What question did this study set out to answer?

This paper aims to present a cryptographic protocol, ExoAuth, that replaces traditional passwords with a secure hardware-based authentication mechanism.

June 27, 2026Open Access

Passwordless Workstation User Authentication

Key Points

This paper aims to present a cryptographic protocol, ExoAuth, that replaces traditional passwords with a secure hardware-based authentication mechanism.
Developed ExoAuth protocol pairing mobile device's Secure Element with workstation's Trusted Platform Module (dTPM).
Used Ultra-Wideband for proximity verification and Bluetooth for secure channel authentication.
Employed a range of validated cryptographic primitives for security and offline recovery.
ExoAuth exhibits strong resistance against relay attacks due to enforced physical proximity.
Security analysis confirms no identified attack can succeed without physical access to both the workstation and mobile device.
All cryptographic components validated against official test vectors.

Abstract

This paper presents ExoAuth, a cryptographic protocol that replaces the password entry screen on workstations with a hardware-bound, proximity-verified authentication mechanism requiring no human-memorized secret. ExoAuth pairs a mobile device's certified Secure Element (Apple Secure Enclave, Google Titan M2, Samsung Knox Vault) with the workstation's discrete Trusted Platform Module (dTPM) over a one-time USB trust anchor. Subsequent daily authentication proceeds over Bluetooth using the Noise IK handshake pattern, ensuring the identity proof transits only inside an encrypted channel with forward secrecy. Physical proximity is enforced via Ultra-Wideband (UWB) distance bounding to prevent relay attacks. Per-session biometric verification is enforced at the hardware level on the mobile device, independent of its lock state. The protocol is composed of five validated cryptographic primitives — Ed25519 (identity), X25519 ephemeral ECDH (channel), ChaCha20-Poly1305 (encryption), HKDF-SHA256 (key derivation), and Shamir Secret Sharing with BIP39 mnemonics (offline recovery) — each verified against official RFC test vectors. Offline recovery requires no server infrastructure and introduces no backup password. Security analysis demonstrates that no identified attack class succeeds without simultaneous physical access to both the workstation and the paired mobile device. The protocol is derived from the Exo-OS research initiative and is presented here as a general-purpose authentication layer applicable to any operating system exposing a credential provider interface

Read Full Paperexternally

Ask AI

Mark Helpful

Bookmark

Relay

View Full Paper