Pith. sign in

REVIEW 3 major objections 5 minor 58 references

Wrangling Entropy: Next-Generation Multi-Factor Key Derivation, Credential Hashing, and Credential Generation Functions

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A multi-factor key derivation function can be proven secure against repeated entropy leaks.

desk verdict The ESTMF framework and factor-fungibility attack are genuine new ideas, but MFKDF2 as written does not even derive a stable key, so the central security claim collapses on mechanical grounds. read the letter →

arxiv 2509.05893 v1 pith:PR3XR3ZO submitted 2025-09-07 cs.CR

Colin Roberts , Vivek Nair , Dawn Song This is my paper · ORCID
classification cs.CR
keywords multi-factorkeyderivationentropyleakagestatefulKDFcryptanalysisframeworkMFKDF2passkeyscredentialhashingself-referentialMAC
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper aims to establish that a stateful multi-factor key derivation function can be designed so that an adversary who observes and manipulates its public state over many invocations learns nothing about the master secret. It introduces the Entropy State Transition Modeling Framework (ESTMF), which treats a KDF as a state machine and catalogues the channels through which entropy can leak: from the master secret, between factors, from a factor into its own public state, and from an adversary into the protocol. Applied to the original MFKDF construction, the framework reproduces every previously known multi-invocation attack and exposes an additional factor-ordering weakness. The paper then specifies MFKDF2, which seals these channels with per-factor salts, polynomial threshold secret sharing over $\mathrm{GF}(256)$, a pseudorandom permutation instead of XOR, and a self-referential MAC, and argues the construction is end-to-end secure under ESTMF. If correct, this makes client-side key management usable with ordinary authentication factors instead of a password alone.

What carries the argument

The load-bearing object is the Entropy State Transition Modeling Framework (ESTMF), a state-machine model of entropy flow in a stateful KDF. It defines four adversarial games, one per leak channel: Master Secret Indistinguishability for the master secret, Factor-IND-CMA for cross-factor leakage, Factor-Key Indistinguishability for a factor's own secret leakage, and state integrity for injection of malicious state. MFKDF2's design is effectively a list of countermeasures keyed to those four channels: the self-referential MAC loop, AES-256 PRP encryption of shares and secrets, bytewise polynomial threshold secret sharing over $\mathrm{GF}(256)$ to remove byte-format bias, per-factor salting to defeat reordering and fungibility, and share regeneration on recovery for forward secrecy. The proof's work is to show that if each factor construction meets Factor-KI and the primitives are secure, then each of the four games is won with negligible advantage, and hence the full state stream is indistinguishable between two independent master secrets.

What would settle it

Run two consecutive derivations with the same enrolled passkey factor following Algorithm 3: the first derivation stores a fresh random challenge in the public state, so on the second derivation the witness, and hence the factor's key material, is different, the derived key changes, and the self-referential MAC check fails; that observation would refute the claimed correctness and end-to-end security for that factor.

Watch

Extended reading notes

Core claim

The central discovery is that the earlier scheme's multi-invocation failures are not isolated bugs but entropy flows along four identifiable channels, and a construction that closes all four channels can be proven secure. MFKDF2 does this by requiring every factor to satisfy Factor-Key Indistinguishability, encrypting shares and factor secrets with a secure pseudorandom permutation (AES-256) rather than XOR, using bytewise polynomial threshold secret sharing over $\mathrm{GF}(2^8)$ so shares are perfectly uniform, salting each factor instance so order and swapping attacks fail, authenticating the whole public state with HMAC-SHA256 keyed by the derived key itself, and regenerating all shares after recovery so compromised old factors do not carry over. The proof's final step is a hybrid argument over the public state stream showing the scheme achieves Master Secret Indistinguishability; the same core then supports server-side multi-factor credential hashing and deterministic password/passkey generation as modes of operation.

Load-bearing premise

The whole construction assumes that each authentication factor contributes the same fixed secret value on every invocation; several of the paper's own factor algorithms instead use a freshly generated random challenge each time, so if that assumption fails the derived key will not be stable and the security proof will not apply.

