Comments on Physically Unclonable Function Based Two-Factor Authentication Protocols

Jin Wook Byun, Ik Rae Jeong

Research output: Contribution to journalArticlepeer-review

3 Citations (Scopus)


Physically unclonable function (PUF) is an embedded hardware-based function in a device and cannot be cloned or reproduced on another device. Due to its unclonability, the PUF has been one of the hot issues in IoT devices over pervasive communication network. Recently, there have been attempts to combine a password with an input of PUF for more efficient authentication over insecure communication. In this paper, we firstly raise a question that “Is it really secure if a password is used for an input of PUF?”. Up to now, to the best of our knowledge, only two password-based PUF authentications have been introduced in the literature. We revisit two schemes in view of an off-line password guessing attack. Under a practical PUF assumption, however, we observe that two protocols are susceptible to an off-line dictionary attack. We also present a quite simple but powerful countermeasure.

Original languageEnglish
Pages (from-to)1243-1252
Number of pages10
JournalWireless Personal Communications
Issue number3
Publication statusPublished - 2019 Jun 1

Bibliographical note

Funding Information:
Acknowledgements This work was supported as part of Military Crypto Research Center (UD170109ED) funded by Defense Acquisition Program Administration(DAPA) and Agency for Defense Development (ADD).

Publisher Copyright:
© 2019, Springer Science+Business Media, LLC, part of Springer Nature.


  • Authentication
  • Password guessing attack
  • Physical unclonable function

ASJC Scopus subject areas

  • Computer Science Applications
  • Electrical and Electronic Engineering


Dive into the research topics of 'Comments on Physically Unclonable Function Based Two-Factor Authentication Protocols'. Together they form a unique fingerprint.

Cite this