{"id":"fa0caff8-e640-47e9-bc1c-7561e45f6ce2","arxiv_id":"2509.05893","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"The authors introduce ESTMF and claim MFKDF2 is provably secure, but several of its own factor algorithms fail to produce a stable key across invocations.","lead":"This paper proposes a framework called ESTMF for detecting entropy leaks in stateful key derivation functions, and a new construction, MFKDF2, claimed to be provably secure. A generalist might read it to see whether a fix for the previously broken multi-factor key derivation idea actually holds up.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"MFKDF2's own factor constructions (Algorithms 3, 5, 6, 8, 9) make κ_i a fresh per-invocation witness, violating Definition 7's static-κ requirement and making the derived key unstable.","rationale":"The reader's weakest assumption is exactly the static-κ premise, and it lands. I checked Definition 7 against the appendix factor constructions: Algorithms 3, 5, 6, 8, and 9 all set κ_i to a witness computed under a newly random challenge in Derive1, and Derive2 rotates the challenge, so κ_i is not static. This breaks both correctness and the premise of the security proof. The paper has no machine-checked proofs or released implementation to offset this; the proofs in §C are conditional on exactly the property the factor constructions fail. Because this is a direct algorithmic inconsistency visible in the manuscript, the reader's REJECT verdict is justified and requires no adjustment.","tokens_in":27865,"tokens_out":4807,"duration_ms":47143,"concrete_test":"Write a minimal simulation of Algorithm 1 instantiated with Algorithm 3. Use a simulated WebAuthn-PRF authenticator that returns PRF(static_secret, challenge), and a valid witness for each challenge. (1) Run Setup to get (B0, T0), K0, observing κ_i = ⊥. (2) Call Derive with the witness for challenge chal_0 to get K1 and B1. (3) Call Derive again with the valid witness for the new challenge chal_1 to get K2. If K1 != K2, the construction is not a KDF because it lacks key stability. Optionally, repeat step 2 without applying Derive2's challenge rotation; if K remains stable only then, the instability is traced to the rotating challenge design in Algorithms 3, 5, 6, 8, and 9.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that MFKDF2 is end-to-end secure under ESTMF (abstract; §5.7). The load-bearing condition for that claim is Definition 7: 'σ and κ are static material and do not ever receive a state-step j subscript,' and the factor constructions must therefore return the same κ_i on every valid invocation. The new factor constructions do not satisfy this. Algorithm 3 (Passkeys/WebAuthn-PRF) sets κ_i ← ⊥ in Setup (line 6) and in Derive1 sets κ_i ← W_i,j (line 10), where W_i,j is the PRF output over a fresh random challenge; Derive2 then replaces chal_i,j with a fresh random challenge (line 14). Thus κ_i changes on every invocation. The same pattern appears in Algorithm 5 (SQRL), Algorithm 6 (Push), Algorithm 8 (NFC/RFID), and Algorithm 9 (OIDC), all of which set κ_i ← W_i,j for a witness produced under a rotating random challenge. This is not a cosmetic mismatch: in Algorithm 1 line 23, M' hashes the κ_i values, so the derived key K' changes from invocation to invocation even when every witness is valid. MFKDF2 therefore fails the basic correctness property of a KDF, and the ESTMF proofs in §C—which assume Factor-KI factors and static κ—cannot apply to the construction as written. Even before the security analysis, the construction does not function as a key derivation function.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces the Entropy State Transition Modeling Framework (ESTMF), a set of definitions for analyzing entropy leakage across multiple invocations of stateful KDFs, and applies it to the previously known MFKDF cryptanalysis. It then proposes MFKDF2, a new construction intended to satisfy ESTMF security via fixed KDF parameters, per-factor salting, Shamir sharing over GF(256), PRP-based share encryption, and a self-referential MAC on the public state. The paper also adds new factor constructions (passkeys, SQRL, push, enclave, proximity, OIDC), new features, and modes for credential hashing and password/key generation. The central claim is that MFKDF2 is end-to-end secure under ESTMF (abstract, §5.7). The manuscript includes algorithms and proofs in Appendices B and C.","tokens_in":28244,"tokens_out":5407,"duration_ms":49458,"significance":"If correct, the ESTMF framework would be a useful step toward formalizing multi-invocation security for stateful key derivation, and MFKDF2 would be a practical successor to NS23's MFKDF. The paper's systematic enumeration of