Editorial extensions

If this is right

  • An adversary who can read and rewrite the public state across any polynomial number of derivations still learns nothing about the master secret, so the derived key remains secret even after many uses.
  • Recovering a lost or compromised factor regenerates all shares, so an old compromised factor is useless against the new state; forward secrecy holds.
  • Because the entire public state is MAC-authenticated with the derived key, any attempt to downgrade the KDF parameters or weaken the policy is detected by the client before a new key is accepted.
  • The security guarantee transfers to the two modes of operation: multi-factor credential hashing (MFCHF2) and deterministic password/passkey generation (MFDPG2), since both build on the same MFKDF2 core.
  • New factor types, including passkeys via WebAuthn-PRF, fuzzy extractors for biometrics and location, push/QR, enclave, proximity, and OIDC flows, can be added without disturbing the core proof, provided each factor satisfies Factor-KI.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension not pursued in the paper is to run the ESTMF games on the concrete factor algorithms rather than at the abstract level; the theorems assume each factor satisfies Factor-KI, so machine-checked proofs for the WebAuthn-PRF, SQRL, push, proximity, and OIDC instantiations would close the gap between the abstract result and code.
  • The state-machine view of entropy flow should transfer to other stateful cryptography with public mutable state, such as hardware-backed keystores or key-insulated signatures; the same four channels give a checklist for auditing them.
  • A deployment detail the paper touches only lightly: because a failed derivation aborts on MAC mismatch, any service that exposes derivation attempts should treat the abort/no-abort outcome as a guessing oracle and rate-limit or pre-authenticate requests.
  • Since the 256-bit core is already symmetric-key based, the upgrade path to a 512-bit variant is mostly widening the field, block size, and KDF output; the paper's suggested MFKDF2-512 target is a concrete route to post-quantum margin.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper introduces the Entropy State Transition Modeling Framework (ESTMF), a set of definitions for analyzing entropy leakage across multiple invocations of stateful KDFs, and applies it to the previously known MFKDF cryptanalysis. It then proposes MFKDF2, a new construction intended to satisfy ESTMF security via fixed KDF parameters, per-factor salting, Shamir sharing over GF(256), PRP-based share encryption, and a self-referential MAC on the public state. The paper also adds new factor constructions (passkeys, SQRL, push, enclave, proximity, OIDC), new features, and modes for credential hashing and password/key generation. The central claim is that MFKDF2 is end-to-end secure under ESTMF (abstract, §5.7). The manuscript includes algorithms and proofs in Appendices B and C.

Significance. If correct, the ESTMF framework would be a useful step toward formalizing multi-invocation security for stateful key derivation, and MFKDF2 would be a practical successor to NS23's MFKDF. The paper's systematic enumeration of entropy-flow channels and its design choices (PRP instead of XOR, per-factor salting, self-referential MAC) are plausible building blocks. However, the central construction is not correct as written: the new factor constructions make the source key material κ_i change on every invocation, so MFKDF2 does not derive a stable key and the security proofs do not apply. The ESTMF definitions themselves are a meaningful conceptual contribution, but the paper's main deliverable—a provably secure MFKDF2—is not established.

