Dynamic Digital Identity: Device-Bound Ephemeral Authentication with Proof of Possession

Dynamic Digital Identity: Device-Bound Ephemeral Authentication with Proof of Possession Luiz Ricardo Mantovani da Silva Professor at Universidade do Sagrado Coração (UNISAGRADO) Bauru, SP, Brazil E-mail: mantov[email protected] Abstract—We propose Dynamic Digital Identity (DDI): an authentication mechanism that issues, at each login, an ephemeral identity (a “mutating key”) only after a cryptographic proof of possession of a private key protected by hardware on the user’s device. Unlike SMS OTP or 2FA over fragile channels, DDI combines WebAuthn/FIDO2 (proof of possession and device attestation when applicable) with shortlived session tokens signed by KMS/HSM and channelbound to prevent replay. We discuss the threat model, security properties (resistance to phishing, replay, SIM swap, and credential cloning), and an evaluation plan with technical and usability metrics. We situate the work relative to standards and guidance (W3C WebAuthn, FIDO2/CTAP; NIST SP 800-63B-4; CISA/GSA). Expected results: reduced attack surface compared to SMS OTP and secret-reuse MFA, without requiring dedicated external apps [1], [2], [3], [4]. Index Terms—WebAuthn; FIDO2; CTAP; passkeys; phishing-resistant MFA; SIM swap; digital identity; KMS/HSM. I. Introduction Passwords and SMS OTP face credential theft, realtime phishing, replay, and SIM swap risks. Recent guidance classifies WebAuthn/FIDO2 as phishing-resistant by eliminating shared secrets and binding credentials to domain and device [1], [3], [4]. In parallel, NIST SP 80063B-4 (Jul. 2025) updates authenticator assurance levels and highlights risks of out-of-band channels like SMS [2]. Empirical studies show practical impacts of SIM swap [5]. This work presents Dynamic Digital Identity (DDI), which renews the “presented identity” at every login (an ephemeral token) after proof of possession of a private key generated and held in-device (TPM, Secure Enclave, Android Keystore) following WebAuthn/CTAP [1], [6], [7]. Contributions •Protocol: detailed design with proof of possession, optional attestation, and issuance of a channel-bound ephemeral identity. •Threat mapping: table summarizing attacks and mitigations. •Evaluation plan: security, usability, and reliability metrics with a pilot proposal. •Adoption readiness: alignment to standards (W3C/FIDO2) and regulatory guidance (NIST/- CISA/GSA). II. Related Work WebAuthn/FIDO2 and CTAP define public-key credentials with proof of possession and optional attestation [1], [6], [7]. NIST SP 800-63B-4 focuses on authentication and authenticator lifecycle, AAL2/AAL3, and SMS risks [2]. CISA/GSA provide guidance on phishing-resistant MFA and zero trust [3], [4]. SIM swap studies expose weaknesses of telephony channels [5]. Gap: Few systematic descriptions exist of protocols with session-bound ephemeral identity that avoid external authenticators and manual code re-entry, while preserving device attestation and session binding. III. Threat Model Adversary capabilities: (i) real-time phishing; (ii) MitM; (iii) SIM swap; (iv) device theft; (v) malicious enrollment; (vi) client malware; (vii) token replay. Goals: impersonation; fake-device registration; token reuse; key cloning. Assumptions: server signing keys in KMS/HSM; sound TLS; non-exportable private keys in secure elements; active risk and revocation policies. IV. Proposed System (DDI) A. Principles 1) Proof of possession via challenge–response. 2) Device attestation (when available) to hinder cloning [1]. 3) Short-lived session token signed in KMS/HSM with channel binding. 4) Renew at every login: never reuse the presented identity. 