entropy-flow channels and its design choices (PRP instead of XOR, per-factor salting, self-referential MAC) are plausible building blocks. However, the central construction is not correct as written: the new factor constructions make the source key material κ_i change on every invocation, so MFKDF2 does not derive a stable key and the security proofs do not apply. The ESTMF definitions themselves are a meaningful conceptual contribution, but the paper's main deliverable—a provably secure MFKDF2—is not established.","major_comments":[{"comment":"Definition 7 states that σ and κ are static material and do not ever receive a state-step j subscript, and that Derive outputs the same source key material κ_i on every valid invocation. The concrete factor constructions violate this requirement at the algorithmic level: in Algorithms 3, 5, 6, 8, and 9, Derive1 sets κ_i ← W_i,j, where W_i,j is a PRF output, signature, or HMAC computed over a challenge that Derive2 replaces with a fresh random value (e.g., Algorithm 3 lines 10 and 14; Algorithm 8 lines 11 and 15). Consequently κ_i changes on every invocation. In the n-of-n construction (Algorithm 1 line 23), M' hashes the κ_i values, so the derived key K' changes from one invocation to the next even when all witnesses are valid; the self-referential MAC check at lines 25–27 will then fail, and legitimate users cannot derive the same key twice. The same problem breaks the threshold construction in Algorithm 2, where each share is decrypted with a key k_i derived from a per-invocation κ_i. This is a correctness failure independent of the security proofs, and it means the ESTMF proofs in Appendix C do not apply to the construction as written.","section":"Definition 7; Algorithms 3, 5, 6, 8, 9; Algorithm 1"},{"comment":"The end-to-end security claim—'MFKDF2 itself is secured under the ESTMF framework'—rests on Theorem 6, whose proof assumes that the factor constructions are Factor-KI secure. No proof of Factor-KI security is supplied for any of the new factor constructions in Appendix B.3, and the construction-level behavior described in the first major comment actively contradicts Definition 4: the value fed into the global KDF changes on every invocation, so the factor-state stream is not computed using a single fixed key K_b. Without a Factor-KI guarantee, the hybrid argument in Theorem 6 has no basis for treating the factor-state components as indistinguishable, and the central security claim is unsupported.","section":"§5.7 and Theorem 6"},{"comment":"The timing oracle is described as an optional, stateless online service that stores an internal 'pepper' and runs its own copy of the TOTP protocol. This introduces a new party holding secret material into the derivation process, but the ESTMF adversarial games in Definitions 1–5 do not model compromise of the oracle, and the paper does not analyze the MSI guarantee if the oracle's pepper is exposed. Since the oracle is presented as part of the MFKDF2 TOTP factor flow, the paper's claim that ESTMF covers all entropy-flow channels is incomplete without an explicit model for this component.","section":"§5.6 and §9.1.3"}],"minor_comments":[{"comment":"The deconstruction of the public state reads 'B_i' but should be 'B_j'; as written the notation is inconsistent with the rest of the Derive function.","section":"Algorithm 2, line 20"},{"comment":"The text says 'For MFKF2, this implies SSS for a 256 bit key over GF(256) is secure'; 'MFKF2' should be 'MFKDF2'.","section":"§5.7, final paragraph"},{"comment":"Algorithms 5 and 6 are textually identical apart from the transport description; the presentation would be clearer if the shared challenge-response logic were factored out and the transport difference explained once.","section":"§6.4.1 and §6.4.2"},{"comment":"The proof claims that recovering s from two ciphertexts E_k(s) and E_k'(s) requires trying all 2^{2m} key pairs. This complexity claim needs formal justification, since meet-in-the-middle or plaintext-distribution considerations may give lower generic attack complexity; a reduction-based argument would be more appropriate.","section":"Appendix C, Theorem 2"},{"comment":"The paper describes MFKDF2 as 'production-ready' and discusses drop-in deployment scenarios, but it provides no implementation, performance measurements, or reference code; these claims should be softened or supported.","section":"§9 and §10"}],"recommendation":"reject","confidential_remarks":"The rejection is driven by a load-bearing correctness flaw in the central construction, not by lack of ideas or novelty. The ESTMF framework and the list of design principles have merit, but the MFKDF2 algorithms as written do not implement a stable KDF. If the authors can revise the factor constructions so that κ_i is genuinely static across invocations (e.g., by separating a long-term per-factor secret from the per-invocation authentication witness), the security analysis might become applicable; the current version, however, cannot be repaired by local edits to the proofs."