major comments (3)
  1. [Definition 7; Algorithms 3, 5, 6, 8, 9; Algorithm 1] Definition 7 states that σ and κ are static material and do not ever receive a state-step j subscript, and that Derive outputs the same source key material κ_i on every valid invocation. The concrete factor constructions violate this requirement at the algorithmic level: in Algorithms 3, 5, 6, 8, and 9, Derive1 sets κ_i ← W_i,j, where W_i,j is a PRF output, signature, or HMAC computed over a challenge that Derive2 replaces with a fresh random value (e.g., Algorithm 3 lines 10 and 14; Algorithm 8 lines 11 and 15). Consequently κ_i changes on every invocation. In the n-of-n construction (Algorithm 1 line 23), M' hashes the κ_i values, so the derived key K' changes from one invocation to the next even when all witnesses are valid; the self-referential MAC check at lines 25–27 will then fail, and legitimate users cannot derive the same key twice. The same problem breaks the threshold construction in Algorithm 2, where each share is decrypted with a key k_i derived from a per-invocation κ_i. This is a correctness failure independent of the security proofs, and it means the ESTMF proofs in Appendix C do not apply to the construction as written.
  2. [§5.7 and Theorem 6] The end-to-end security claim—'MFKDF2 itself is secured under the ESTMF framework'—rests on Theorem 6, whose proof assumes that the factor constructions are Factor-KI secure. No proof of Factor-KI security is supplied for any of the new factor constructions in Appendix B.3, and the construction-level behavior described in the first major comment actively contradicts Definition 4: the value fed into the global KDF changes on every invocation, so the factor-state stream is not computed using a single fixed key K_b. Without a Factor-KI guarantee, the hybrid argument in Theorem 6 has no basis for treating the factor-state components as indistinguishable, and the central security claim is unsupported.
  3. [§5.6 and §9.1.3] The timing oracle is described as an optional, stateless online service that stores an internal 'pepper' and runs its own copy of the TOTP protocol. This introduces a new party holding secret material into the derivation process, but the ESTMF adversarial games in Definitions 1–5 do not model compromise of the oracle, and the paper does not analyze the MSI guarantee if the oracle's pepper is exposed. Since the oracle is presented as part of the MFKDF2 TOTP factor flow, the paper's claim that ESTMF covers all entropy-flow channels is incomplete without an explicit model for this component.
minor comments (5)
  1. [Algorithm 2, line 20] The deconstruction of the public state reads 'B_i' but should be 'B_j'; as written the notation is inconsistent with the rest of the Derive function.
  2. [§5.7, final paragraph] The text says 'For MFKF2, this implies SSS for a 256 bit key over GF(256) is secure'; 'MFKF2' should be 'MFKDF2'.
  3. [§6.4.1 and §6.4.2] Algorithms 5 and 6 are textually identical apart from the transport description; the presentation would be clearer if the shared challenge-response logic were factored out and the transport difference explained once.
  4. [Appendix C, Theorem 2] The proof claims that recovering s from two ciphertexts E_k(s) and E_k'(s) requires trying all 2^{2m} key pairs. This complexity claim needs formal justification, since meet-in-the-middle or plaintext-distribution considerations may give lower generic attack complexity; a reduction-based argument would be more appropriate.
  5. [§9 and §10] The paper describes MFKDF2 as 'production-ready' and discusses drop-in deployment scenarios, but it provides no implementation, performance measurements, or reference code; these claims should be softened or supported.

Circularity Check

1 steps flagged · score 2.0 of 10

No fit-based circularity, but the security theorem is instantiated on factor constructions that contradict the model's own static-kappa premise.

  1. self definitional [Definition 7 (Appendix A); Algorithms 3, 5, 6, 8, 9 (Appendix B.3); Theorem 6 (Appendix C.4)]
    "First, note that σ and κ are static material and do not ever receive a state-step j subscript. ... κ_i←W_i,j ... chal_i,j+1←{0,1}^256"

    Definition 7's static-kappa requirement is the premise under which Factor-KI (Def. 4) and Theorem 6 prove MSI for MFKDF2. Algorithm 3 and the parallel dynamic-factor algorithms (Algs. 5, 6, 8, 9) define κ_i as the witness W_i,j computed from the current random challenge, and Derive2 replaces chal_i,j with a fresh random value at every invocation. Thus κ_i carries a state-step index j by construction, contrary to Definition 7. Algorithm 1 then hashes these κ_i values to form M' and derives K', so the derived key changes on every invocation and the self-referential MAC check in Algorithm 1 rejects the state the honest client just produced.

full rationale

The paper contains no parameter fitting or fitted-input-called-prediction step, and its main proof chain is compositional over standard cryptographic assumptions about PRPs, MACs, and KDFs rather than over fitted data. I did not treat the self-referential MAC as circular: authenticating a public state with a key derived from that state is a legitimate integrity pattern, and the proof invokes external unforgeability of the MAC. The score stays at 2 rather than 0 because one load-bearing premise is self-definitionally mismatched: the security theorems assume static source key material κ, while the new factor constructions define κ as a fresh per-invocation witness W_i,j over a rotating challenge. That makes the claimed end-to-end theorem inapplicable to the construction as written and leaves the Factor-KI hypothesis assumed without an instantiated proof. This is a correctness and completeness defect on the boundary of circularity, not a case where the central result reduces to a fit or to a self-citation chain, so it does not warrant a higher score.

