complementary security measure for computer devices that are handled directly by humans, such as smart phones, in addition to common authentication methods, such as passwords, iris recognition, etc. The supposed advantage is a passive and seamless authentication mechanism that does not require user attention and user action, such as re-typing of passwords or holding the phone in front of the face for iris recognition. While conventional authentication methods are session-oriented, meaning that the device remains unlocked during the time period of the session, the time-window of access for continuous authentication methods is smaller than for session-oriented approaches. Continuous authentication is realized by continuously monitoring and collecting certain user feature data and checking whether they are consistent with reference template data collected during user enrollment. One purported benefit of continuous authentication over session-oriented approaches is that if a smart phone for a moment becomes accessible to someone else while it is unlocked, the continuous authentication mechanism will not recognize the other person. This will cause the authentication to fail, and the phone will lock.

Categories of continuous authentication modalities include behavioral authentication and context-aware authentication. The premise of behavioral authentication is that there is a uniqueness to the way that a person moves and acts, such as walking style, typing style, or handling of devices, and recognizing such unique patterns is sufficient for identifying the person. Behavioral modalities (or modes) include gait, screen touch (known as touch dynamics), and typing (keystroke dynamics). Biometric authentication modalities such as face and iris recognition are often considered to be continuous authentication modalities as well. Since such modalities require some user attention and are not entirely passive and seamless, they cannot be considered true continuous authentication mechanisms. Regarding context-aware user authentication, user device-specific data and location data such as GPS data, Wi-Fi access points, and cellular data may constitute the basis for user authenticity.

Continual user- and device-specific monitoring and data collection can indeed, be considered invasive as they reveal certain user actions and whereabouts while the user is in contact with the device. Concerns and skepticism have been raised in this regard. To mitigate for such privacy challenges, several privacy-preserving continuous authentication schemes have been proposed using homomorphic encryption techniques [1–7]. Homomorphic encryption is a form of encryption that allows computations to be performed on encrypted data without first having to decrypt it. Using such encryption mechanism during enrollment, the user device encrypts the reference template data. The encryptions are transmitted to the authentication server that stores them. During the ongoing authentication, the device samples and encrypts feature data that is transmitted to the authentication server. The homomorphic encryption enables the authentication server to verify whether the encrypted authentication-time data are consistent with the encrypted reference template data, while disclosure of any other information is prevented.

Domingo-Ferrer et al. [1] proposed a privacy-preserving protocol for continuous (implicit) authentication based on private set intersection. Using private set intersection, a comparison is carried out showing the (dis)similarity between the encrypted reference template and the encrypted authentication-time features. No decryption takes place and no private keys are required, and thus, no plaintext data are revealed to any party. The authors claim that their scheme “remains robust in the malicious scenario,” in which a participant may deviate from the protocol.

In this article, we show that Domingo-Ferrer et al.’s scheme is insecure against a misbehaving authentication server and external adversaries. The scheme uses the Paillier encryption algorithm as a cryptographic primitive. It has a homomorphic property that we observe not only lacks relevance but, indeed, incurs a vulnerability that is exploited in the proposed cryptanalysis. This means that special care needs to be taken considering homomorphic properties of cryptographic primitives used in cryptographic protocols.

We present two attacks that, respectively, reveal reference template features and authentication-time features in plaintext. We believe that our cryptanalysis has a general interest due to the fact that the Paillier cryptosystem is commonly used as primitive in cryptographic protocols.

2 Related work

A few privacy-preserving schemes have been proposed for different types of modalities of behavior-based and context-based user authentication.

Domingo-Ferrer et al.’s privacy-preserving authentication scheme [1] is using user context feature similarities as a basis for authentication. These features are encrypted and compared by means of private set intersection comparison, using the Paillier cryptosystem [8] as a primitive. This enables us to determine (dis)similarities between encrypted reference data and input data. This scheme seems to be inspired by the private set intersection comparison scheme proposed by Freedman et al. [9]. Similar to the former, set elements are represented by polynomial roots (or coefficients), which are protected using homomorphic encryption, based on the Paillier encryption system. Their scheme is secure in the honest-but-curious adversarial model, while also an extension with regard to the malicious adversary model is proposed.

Govindarajan et al. [6] proposed a privacy-preserving protocol for touch dynamics-based authentication. Their scheme uses a private comparison protocol proposed by Erkin et al. [10] and the homomorphic DGK encryption algorithm proposed by Damgård et al. [11,12]. It could be noted that the privacy-preserving comparison is bitwise, and as such, it is inefficient.

Safa et al. [3] proposed a generic framework for privacy-preserving implicit authentication using context data, such as location data, device-specific data, wifi connection, and browsing history. It is based on homomorphic encryption (the authors suggest the Paillier encryption scheme) and order-preserving encryption to compute the similarity between encrypted input and encrypted reference templates (by means of average absolute deviation).