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The thing to know about this paper is that the framing is useful and the construction is broken. ESTMF is a real attempt to model multi-invocation entropy leakage in stateful KDFs, and the Factor Fungibility attack on NS23 is a legitimate new observation. The paper also does a decent job of cataloguing the SBH24 vulnerabilities and connecting them to missing state-integrity, factor-isolation, and key-indistinguishability properties. I would not dismiss the framework work.\n\nThe problem is that MFKDF2 does not function as a key derivation function. Definition 7 requires the source key material κ to be static and never receive a state-step subscript. But Algorithms 3, 5, 6, 8, and 9 set κ_i to a fresh witness — a PRF output, signature, HMAC response, or signed token — computed over a newly randomized challenge. The challenge rotates on every invocation, so κ_i changes every time. Algorithm 1 then hashes the κ_i values to form M', which means the derived key K' changes on every valid invocation. The self-referential MAC check will fail for the legitimate user, not just for an attacker. This is not a subtle security gap; it is a failure of the basic correctness property the paper claims.\n\nThe proofs have corresponding issues. Proposition 1's proof is misstated: it says the attacker must produce T' = T, but the client checks T' = MAC(K', B'), and the proof does not correctly reduce to EUF-CMA. Theorem 6, the main MSI result, simply assumes the concrete factor constructions satisfy Factor-KI. That assumption is doing all the work, and the appendix constructions are not shown to satisfy it — in fact, they violate the static-κ premise that Factor-KI requires. So the chain from ESTMF to the security of MFKDF2 has a load-bearing gap at exactly the point where the construction meets the model.\n\nWhat is good here is the modeling methodology and the systematic re-derivation of known attacks. What is not good is the construction itself, which is the paper's main deliverable. I would not rely on these algorithms, and I would not cite the security claims.\n\nWho should read it? People working on applied key management or on formal models for stateful primitives might mine the ESTMF part for ideas. But the paper needs major revision before it can be taken seriously as a construction paper. I would still send it to review — the problem is important and the framework deserves expert scrutiny — but the right recommendation is reject, with an invitation to resubmit a corrected construction.","headline":"The ESTMF framework and factor-fungibility attack are genuine new ideas, but MFKDF2 as written does not even derive a stable key, so the central security claim collapses on mechanical grounds.","tokens_in":28711,"tokens_out":2139,"would_cite":false,"duration_ms":22145,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A multi-factor key derivation function can be proven secure against repeated entropy leaks.","keywords":["multi-factor key derivation","entropy leakage","stateful KDF","cryptanalysis framework","MFKDF2","passkeys","credential hashing","self-referential MAC"],"falsifier":"Run two consecutive derivations with the same enrolled passkey factor following Algorithm 3: the first derivation stores a fresh random challenge in the public state, so on the second derivation the witness, and hence the factor's key material, is different, the derived key changes, and the self-referential MAC check fails; that observation would refute the claimed correctness and end-to-end security for that factor.","tokens_in":1709,"feed_emoji":"🔑","tokens_out":1842,"duration_ms":128973,"temperature":0.7,"pith_summary":"This paper aims to establish that a stateful multi-factor key derivation function can be designed so that an adversary who observes and manipulates its public state over many invocations learns nothing about the master secret. It introduces the Entropy State Transition Modeling Framework (ESTMF), which treats a KDF as a state machine and catalogues the channels through which entropy can leak: from the master secret, between factors, from a factor into its own public state, and from an adversary into the protocol. Applied to the original MFKDF construction, the framework reproduces every previously known multi-invocation attack and exposes an additional factor-ordering weakness. The paper then specifies MFKDF2, which