Assumptions & free parameters 0 free parameters · 6 assumptions · 1 invented entities

The construction rests on the standard security of AES-256 as a PRP, HMAC-SHA256 as a MAC and PRF, Balloon-Hash or Argon2id as a KDF, and SSS over GF(256). The load-bearing non-standard axiom is that the proposed factor constructions satisfy Factor-KI and produce static κ_i, which is assumed but not proved and contradicted by several algorithms. No numerical parameters are fitted to data.

assumptions (6)
  • standard math AES-256 is a secure pseudorandom permutation and its inverse is available.
    Used in Theorems 1 and 2 and Algorithm 2 to encrypt shares and factor secrets.
  • standard math HMAC-SHA256 is existentially unforgeable under chosen-message attack and behaves as a PRF.
    Used in Proposition 1 and Theorem 6 for the self-referential state tag.
  • domain assumption Balloon-Hash-SHA3-256 and Argon2id are secure key derivation functions modeled as PRFs.
    Invoked in Section 5.1 and Theorem 6; no specific proof is provided for these instantiations.
  • ad hoc to paper The concrete factor constructions satisfy Factor-KI and produce static source key material κ_i.
    Assumed in Section 5.7 and Theorem 6; contradicted as written by Algorithms 3, 5, 6, 8, and 9 where κ_i rotates with the challenge.
  • ad hoc to paper A rational client will detect and reject Recover transitions that degrade security.
    Stated in Section 4 to bound the state-integrity analysis; the MAC does not detect rollback to older authentic states.
  • standard math Shamir's secret sharing over GF(256) yields byte-uniform shares when the field size is a byte and n is less than 256.
    Lemma 1 relies on standard SSS results; this part is unremarkable.
invented entities (1)
  • Timing oracle, an online TOTP pepper service
    purpose: Stores a secret pepper, runs its own TOTP copy, and subtracts its value from the user's TOTP to enforce time alignment and mitigate replay and HOTP bias.
    Introduced in Section 5.6 as an optional third-party service. The paper provides no independent security proof or falsifiable property for the oracle beyond an informal liveness trust argument, and it adds a new trust assumption to the system.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Wrangling Entropy: Next-Generation Multi-Factor Key Derivation, Credential Hashing, and Credential Generation Functions." pith.science (2026). https://pith.science/paper/PR3XR3ZO

@misc{pith2026250905893,
  author       = {Pith},
  title        = {Pith review of: Wrangling Entropy: Next-Generation Multi-Factor Key Derivation, Credential Hashing, and Credential Generation Functions},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PR3XR3ZO}},
  note         = {Machine review of arXiv:2509.05893}
}
read the original abstract

The Multi-Factor Key Derivation Function (MFKDF) offered a novel solution to the classic problem of usable client-side key management by incorporating multiple popular authentication factors into a key derivation process, but was later shown to be vulnerable to cryptanalysis that degraded its security over multiple invocations. In this paper, we present the Entropy State Transition Modeling Framework (ESTMF), a novel cryptanalytic technique designed to reveal pernicious leaks of entropy across multiple invocations of a cryptographic key derivation or hash function, and show that it can be used to correctly identify each of the known vulnerabilities in the original MFKDF construction. We then use these findings to propose a new construction for ``MFKDF2,'' a next-generation multi-factor key derivation function that can be proven to be end-to-end secure using the ESTMF. Finally, we discuss how MFKDF2 can be extended to support more authentication factors and usability features than the previous MFKDF construction, and derive several generalizable best-practices for the construction of new KDFs in the future.

