Cryptographic protocols for passwordless systems with enhanced security

Kumawat, Gaurav; Kant, Tapan; Bhardwaj, Vivek; Kumar, Mukesh; Rashid, Abdulnaser; Othman, Mohamed Tahar Ben

doi:10.47974/JDMSC-2438

Open Access Research Article

Cryptographic protocols for passwordless systems with enhanced security

Gaurav KumawatGaurav.Kumawat@jaipur.manipal.eduSchool of Computer Science and EngineeringManipal University JaipurJaipur, Rajasthan, 303007, IndiaView full profile → , Tapan Kanttapan.kant@gla.ac.inDepartment of Computer Engineering and ApplicationGLA UniversityMathura, Uttar Pradesh, 281406, IndiaView full profile → , Vivek Bhardwajvivek.bhardwaj@outlook.inDepartment of Computer Science and EngineeringAmity University PunjabMohali, Punjab, 140306, IndiaView full profile → , Mukesh Kumarmukesh.kumarphd2014@gmail.comDepartment of Computer ApplicationsChandigarh School of BusinessChandigarh Group of Colleges, JhanjeriMohali, Punjab, 140307, IndiaView full profile → , ^*Abdulnaser RashidCorresponding authorarshied@qu.edu.saDepartment of Computer ScienceCollege of ComputerQassim UniversityBuraydah, 51452, Saudi ArabiaView full profile → , Mohamed Tahar Ben Othmanmaathaman@qu.edu.saDepartment of Computer ScienceCollege of ComputerQassim UniversityBuraydah, 51452, Saudi ArabiaView full profile →

* Corresponding author · click or hover a name for details

pp. 2933–2944Vol. 28Issue 8December 2025DOI: 10.47974/JDMSC-2438 Crossmark XML

Received:: 11 Dec 2024
Published Online:: 08 Dec 2025
Article type:: Research Article
Language:: EN
Article no.:: JDMSC-2438
Pages:: 2933–2944

Abstract

Password-based authentication systems are vulnerable to a variety of security risks, such as phishing, credential theft, and user fatigue due to complex password requirements. This paper introduces a novel passwordless authentication framework that leverages advanced cryptographic techniques, including Zero-Knowledge Proofs (ZKP), Secure Multi-Party Computation (SMPC), and Homomorphic Encryption to enhance security, privacy, and user experience. The proposed system eliminates the need for traditional passwords by utilizing biometric data to generate cryptographic keys, ensuring that sensitive information remains secure. The architecture is composed of three primary components: the client device, the authentication server, and the key management system (KMS). The client device captures biometric data and transforms it into cryptographic keys using SMPC, while the server verifies the authentication using ZKP and establishes secure communication channels via Diffie-Hellman key exchange. The KMS handles key generation, storage, and rotation to ensure secure communication. Evaluation results show that the system is highly resistant to common attack vectors such as replay and man-in-the-middle attacks, with a 0% attack success rate. Performance analysis reveals an average authentication time of 180 ms, which is 10% faster than WebAuthn.

Keywords

Cryptographic protocols Passwordless authentication Data privacy Security Performance gain

Subject Classifications

Primary 68P25Secondary 94A60

References

[1] K. Kevin, “Beyond Passwords: A Comprehensive Guide to Passwordless Authentication Technologies and Implementation Strategies,” Revista de Inteligencia Artificial en Medicina, vol. 15, no. 1, pp. 679–969 (2024).
[2] J. Fantaye, “An Introduction and Overview of Privacy-Enhancing Technologies for Data Processing and Analysis,” (2022).
[3] A. K. Singha, S. Kundu, H. P. Singh, L. S. Songare, and P. K. Tiwari , “ Measuring network security in the cloud : A roadmap for proactive defense,” Journal of Discrete Mathematical Sciences and Cryptography, vol. 27, no. 2-B, pp. 889–902 (2024), doi: 10.47974/JDMSC-1964.
[4] H. A. Rahman and N. Yulianti, “Implementation a Passwordless and Multi Factor Authentication (MFA) Mechanism for Enhancing Login Security in Android Applications,” in 2023 International Conference on Informatics, Multimedia, Cyber and Informations System (ICIMCIS), IEEE (2023), pp. 206–211.
[5] R. O. Abdul, “Enhancing IoT-based wireless sensor network security with cryptographic techniques,” Journal of Discrete Mathematical Sciences and Cryptography, vol. 28, no. 4-A, pp. 1117–1130-undefined (Jun. 2025), doi: 10.47974/JDMSC-2102.
[6] E. Uzun, C. Yagemann, S. Chung, V. Kolesnikov, and W. Lee, “Cryptographic key derivation from biometric inferences for remote authentication,” in Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security, pp. 629–643 (2021).
[7] R. Stefanov and K. Liang, “Enhancing the privacy and security of Hyperledger Fabric smart contracts using different encryption methods,” (2021).
[8] E. Praveen Kumar and S. Priyanka, “A password less authentication protocol for multi-server environment using physical unclonable function,” J Supercomput, vol. 79, no. 18, pp. 21474–21506 (2023).
[9] N. K. Verma and V. Singh, “A pragmatic approach to recover access time of Apriori algorithm by applying intersection on CSS for redefining FIS through matrix implementation in textual data,” Journal of Discrete Mathematical Sciences and Cryptography, vol. 25, no. 4, pp. 871–878 (2022), doi: 10.1080/09720529.2022.2068601.
[10] R. Sahil, S. Manmohan, K. Parul, K. Mukesh, and B. Vivek, “Crypt analysis of multi-key biometric encryption for business enterprises using cloud storage,” Journal of Discrete Mathematical Sciences and Cryptography, vol. 28, no. 5-A, pp. 1559–1568-undefined (Aug. 2025), doi: 10.47974/JDMSC-2154.
[11] P. Pallavi, Y. Surendra, and C. S. Singh, “Addressing applications and security issues in the Internet of Things (IoT) : A comprehensive review,” Journal of Discrete Mathematical Sciences and Cryptography, vol. 27, no. 7, pp. 1977–1989-undefined (Oct. 2024), doi: 10.47974/JDMSC-2073.
[12] A. Jabbari, G. Ramachandran, S. Malik, and R. Jurdak, “ZK-DPPS: A Zero-Knowledge Decentralised Data Sharing and Processing Middleware,” (Oct. 2024), [Online]. Available: http://arxiv.org/abs/2410.15568
[13] J. G. Dhokrat, N. Pulgam, T. Maktum, and V. Mane, “A Framework for Privacy-Preserving Multiparty Computation with Homomorphic Encryption and Zero-Knowledge Proofs,” Informatica, vol. 48, no. 21 (Nov. 2024), doi: 10.31449/inf.v48i21.6562.
[14] T. Oduguwa and A. Arabo, “Passwordless Authentication Using a Combination of Cryptography, Steganography, and Biometrics,” Journal of Cybersecurity and Privacy, vol. 4, no. 2, pp. 278–297 (2024).
[15] J. Cabrero-Holgueras and S. Pastrana, “Sok: Privacy-preserving computation techniques for deep learning,” Proceedings on Privacy Enhancing Technologies (2021).
[16] S. Joseph, “Balancing Data Privacy and Compliance in Blockchain-Based Financial Systems,” Journal of Engineering Research and Reports, vol. 26, no. 9, pp. 10–9734 (2024).

Views: 476Downloads: 134Citations: 0