5) Secure recovery and revocation (loss/theft). B. Flows (simplified) Enrollment S -> C: nonce_e, policy C: (sk, pk) <- generate_in_secure_element() att <- attestation(pk, device) sig_e <- sign(sk, nonce_e) C -> S: {pk, att, sig_e, user_id} S: verify(att, sig_e, policy); register(pk, device_meta) TABLE I Threats and mitigations in the DDI protocol Threat Mitigation (summary) Phishing/MitM Origin binding, unique challenge, channel binding Replay Ephemeral token (short TTL), sid, post-use invalidation SIM swap Elimination of SMS/voice (public-key) Key cloning Non-exportable keys, attestation, revocation Device theft Local unlock (PIN/biometrics); remote revocation Authentication + Ephemeral Identity C -> S: start(user_id) S -> C: nonce_a, sid, cbinfo C: proof <- sign(sk, nonce_a || sid || cbinfo) C -> S: {proof, device_meta} S: verify(proof, pk[user_id]); risk_check() S -> C: EI <- sign_KMS({user_id, sid, iat, exp, cbinfo}) C. Built-in Countermeasures •Anti-phishing/MitM: origin binding (WebAuthn) + token channel binding; unique nonce [1]. •Anti-replay: session id (sid) + short expiry + post-use invalidation. •Anti-SIM swap: no SMS/voice; public-key authentication [3]. •Anti-cloning: non-exportable keys in secure elements; optional/strict attestation in regulated contexts [1]. •Server: token-signing keys protected in KMS/HSM (rotation and key ceremony). V. Security Properties Resistance to phishing and replay; no credential reuse; local proof of possession (PIN/biometrics); potential for AAL2/AAL3 depending on policy and authenticator type [2]. VI. Evaluation Methodology Environment: OIDC backend with KMS/HSM; WebAuthn frontend; clients: modern browsers, iOS/Android (passkeys), and security keys (e.g., YubiKey) [1], [7]. Metrics: security (phishing success, replay resistance, SIM swap effect), usability (p50/p95 time, abandonment, SUS/NPS), reliability (per-platform failures) and KMS availability. Design: A/B between SMS/App OTP and DDI; lab attacks (MitM, replay); field pilot (500–5,000 users). VII. Discussion, Limitations, and Risks Platform support for attestation may vary; legacy devices require higher-friction fallback; account recovery must be robust to avoid social-engineering avenues; privacy: minimize attestation metadata; interoperability with OIDC/SAML. VIII. Regulatory and Market Implications Compliance with NIST SP 800-63B-4 (AALs) and CISA/GSA guidance on phishing-resistant MFA; alignment with zero-trust strategies supports adoption in banking, fintech, and digital government [2], [3], [4]. IX. Conclusion DDI introduces an ephemeral identity issued after proof of possession of a hardware-protected private key, reducing phishing, replay, and SIM swap attacks while preserving good usability. Current standards and guidance support the approach and facilitate adoption in financial and government sectors [1], [2]. Artifact and Reproducibility Code/prototype: https://github.com/ LuizRMSilva1973/Seguranca. Acknowledgments We thank the technical community discussions and anonymous reviewers. References [1] W3C Web Authentication Working Group, “Web authentication: An api for accessing public key credentials — level 3,” https: //www.w3.org/TR/webauthn-3/, 2025, w3C TR. Accessed 202510-04. [2] D. Temoshok, J. Fenton, Y.-Y. Choong, N. Lefkovitz, A. Regenscheid, R. Galluzzo, and J. Richer, “Digital identity guidelines: Authentication and authenticator management,” National Institute of Standards and Technology, Special Publication 800-63B-4, 2025. [Online]. Available: https://csrc.nist.gov/pubs/sp/800/63/b/4/final [3] Cybersecurity and Infrastructure Security Agency, “Implementing phishing-resistant mfa,” Tech. Rep., 2022, fact sheet. Accessed 2025-10-04. [Online]. Available: https://www.cisa.gov/sites/default/files/publications/ fact-sheet-implementing-phishing-resistant-mfa-508c.pdf [4] IDManagement.gov (GSA), “Phishing-resistant authenticator playbook,” https://www.idmanagement.gov/playbooks/ altauthn/, 2024, accessed 2025-10-04. [5] K. Lee, B. Kaiser, J. Mayer, and A. Narayanan, “An empirical study of wireless carrier authentication for sim swaps,” in Sixteenth Symposium on Usable Privacy and Security (SOUPS 2020), 2020. [Online]. Available: https: //www.usenix.org/system/files/soups2020-lee.pdf [6] FIDO Alliance, “Fido alliance specifications (fido2, ctap, u2f),” https://fidoalliance.org/specifications/, 2025, accessed 2025-1004. [7] Yubico Developers, “Client to authenticator protocol (ctap) overview,” https://developers.yubico.com/CTAP/, 2025, accessed 2025-10-04.