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

58 extracted references · 57 canonical work pages

  1. [1]

    1Password Security Design

    1Password. 1Password Security Design

    work page

  2. [2]

    Sign in faster and more securely with passkeys

    1Password. Sign in faster and more securely with passkeys. Web Page, 2024

    work page 2024

  3. [3]

    2020 state of the internet

    Akamai. 2020 state of the internet

    work page 2020

  4. [4]

    iOS Security, May 2012

    Apple. iOS Security, May 2012

    work page 2012

  5. [5]

    Hardware security overview

    Apple Inc. Hardware security overview. Apple Platform Security Guide, May 2024

    work page 2024

  6. [6]

    Key derivation functions without a grain of salt

    Matilda Backendal, Sebastian Clermont, Marc Fischlin, and Felix Günther. Key derivation functions without a grain of salt. In Serge Fehr and Pierre-Alain Fouque, editors,Advances in Cryptology – EUROCRYPT 2025, pages 393–426, Cham, 2025. Springer Nature Switzer- land

    work page 2025

  7. [7]

    Sethura- man, Jithesh Mon Mullool, and R

    K Balaji, Aruna Sri Rongali, Ns Archana, G. Sethura- man, Jithesh Mon Mullool, and R. Karthi. A critical analysis of key management techniques in applied cryp- tography. In2024 15th International Conference on Computing Communication and Networking Technolo- gies (ICCCNT), pages 1–5, 2024

    work page 2024

  8. [8]

    Lucas Ballard, Seny Kamara, and Michael K. Reiter. The Practical Subtleties of Biometric Key Generation

    work page

Show all 58 references
  1. [9]

    Digital Signa- ture Standard (DSS)

    Elaine Barker, Lily Chen, Sharon Keller, Allen Rogin- sky, Apostol Vassilev, and Richard Davis. Digital Signa- ture Standard (DSS). FIPS Publication 186-5, National Institute of Standards and Technology, February 2023

    2023

  2. [10]

    Argon2: the memory-hard function for password hash- ing and other applications

    Alex Biryukov, Daniel Dinu, and Dmitry Khovratovich. Argon2: the memory-hard function for password hash- ing and other applications

  3. [11]

    Balloon hashing: A memory-hard function providing provable protection against sequential attacks

    Dan Boneh, Henry Corrigan-Gibbs, and Stuart Schechter. Balloon hashing: A memory-hard function providing provable protection against sequential attacks. Cryptology ePrint Archive, Paper 2016/027, 2016

    2016

  4. [12]

    A graduate course in ap- plied cryptography, 2020

    Dan Boneh and Victor Shoup. A graduate course in ap- plied cryptography, 2020. https://toc.cryptobook. us/

    2020

  5. [13]

    Recovering Win- dows Secrets and EFS Certificates Offline

    Elie Burzstein and Jean Michel Picod. Recovering Win- dows Secrets and EFS Certificates Offline

  6. [14]

    Schechter

    Henry Corrigan-Gibbs, Dan Boneh, and Stuart E. Schechter. Balloon hashing: Provably space-hard hash functions with data-independent access patterns.IACR Cryptol. ePrint Arch., 2016:27, 2016

    2016

  7. [15]

    2FE: Two-Factor Encryp- tion for Cloud Storage, October 2020

    Anders Dalskov, Daniele Lain, Enis Ulqinaku, Kari Kos- tiainen, and Srdjan Capkun. 2FE: Two-Factor Encryp- tion for Cloud Storage, October 2020. arXiv:2010.14417 [cs]

    2020 arXiv

  8. [16]

    Security white paper

    Dashlane. Security white paper. Technical report, Dash- lane, March 2021

    2021

  9. [17]

    Fuzzy extractors: How to generate strong keys from biometrics and other noisy data.SIAM Jour- nal on Computing, 38(1):97–139, 2008

    Yevgeniy Dodis, Rafail Ostrovsky, Leonid Reyzin, and Adam Smith. Fuzzy extractors: How to generate strong keys from biometrics and other noisy data.SIAM Jour- nal on Computing, 38(1):97–139, 2008

