Multi-factor simple password exponential key exchange (SPEKE) authentication

1. A method comprising:

receiving, by a processing device of an authentication server over a public network, an authentication request and a first public key from a client device, wherein the first public key generated by the client device, and wherein the authentication request comprising:

a user identifier;

first factor data associated with the user identifier, wherein the first factor data comprises a password, and wherein the password is stored in a storage associated with the authentication server prior to receiving the authentication request; and

second factor data associated with the user identifier, wherein the second factor data comprises one of:

a one-time password, wherein the one-time password is different than the password; or

biometric data; and

generating a session key that is a function of a combination of the first factor data, the second factor data, and the first public key received from the client device, wherein the combination comprises determining a generator value by:

combining the first factor data with the second factor data to generate a combined value, wherein combining comprises one of concatenating the first factor data with the second factor data or calculating an exclusive-OR of the first factor data and the second factor data; and

calculating a hash value of the combined value.

2. The method of claim 1 , further comprising:

receiving a first twice-hashed value from the client device;

generating a derived session key in view of the session key;

calculating a second hash value of the derived session key; and validating the second hash value in view of the first twice-hashed value received from the client device.

3. The method of claim 2 , further comprising:

in response to successfully validating the second hash value with the first twice-hashed value, issuing a proof of authentication token to the client device.

4. The method of claim 3 , wherein the proof of authentication token is issued without requiring using a security certificate.

5. The method of claim 2 , further comprising:

in response to failing to validate the second hash value with the first hash value, issuing a denial-of-authentication token to the client device.

6. The method of claim 1 , wherein the one-time password is valid for one of a pre-determined period of time or a pre-determined count according to a counter.

7. The method of claim 1 , further comprising:

generating a random number;

generating a second public key in view of the generator value and the random number; and

transmitting the second public key to the client device.

8. The method of claim 1 , wherein a processing device of the client device is to:

calculate a second generator value in view of a combination of the first factor data and the second factor data;

generate a second random number;

generate the first public key in view of the second generator value and the second random number; and

transmit the first public key to the authentication server.

9. A non-transitory machine-readable storage medium storing instructions which, when executed, cause a processing device to:

receive, by the processing device of an authentication server over a public network, an authentication request and a first public key from a client device, wherein the first public key generated by the client device, and wherein the authentication request comprising:

a user identifier;

first factor data associated with the user identifier, wherein the first factor data comprises a password, and wherein the password is stored in a storage associated with the authentication server prior to receiving the authentication request; and

second factor data associated with the user identifier, wherein the second factor data comprises one of:

a one-time password, wherein the one-time password is different than the password; or

biometric data; and

generate a session key that is a function of a combination of the first factor data, the second factor data, and the first public key received from the client device, wherein the combination comprises determining a generator value by:

combine, by the processing device of an authentication server over a public network, the first factor data with the second factor data to generate a combined value, wherein combining comprises one of concatenating the first factor data with the second factor data or calculating an exclusive-OR of the first factor data and the second factor data; and

calculate a hash value of the combined value.

10. The non-transitory machine-readable storage medium of claim 9 , wherein the processing device is further to:

receive a first twice-hashed value from the client device;

generate a derived session key in view of the session key;

calculate a second hash value of the derived session key; and

validate the second hash value in view of the first twice-hashed value received from the client device.

11. The non-transitory machine-readable storage medium of claim 10 , wherein the processing device is further to:

in response to successfully validating the second hash value with the first twice-hashed value, issue a proof of authentication token to the client device.

12. The non-transitory machine-readable storage medium of claim 9 , wherein the one-time password is valid for one of a pre-determined period of time or a pre-determined count according to a counter.

13. A server, comprising:

a memory to store a first factor data and a second factor data; and

a processing device, operatively coupled to the memory, the processing device to:

receive, over a public network, an authentication request and a first public key from a client device, wherein the first public key generated by the client device, and wherein the authentication request comprising:

a user identifier;

first factor data associated with the user identifier, wherein the first factor data comprises a password, and wherein the password is stored in the memory prior to receiving the authentication request; and

second factor data associated with the user identifier, wherein the second factor data comprises one of:

a one-time password, wherein the one-time password is different than the password; or

biometric data; and

generate a session key that is a function of a combination of the first factor data, the second factor data, and the first public key received from the client device, wherein the combination comprises determining a generator value by:

combine, by the processing device of an authentication server over a public network, the first factor data with the second factor data to generate a combined value, wherein combining comprises one of concatenating the first factor data with the second factor data or calculating an exclusive-OR of the first factor data and the second factor data; and

calculate a hash value of the combined value.

14. The server of claim 13 , wherein the processing device is further to:

receive a first twice-hashed value from the client device,

generate a derived session key in view of the session key,

calculate a second hash value of the derived session key, and

validate the second hash value in view of the first twice-hashed value received from the client device.

15. The server of claim 14 , wherein the processing device is further to:

in response to successfully validating the second hash value with the first twice hashed value, issue a proof of authentication token to the client device.

16. The server of claim 14 , wherein the processing device is further to:

in response to failing to validate the second hash value with the first hash value, issue a denial-of-authentication token to the client device.

17. The server of claim 13 , wherein the one-time password is valid for one of a pre-determined period of time or a pre-determined count according to a counter.