What question did this study set out to answer?

The aim is to present ExoAuth, a passwordless authentication mechanism using cryptographic principles and hardware components.

June 27, 2026Open Access

Passwordless Workstation User Authentication

Key Points

The aim is to present ExoAuth, a passwordless authentication mechanism using cryptographic principles and hardware components.
Developed a cryptographic protocol replacing passwords with hardware-bound authentication.
Used mobile devices' Secure Elements and Trusted Platform Module in workstations for secure access.
Ensured continuous authentication through Bluetooth and proximity verification with Ultra-Wideband.
Demonstrated no attack class successful without simultaneous physical access to both devices.
Achieved biometric verification at the hardware level, independent of device lock state.
Validated cryptographic primitives against official RFC test vectors.

Abstract

This paper presents ExoAuth, a cryptographic protocol that replaces the password entry screen on workstations with a hardware-bound, proximity-verified authentication mechanism requiring no human-memorized secret. ExoAuth pairs a mobile device's certified Secure Element (Apple Secure Enclave, Google Titan M2, Samsung Knox Vault) with the workstation's discrete Trusted Platform Module (dTPM) over a one-time USB trust anchor. Subsequent daily authentication proceeds over Bluetooth using the Noise IK handshake pattern, ensuring the identity proof transits only inside an encrypted channel with forward secrecy. Physical proximity is enforced via Ultra-Wideband (UWB) distance bounding to prevent relay attacks. Per-session biometric verification is enforced at the hardware level on the mobile device, independent of its lock state. The protocol is composed of five validated cryptographic primitives — Ed25519 (identity), X25519 ephemeral ECDH (channel), ChaCha20-Poly1305 (encryption), HKDF-SHA256 (key derivation), and Shamir Secret Sharing with BIP39 mnemonics (offline recovery) — each verified against official RFC test vectors. Offline recovery requires no server infrastructure and introduces no backup password. Security analysis demonstrates that no identified attack class succeeds without simultaneous physical access to both the workstation and the paired mobile device. The protocol is derived from the Exo-OS research initiative and is presented here as a general-purpose authentication layer applicable to any operating system exposing a credential provider interface

Read Full Paperexternally

Perguntar à IA

Bookmark

View Full Paper