Revisiting Authentication with Shoulder-Surfing Resistance for Smartphones

A challenge/response authentication scheme with a hidden challenge is useful authentication against a shoulder-surfing attack. This scheme allows a user in authentication with secret information to receive a challenge securely as a nonce and to input the response obtained from the secret information and the challenge, and hence, to prevent impersonation by an adversary as long as the challenge information is kept secret. However, existing schemes sometimes have unreasonable assumptions. Thus, there is an open problem as to "which approach is the best". In this paper, we review the best way to receive a challenge and how to input a response, which should shed light on a scheme that provides both security and usability. To accomplish this, we focus especially on the use of the vibration of devices to receive a challenge, and a shift of secret information in eight directions to input a response as potential approaches. We then show that the vibration is suitable for receiving a challenge, and a digit addition or shift to eight directions is suitable to input a response via experiments. To this purpose, we also propose two authentication schemes, i.e., the vibration-then-digit-addition (VDA) scheme and the vibration-then-eight-direction (V8D) scheme, under experimental results.