Accountable authentication with privacy protection: The Larch system for universal login. (arXiv:2305.19241v2 [cs.CR] UPDATED)

Credential compromise is hard to detect and hard to mitigate. To address this
problem, we present larch, an accountable authentication framework with strong
security and privacy properties. Larch protects user privacy while ensuring
that the larch log server correctly records every authentication. Specifically,
an attacker who compromises a user's device cannot authenticate without
creating evidence in the log, and the log cannot learn which web service
(relying party) the user is authenticating to. To enable fast adoption, larch
is backwards-compatible …

address authentication compromise credential credential compromise detect framework hard log login privacy problem protection security server system user privacy