seals these channels with per-factor salts, polynomial threshold secret sharing over $\\mathrm{GF}(256)$, a pseudorandom permutation instead of XOR, and a self-referential MAC, and argues the construction is end-to-end secure under ESTMF. If correct, this makes client-side key management usable with ordinary authentication factors instead of a password alone.","feed_headline":"Rebuilt multi-factor key derivation closes repeated-use leaks","feed_subtitle":"The redesigned MFKDF2 is proven secure against the repeated-use entropy leaks that broke its predecessor.","key_machinery":"The load-bearing object is the Entropy State Transition Modeling Framework (ESTMF), a state-machine model of entropy flow in a stateful KDF. It defines four adversarial games, one per leak channel: Master Secret Indistinguishability for the master secret, Factor-IND-CMA for cross-factor leakage, Factor-Key Indistinguishability for a factor's own secret leakage, and state integrity for injection of malicious state. MFKDF2's design is effectively a list of countermeasures keyed to those four channels: the self-referential MAC loop, AES-256 PRP encryption of shares and secrets, bytewise polynomial threshold secret sharing over $\\mathrm{GF}(256)$ to remove byte-format bias, per-factor salting to defeat reordering and fungibility, and share regeneration on recovery for forward secrecy. The proof's work is to show that if each factor construction meets Factor-KI and the primitives are secure, then each of the four games is won with negligible advantage, and hence the full state stream is indistinguishable between two independent master secrets.","core_discovery":"The central discovery is that the earlier scheme's multi-invocation failures are not isolated bugs but entropy flows along four identifiable channels, and a construction that closes all four channels can be proven secure. MFKDF2 does this by requiring every factor to satisfy Factor-Key Indistinguishability, encrypting shares and factor secrets with a secure pseudorandom permutation (AES-256) rather than XOR, using bytewise polynomial threshold secret sharing over $\\mathrm{GF}(2^8)$ so shares are perfectly uniform, salting each factor instance so order and swapping attacks fail, authenticating the whole public state with HMAC-SHA256 keyed by the derived key itself, and regenerating all shares after recovery so compromised old factors do not carry over. The proof's final step is a hybrid argument over the public state stream showing the scheme achieves Master Secret Indistinguishability; the same core then supports server-side multi-factor credential hashing and deterministic password/passkey generation as modes of operation.","pith_inferences":["A natural extension not pursued in the paper is to run the ESTMF games on the concrete factor algorithms rather than at the abstract level; the theorems assume each factor satisfies Factor-KI, so machine-checked proofs for the WebAuthn-PRF, SQRL, push, proximity, and OIDC instantiations would close the gap between the abstract result and code.","The state-machine view of entropy flow should transfer to other stateful cryptography with public mutable state, such as hardware-backed keystores or key-insulated signatures; the same four channels give a checklist for auditing them.","A deployment detail the paper touches only lightly: because a failed derivation aborts on MAC mismatch, any service that exposes derivation attempts should treat the abort/no-abort outcome as a guessing oracle and rate-limit or pre-authenticate requests.","Since the 256-bit core is already symmetric-key based, the upgrade path to a 512-bit variant is mostly widening the field, block size, and KDF output; the paper's suggested MFKDF2-512 target is a concrete route to post-quantum margin."],"forward_implications":["An adversary who can read and rewrite the public state across any polynomial number of derivations still learns nothing about the master secret, so the derived key remains secret even after many uses.","Recovering a lost or compromised factor regenerates all shares, so an old compromised factor is useless against the new state; forward secrecy holds.","Because the entire public state is MAC-authenticated with the derived key, any attempt to downgrade the KDF parameters or weaken the policy is detected by the client before a new key is accepted.","The security guarantee transfers to the two modes of operation: multi-factor credential hashing (MFCHF2) and deterministic password/passkey generation (MFDPG2), since both build on the same MFKDF2 core.","New factor types, including passkeys via WebAuthn-PRF, fuzzy extractors for biometrics and location, push/QR, enclave, proximity, and OIDC flows, can be added without