[Paper Review] Authentication as a service: Shamir Secret Sharing with byzantine components

Andrea Bissoli, Fabrizio d’Amore|arXiv (Cornell University)|Jun 19, 2018

User Authentication and Security Systems4 citations

TL;DR

This paper proposes a novel authentication-as-a-service framework leveraging Shamir's (k,n)-threshold secret sharing with Byzantine-resilient components, where passwords are split into shares stored across distributed cloud nodes. By hiding abscissae and using Pedersen verifiable secrets, the scheme achieves information-theoretic security, ensuring that even if the dealer and k−1 shareholders are compromised, the password remains computationally unbreakable, with a working prototype demonstrating feasibility and robustness under adversarial conditions.

ABSTRACT

We present a practical methodology for securing the password-based authentication scheme. We propose a solution based on the well-known (k,n) threshold scheme of Shamir for sharing a secret, where in our case the secret is the password itself and (k,n) threshold scheme means that n password-derived secrets (shares) are created and k less than n shares are necessary and sufficient for reconstructing the password, while k-1 are not sufficient. The scheme is information-theoretic secure. Since each of the n shares is stored on a different host (shareholder), an attacker will need to compromise k different shareholders for obtaining an amount of data sufficient for reconstructing the secret. Furthermore, in order to be resistant to the compromising of the server (dealer) coordinating the shareholders we define a variant of the classic Shamir, where the Shamir's abscissae are unknown to dealer and shareholders, making the reconstruction impossible even in the case of dealer and shareholders compromised. In addition we use the Pedersen technique for allowing the verification of shares. For the described scenario we have designed two protocols: the registration (user's sign-up, to be carried out once), and authentication (user's login). We analyse several scenarios where dealer and/or shareholders are partially/totally compromised and confirm that none of them is enabling the attacker to break the authentication. Furthermore we focus on cases where one or more byzantine servers are presented, analysing the impact on the framework and show the adopted mechanisms to be safe against these kinds of attacks. We have developed a prototype demonstrating that our framework works correctly, effectively and efficiently. It provides a first feasibility study that will provide a base for structured and engineered cloud-based implementations aiming at providing an authentication-as-a-service.

Motivation & Objective

• To address the critical security flaw in password-based authentication where reused or leaked passwords lead to widespread account compromise.
• To design a scalable, cloud-native authentication system where users need to remember only one secret, while cryptographic shares are distributed across multiple untrusted servers.
• To ensure resilience against both dealer compromise and Byzantine behavior in shareholder nodes through novel cryptographic hardening of Shamir's scheme.
• To provide a practical, deployable solution that supports real-world authentication workloads with strong security guarantees and performance efficiency.
• To lay the foundation for engineered, production-ready cloud-based authentication services with formal security analysis and a working proof-of-concept.

Proposed method

• The system uses Shamir's (k,n)-threshold secret sharing to split the user password into n cryptographically secure shares, each stored on a separate untrusted server (shareholder).
• The abscissae (x-coordinates) of the shares are kept secret from both the dealer and shareholders, preventing reconstruction even if both are fully compromised.
• Pedersen's verifiable secret sharing scheme is integrated to allow each shareholder to cryptographically verify the correctness of their share without learning the secret.
• A two-phase protocol is designed: registration (one-time setup) and authentication (interactive login), with secure message exchange between client, dealer, and shareholders.
• The system leverages Docker containerization for cloud deployment, enabling modular, isolated, and reproducible execution of all components.
• Security is formally analyzed under multiple threat models, including partial and total compromise of the dealer and shareholders, as well as Byzantine behavior in the network.

Experimental results

Research questions

• RQ1 Can a password-based authentication system be made information-theoretically secure using secret sharing, even when the dealer and multiple shareholders are compromised?
• RQ2 How can Shamir's secret sharing be modified to prevent reconstruction when abscissae are not known to the dealer or shareholders?
• RQ3 What mechanisms can ensure the integrity and authenticity of shares in the presence of Byzantine or malicious shareholders?
• RQ4 Can a practical, cloud-based authentication-as-a-service framework be built with strong cryptographic guarantees and acceptable performance?
• RQ5 How does the system behave under real-world threats such as credential leaks, replay attacks, and dynamic node compromise?

Key findings

• The proposed scheme achieves information-theoretic security for the password, meaning that even with unbounded computational power, an attacker cannot reconstruct the secret unless they compromise at least k shareholders.
• By hiding the abscissae from both the dealer and shareholders, the system remains secure even if the dealer is fully compromised and k−1 shareholders are corrupted.
• The integration of Pedersen's verifiable secret sharing ensures that all shares are cryptographically verifiable, preventing malicious shareholders from submitting invalid or forged shares.
• The prototype implementation demonstrates that the system is both functionally correct and efficient, with measurable performance suitable for real-world deployment.
• Security analysis confirms that no combination of compromised dealer and shareholders (up to k−1) enables an attacker to reconstruct the password or impersonate a user.
• The system supports a multi-device model and could be extended with dynamic dealer election, automated fault detection, and standardized APIs for broader integration.