The privacy-preserving authentication scheme proposed by Shahandashti et al. [4] assumes context features and is based on order-preserving symmetric encryption (OPSE) and additive homomorphic encryption. The cryptographic primitives are generic, but the authors suggest the OPSE scheme proposed by Boldyreva et al. [5] and the Paillier public key scheme.

A potential limitation with context-aware modes [1,3,4] is the inability to determine whether the user is present or not. For example, if the device is stolen within a specified area, then it cannot be distinguished between a legitimate and illegitimate user.

Balagani et al. [13] proposed a periodic keystroke dynamics-based privacy-preserving authentication scheme. It is similar to the Govindarajan et al.’s protocol [6] but assumes the private comparison protocol proposed by Erkin et al. [10] and the homomorphic DGK encryption algorithm proposed by Damgård et al. [11]. This scheme has the same efficiency problems as Govindarajan et al.

Wei et al. [2] proposed a privacy-preserving authentication scheme for touch dynamics using homomorphic encryption properties. It is based on similarity scores between input and reference features using cosine similarity. The authentication server performs a comparison between the encrypted reference template (provided during enrollment) and encrypted input template sampled during authentication. The authentication server decrypts the similarity scores and compares them with a predefined threshold. The scheme was shown to be insecure in the study by Eskeland et al. [14].

3 Domingo-Ferrer et al.’s privacy-preserving authentication protocol

Domingo-Ferrer et al.’s privacy-preserving authentication protocol [1] conducts privacy-preserving set intersection comparison for finding the (dis)similarity between two encrypted data sets. The enrollment reference template is denoted X , and the authentication-time features is denoted Y . The privacy-preserving scheme in question establishes the similarity or the number of matching elements ∣ X ∩ Y ∣ , of which each set element is encrypted. Note that the study by Domingo-Ferrer et al. [1] and other literature in this area consider dissimilarity rather than similarity, which is the inverse 1 ∕ ∣ X ∩ Y ∣ . A potential user is considered legitimate and is thus authenticated if the dissimilarity stays below a certain threshold; otherwise, the authentication fails.

Enrollment phase. In this phase, the client device samples s secret enrollment values X = { a 1 , … , a s } that constitute the user reference template. These are encrypted and transferred to the carrier. To do so, the client does the following computations:

1. Generate a public key ( g , n ) in agreement with the Paillier cryptosystem, where g is of order n modulo n 2 . For simplicity, let g = n + 1 . The corresponding private key is not established.

2. Generate s + 4 random secret integers: ( R ′ , r 0 ′ , d , r i ∣ 0 ≤ i ≤ s ) in Z n .

3. Given X , compute s + 1 secret polynomial coefficients ( p 0 , p 1 , … , p s ) :

   (1) p ( x ) = ∏ i = 1 s ( x − a i ) = ∑ i = 0 s p i x i .

4. Encrypt ( p 0 , p 1 , … , p s ) in agreement with the Paillier cryptosystem:

   E ( p i ) = g p i r i n mod n 2 .

5. Given ( R ′ , r 0 ′ , X ) , compute the secret integers ( r 1 ′ , … , r s ′ ) , so that

   (2) R ′ = ∏ j = 0 s r j ′ a 1 j mod n 2 ∏ j = 0 s r j ′ a 2 j mod n 2 ⋮ ∏ j = 0 s r j ′ a s j mod n 2 .

   More on this below.

6. Compute R i d = ( r i ′ ∕ r i ) d mod n 2 for 0 ≤ i ≤ s .

7. The client sends the elements

   ( g , n , E ( p i ) , R i d ∣ 0 ≤ i ≤ s )

   to the carrier. The client deletes all data except ( d , R ′ ) , which are kept secret.

where R is a positive integer. The correctness of equation (2) is shown by:

since R p ( a i ) = R 0 = 1 .

Authentication phase. In this phase, the carrier computes the cardinality of the intersection of the enrollment samples and samples t authentication-time features Y = { b 1 , … , b t } .

1. The carrier selects a random secret integer θ , computes s + 1 exponentiations E i ′ = E ( p i ) θ mod n 2 , and sends ( g , n , E i ′ , R i d ∣ 0 ≤ i ≤ s ) to the device of the client to be authenticated.

2. The client generates t random secret integers t i ∈ Z n (these are denoted r ( i ) in [1]), and using the secret integers ( d , R ′ ) , it encrypts the sampled b i :

   B i = ∏ j = 0 s E j ′ b i j ⋅ d ⋅ t i mod n 2 , ϒ i = ∏ j = 0 s ( R j d ) b i j ⋅ t i mod n 2 , D i = R ′ d ⋅ t i mod n 2 , 1 ≤ i ≤ t .

   The triplets { B i , ϒ i , D i ∣ 1 ≤ i ≤ t } are sent to the carrier in a random order.

3. The carrier checks each triplet whether

   (4) B i ϒ i n ⋅ θ ≡ ? D i n ⋅ θ ( mod n 2 ) , 1 ≤ i ≤ t ,

since p ( x ) = ∑ j = 0 s p j x j and r 0 ′ = R ′ R p 0 . The right-hand side (R.H.S.) of equation (4) is D i n ⋅ θ = R ′ d ⋅ t i ⋅ n ⋅ θ . Thus, if p ( b i ) = 0 then B i ϒ i n ⋅ θ = R ′ d ⋅ t i ⋅ n ⋅ θ and equation (4) holds.