disturbing the core proof, provided each factor satisfies Factor-KI."],"supporting_citations":[{"why":"The original MFKDF scheme whose security definitions, factor constructions, and threshold/policy mechanisms MFKDF2 inherits and re-hardens.","marker":"[42]"},{"why":"The cryptanalysis that identified multi-invocation entropy leaks; ESTMF is validated by reproducing these attacks and MFKDF2 is designed to defeat them.","marker":"[46]"},{"why":"The standard cryptographic background used for the PRP security theorem and the uniform-share lemma in the MFKDF2 proof.","marker":"[12]"},{"why":"Argon2, the memory-hard KDF that the MFKDF2 Setup and Derive algorithms use to turn combined factor material into a key.","marker":"[10]"},{"why":"Balloon hashing, the memory-hard KDF chosen in the hardened defaults to prevent parameter-tampering attacks.","marker":"[14]"},{"why":"Fuzzy extractors, the primitive behind the fuzzy encryption factor for biometric, location, and behavioral inputs.","marker":"[17]"},{"why":"The WebAuthn PRF extension used to derive deterministic factor material from passkeys.","marker":"[57]"}],"fun_headline_variants":["MFKDF2 seals four entropy leak channels in multi-factor keys","Proven secure multi-factor key derivation after four leak fixes","New multi-factor key function closes repeated-use entropy leaks with proof","Multi-factor key derivation sequel proven secure against entropy leaks"],"cache_read_input_tokens":30848,"weakest_assumption_plain":"The whole construction assumes that each authentication factor contributes the same fixed secret value on every invocation; several of the paper's own factor algorithms instead use a freshly generated random challenge each time, so if that assumption fails the derived key will not be stable and the security proof will not apply.","fun_headline_variants_meta":{"raw":{"variants":["MFKDF2 seals four entropy leak channels in multi-factor keys","Proven secure multi-factor key derivation after four leak fixes","New multi-factor key function closes repeated-use entropy leaks with proof","Multi-factor key derivation sequel proven secure against entropy leaks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000776,"raw_usage":{"total_tokens":3428,"prompt_tokens":937,"completion_tokens":2491,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":553,"completion_tokens_details":{"reasoning_tokens":2422}},"tokens_in":553,"tokens_out":2491,"duration_ms":16677,"temperature":1.0,"reasoning_tokens":2422,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T16:20:29.508247+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run two consecutive derivations with the same enrolled passkey factor following Algorithm 3: the first derivation stores a fresh random challenge in the public state, so on the second derivation the witness, and hence the factor's key material, is different, the derived key changes, and the self-referential MAC check fails; that observation would refute the claimed correctness and end-to-end security for that factor.","supporting_citations":[{"cited_title":"Multi-Factor key derivation function (MFKDF) for fast, flexible, secure, & practical key management","cited_arxiv_id":null,"evidence_quote":"The original MFKDF scheme whose security definitions, factor constructions, and threshold/policy mechanisms MFKDF2 inherits and re-hardens."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The cryptanalysis that identified multi-invocation entropy leaks; ESTMF is validated by reproducing these attacks and MFKDF2 is designed to defeat them."},{"cited_title":"A graduate course in ap- plied cryptography, 2020","cited_arxiv_id":null,"evidence_quote":"The standard cryptographic background used for the PRP security theorem and the uniform-share lemma in the MFKDF2 proof."},{"cited_title":"Argon2: the memory-hard function for password hash- ing and other applications","cited_arxiv_id":null,"evidence_quote":"Argon2, the memory-hard KDF that the MFKDF2 Setup and Derive algorithms use to turn combined factor material into a key."},{"cited_title":"Schechter","cited_arxiv_id":null,"evidence_quote":"Balloon hashing, the memory-hard KDF chosen in the hardened defaults to prevent parameter-tampering attacks."},{"cited_title":"Fuzzy extractors: How to generate strong keys from biometrics and other noisy data.SIAM Jour- nal on Computing, 38(1):97–139, 2008","cited_arxiv_id":null,"evidence_quote":"Fuzzy extractors, the primitive behind the fuzzy encryption factor for biometric, location, and behavioral inputs."},{"cited_title":"TOTP: Time-Based One-Time Password Al- gorithm","cited_arxiv_id":null,"evidence_quote":"The WebAuthn PRF extension used to derive deterministic factor material from passkeys."}],"review_version":2}