    2008

  10. [18]

    SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions

    Morris Dworkin. SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions. FIPS Publica- tion 202, National Institute of Standards and Technology, August 2015

    2015

  11. [19]

    On cryptocurrency wallet design

    Ittay Eyal. On cryptocurrency wallet design. Cryp- tology ePrint Archive, Paper 2021/1522, 2021. https: //eprint.iacr.org/2021/1522

    2021

  12. [20]

    A Modular Framework for Multi-Factor Authentica- tion and Key Exchange

    Nils Fleischhacker, Mark Manulis, and Amir Azodi. A Modular Framework for Multi-Factor Authentica- tion and Key Exchange. In Liqun Chen and Chris Mitchell, editors,Security Standardisation Research, volume 8893, pages 190–214. Springer International Publishing, Cham, 2014. Ser...

    2014

  13. [21]

    A Large Scale Study of Web Password Habits, November 2006

    Dinei Florencio and Cormac Herley. A Large Scale Study of Web Password Habits, November 2006

    2006

  14. [22]

    A blockchain wallet scheme with multi-factor authentication based on dis- tributed system

    Qianwen Gao and Yichi Tu. A blockchain wallet scheme with multi-factor authentication based on dis- tributed system. In2024 4th International Conference on Blockchain Technology and Information Security (ICBCTIS), pages 55–61, 2024

    2024

  15. [23]

    GRC — SQRL Secure Quick Reliable Login — grc.com

    GRC. GRC — SQRL Secure Quick Reliable Login — grc.com. https://www.grc.com/sqrl/sqrl.htm. [Accessed 26-08-2025]

    2025

  16. [24]

    Se- cure key management mechanism in big data

    Mr BOUDJELABA Hakim and Mr Belghit Lounes. Se- cure key management mechanism in big data

  17. [25]

    How Users Choose and Reuse Passwords

    Ameya Hanamsagar, Simon S Woo, Christopher Kanich, and Jelena Mirkovic. How Users Choose and Reuse Passwords. 14

  18. [26]

    New proofs for pseudorandomness of hmac- based key derivation functions (rfc 5869).Journal of In- formation Security and Applications, 93:104179, 2025

    Dinh Linh Hoang, Thi Luong Tran, and Van Long Nguyen. New proofs for pseudorandomness of hmac- based key derivation functions (rfc 5869).Journal of In- formation Security and Applications, 93:104179, 2025

    2025

  19. [27]

    Personhood cre- dentials: Human-centered design recommendation bal- ancing security, usability, and trust.arXiv preprint arXiv:2502.16375, 2025

    Ayae Ide and Tanusree Sharma. Personhood cre- dentials: Human-centered design recommendation bal- ancing security, usability, and trust.arXiv preprint arXiv:2502.16375, 2025

    2025 arXiv

  20. [28]

    What is Out-of-Band Authentication (OOBA)?

    Ping Identity. What is Out-of-Band Authentication (OOBA)?

  21. [29]

    Ieee standard for wireless lan medium access control (mac) and physical layer (phy) specifications

    IEEE. Ieee standard for wireless lan medium access control (mac) and physical layer (phy) specifications. IEEE Std 802.11-1997, 1997

    1997

  22. [30]

    IEEE. Ieee standard for information technology- telecommunications and information exchange between systems-local and metropolitan area networks-specific requirements-part 11: Wireless lan mac and phy spec- ifications: Amendment 6: Mac security enhancements. IEEE Std 802.11i-2...