4 Cryptanalysis

In this section, we present two attacks that reveal all user information that is subject to the enrollment and authentication phases. A significant feature is that the proposed attacks are undetectable.

The adversary is the mainly the authentication server, but could, in principle, be an external party since no private keys are involved. In addition to breeching privacy, the latter could cause additional security breeches. The external adversary could simply use the disclosed enrollment reference template for any subsequent authentication session, enabling him or her to successfully masquerade as the victim.

5 Comments on Domingo-Ferrer et al.’s protocol

The enrollment security of Domingo-Ferrer et al.’s scheme is based on the secrecy of the elements ( d , R , R ′ , r 0 ′ , … , r s ′ , r 0 , … r s ) , of which r 0 ′ is determined by the secret integers ( R , R ′ , p 0 ) , and ( r 1 ′ , … , r s ′ ) are determined by R and the polynomial coefficients ( p 0 , p 1 , … , p s ) . The latter are eventually defined by the reference template features X . In summary, these features are included in:

1. The Paillier encryptions E ( p i ) = g p i r i n .

2. The nominators of the powers R i d = ( r i ′ ∕ r i ) d , where r 0 ′ = R ′ R p 0 , r j ′ = R p j , 1 ≤ j ≤ s , in agreement with equation (2).

A security feature is that all encryptions in the authentication phase are cryptographically tied to a specific session, whose security function would be to prevent replay attacks. In Step 1, the encrypted enrollment features E ( p i ) are encrypted by means of a common secret exponent θ , establishing a cryptographic tie to that session. Application of the same θ is therefore necessary during verification, cf. equation (4). In Step 2, the client computes the t triplets ( B i , ϒ i , D i ) , 1 ≤ i ≤ t , using the secret exponents t i , 1 ≤ i ≤ t . This does not only cryptographically link these elements that session, but also establishes a unique link for each triplet. If the protocol is correctly designed, this would prevent an attacker from replaying or reusing cryptographic elements from previous sessions, and to combine such triplets, to mount a successful attack.

Considering a Paillier encryption E ( m ) = g m r n mod n 2 , the plaintext factor g m is protected by the secret encryption factor r n , of which its additive homomorphic property is realized due to that g has group order n . However, the scheme in question neither decrypts anything nor uses the homomorphic property of the Paillier cryptosystem. A key observation is thus that utilizing Paillier encryption not only lacks relevance, but more importantly incurs an insecure protocol design as already shown.

6 Suggested fix

An immediate fix would simply to avoid the Paillier encryption and conduct all computations modulo n . The effect is that the Paillier generator g is discarded and that c i = E ( p i ) becomes c i = r i n mod n . This prevents Attack #1 (disclosure of X and δ i ), which in turn prevents Attack #2. Furthermore, protecting X from disclosure to external adversaries, prevents those adversaries from successfully posing as the victim during subsequent authentication sessions.

The polynomial coefficients ( p 0 , p 1 , … , p s ) are then (via r i ′ , cf. equations 2 and 3) only used for establishing R i d = ( r i ′ ∕ r i ) d mod n , which, indeed, allows us correct polynomial evaluation in the verification step, cf. equation (4):

of which the L.H.S. expands to B i ϒ i n ⋅ θ = R ′ d ⋅ t i ⋅ n ⋅ θ R n ⋅ p ( b i ) ⋅ d ⋅ t i ⋅ θ ( mod n ) and the R.H.S. expands to D i n ⋅ θ = R ′ d ⋅ t i ⋅ n ⋅ θ ( mod n ) , 1 ≤ i ≤ t .

7 Conclusion

Continuous and context-aware authentication have been proposed as an alternative to password-based authentication. However, such authentication mechanisms have privacy issues as certain user features and context-relevant information are submitted to the authentication server. In this study, we have considered a clever privacy-preserving protocol for context-aware authentication proposed by Domingo-Ferrer et al. that enables authentication, without revealing any user context information to the authentication server. The authors claim that their scheme is secure with regard to malicious participants.

In this study, we have presented two attacks: the first enables the authentication server to obtain the enrollment reference plaintext data despite the encryption, and the authentication-time plaintext data by means of the second attack. Due to the probabilistic nature of these attacks, they are not detectable.

The attacks exploit the fact that computations in Domingo-Ferrer et al.’s scheme are conducted in Z n 2 in compliance with the Paillier encryption scheme. However, a key observation in this article is that the additive homomorphism that the Paillier encryption scheme provide is not really used by the protocol in question. Instead, by rather conducting the computations in Z n , the scheme would no longer be vulnerable to the proposed attacks. This means that special care must be taken when using cryptographic primitives having homomorphic properties in cryptographic protocols, since these may also incur cryptographic vulnerabilities.