    2004

  23. [31]

    Highly-efficient and composable password-protected secret sharing (or: How to protect your bitcoin wallet online)

    Stanislaw Jarecki, Aggelos Kiayias, Hugo Krawczyk, and Jiayu Xu. Highly-efficient and composable password-protected secret sharing (or: How to protect your bitcoin wallet online). Cryptology ePrint Archive, Paper 2016/144, 2016. https://eprint.iacr.org/ 2016/144

    2016

  24. [32]

    PKCS #5: Password-Based Cryptography Specification Version 2.0

    Burt Kaliski. PKCS #5: Password-Based Cryptography Specification Version 2.0. Request for Comments RFC 2898, Internet Engineering Task Force, September 2000. Num Pages: 34

    2000

  25. [33]

    Our Zero-Knowledge Security Model

    LastPass. Our Zero-Knowledge Security Model

  26. [34]

    Multi-Factor Authenticated Key Exchange Protocol in the Three- Party Setting

    Ying Liu, Fushan Wei, and Chuangui Ma. Multi-Factor Authenticated Key Exchange Protocol in the Three- Party Setting. In Xuejia Lai, Moti Yung, and Dongdai Lin, editors,Information Security and Cryptology, pages 255–267, Berlin, Heidelberg, 2011. Springer Berlin Hei- delberg

    2011

  27. [35]

    Windows hello biometric security

    Microsoft. Windows hello biometric security. Microsoft Learn, October 2020

    2020

  28. [36]

    Tutorial: Key enveloping

    Multifactor. Tutorial: Key enveloping. MFKDF Docu- mentation, 2024

    2024

  29. [37]

    Decentralizing custodial wallets with mfkdf

    Vivek Nair and Dawn Song. Decentralizing custodial wallets with mfkdf. In2023 IEEE International Confer- ence on Blockchain and Cryptocurrency (ICBC), pages 1–9, 2023

    2023

  30. [39]

    Mfdpg: Multi-factor authen- ticated password management with zero stored secrets, 2023

    Vivek Nair and Dawn Song. Mfdpg: Multi-factor authen- ticated password management with zero stored secrets, 2023

    2023

  31. [40]

    Multi-factor credential hashing for asymmetric brute-force attack resistance

    Vivek Nair and Dawn Song. Multi-factor credential hashing for asymmetric brute-force attack resistance. In 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P), pages 56–72, 2023

    2023

  32. [41]

    Multi-Factor Credential Hashing for Asymmetric Brute-Force Attack Resistance

    Vivek Nair and Dawn Song. Multi-Factor Credential Hashing for Asymmetric Brute-Force Attack Resistance. IEEE European Symposium on Security and Privacy (EuroS&P), 2023

    2023

  33. [42]

    Multi-Factor key derivation function (MFKDF) for fast, flexible, secure, & practical key management

    Vivek Nair and Dawn Song. Multi-Factor key derivation function (MFKDF) for fast, flexible, secure, & practical key management. In32nd USENIX Security Symposium (USENIX Security 23), pages 2097–2114, Anaheim, CA, August 2023. USENIX Association

    2023

  34. [43]

    BIP-0039: Mnemonic code for generating deter- ministic keys

    Marek Palatinus, Pavol Rusnak, Aaron V oisine, and Sean Bowe. BIP-0039: Mnemonic code for generating deter- ministic keys. Bitcoin Improvement Proposals, Septem- ber 2013

    2013

  35. [44]

    Multi- factor Authenticated Key Exchange

    David Pointcheval and Sébastien Zimmer. Multi- factor Authenticated Key Exchange. In Steven M. Bellovin, Rosario Gennaro, Angelos Keromytis, and Moti Yung, editors,Applied Cryptography and Net- work Security, pages 277–295, Berlin, Heidelberg, 2008. Springer Berlin Heidelberg

    2008

  36. [45]

    Update on SHA-

    Vincent Rijmen and Elisabeth Oswald. Update on SHA-

  37. [46]

    Cryptology ePrint Archive, Paper 2005/010, 2005

    2005

  38. [47]

    MFKDF: Multiple factors knocked down flat

    Matteo Scarlata, Matilda Backendal, and Miro Haller. MFKDF: Multiple factors knocked down flat. In 33rd USENIX Security Symposium (USENIX Security 24), pages 4301–4318, Philadelphia, PA, August 2024. USENIX Association

    2024

  39. [48]

    Construc- tion of a New Biometric-Based Key Derivation Function and Its Application.Security and Communication Net- works, 2018:1–14, December 2018

    Minhye Seo, Jong Hwan Park, Youngsam Kim, Sangrae Cho, Dong Hoon Lee, and Jung Yeon Hwang. Construc- tion of a New Biometric-Based Key Derivation Function and Its Application.Security and Communication Net- works, 2018:1–14, December 2018

    2018

  40. [49]

    i can’t believe it’s not custo- dial!

    Tanusree Sharma, Vivek C Nair, Henry Wang, Yang Wang, and Dawn Song. “i can’t believe it’s not custo- dial!”: Usable trustless decentralized key management. InProceedings of the 2024 CHI Conference on Human Factors in Computing Systems, CHI ’24, New York, NY , USA, 2024. Assoc...

    2024

  41. [50]

    There is always a way out! destruction- resistant key management: Formal definition and prac- tical instantiation

    Yaqing Song, Yuan Zhang, Shiyu Li, Weijia Li, Zeqi Lai, and Qiang Tang. There is always a way out! destruction- resistant key management: Formal definition and prac- tical instantiation. Cryptology ePrint Archive, Paper 2023/1785, 2023. 15

    2023

  42. [51]

    Gilroy, and B

    Colin Soutar, Danny Roberge, Alex Stoianov, Rene M. Gilroy, and B. V . K. Vijaya Kumar. Biometric encryption using image processing. InElectronic Imaging, 1998

    1998

  43. [52]

    Us secure hash algorithm 1 (sha1)

    Cisco Systems. Us secure hash algorithm 1 (sha1). Request for Comments RFC 4226, Internet Engineering Task Force, December 2001

    2001

  44. [53]

    USENIX Security ’23 Fall Accepted Papers — usenix.org

    USENIX. USENIX Security ’23 Fall Accepted Papers — usenix.org. https://www.usenix.org/conference/ usenixsecurity23/fall-accepted-papers. [Ac- cessed 24-08-2025]

    2025

  45. [54]

    Uymatiao and William Emmanuel S

    Mariano Luis T. Uymatiao and William Emmanuel S. Yu. Time-based otp authentication via secure tunnel (toast): A mobile totp scheme using tls seed exchange and encrypted offline keystore. In2014 4th IEEE Inter- national Conference on Information Science and Tech- nology, pages ...

    2014

  46. [55]

    Cryptographic Key Deriva- tion from Biometric Inferences for Remote Authentica- tion

    Erkam Uzun, Carter Yagemann, Simon Chung, Vladimir Kolesnikov, and Wenke Lee. Cryptographic Key Deriva- tion from Biometric Inferences for Remote Authentica- tion. InProceedings of the 2021 ACM Asia Conference on Computer and Communications Security, ASIA CCS ’21, pages 629–64...

    2021

  47. [56]

    HOTP: An HMAC-Based One-Time Password Algorithm

    Mountain View, David M’Raihi, Frank Hoornaert, David Naccache, Mihir Bellare, and Ohad Ranen. HOTP: An HMAC-Based One-Time Password Algorithm. Request for Comments RFC 4226, Internet Engineering Task Force, December 2005. Num Pages: 37

    2005

  48. [57]

    TOTP: Time-Based One-Time Password Al- gorithm

    Mountain View, Johan Rydell, Mingliang Pei, and Salah Machani. TOTP: Time-Based One-Time Password Al- gorithm. Request for Comments RFC 6238, Internet Engineering Task Force, May 2011. Num Pages: 16

    2011

  49. [58]

    Web au- thentication: An api for accessing public key credentials level 3

    W3C Web Authentication Working Group. Web au- thentication: An api for accessing public key credentials level 3. W3C Proposed Recommendation, July 2024

    2024

  50. [59]

    ). During Derive, the user’s 6-digit TOTP code (the witness W) is combined with this public helper data to reconstruct the static κ. Thus, σ is the underlying secret that “powers

    Alma Whitten and J. D. Tygar. Why johnny can’t en- crypt: a usability evaluation of pgp 5.0. InProceedings of the 8th Conference on USENIX Security Symposium - Volume 8, SSYM’99, page 14, USA, 1999. USENIX Association. 16 A Preliminaries We first recall the core components of ...

    1999

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.