Original title: Hardware-assisted zero-knowledge authentication scheme for resource-constrained IoT terminals: USBKEY implementation and evaluation based on GSVOLE-2DLC
Jianxin Wang, Zifan Xu, Runze Zhou, Chaoen Xiao +1 · September 2026
Small Internet of Things devices need to log in safely without wasting power or leaking private data. Standard logins use static passwords or security keys that attackers can steal, replay, or fake. To fix this, researchers created a new login scheme that uses a USBKEY device. It relies on a zero-knowledge proofA way to prove you know a secret without revealing any part of the secret itself., which is a clever math method that lets a device prove who it is without sending actual identity credentials over the network. During setup, the system saves special setup parameters to the key. When logging in, the server sends a random math challenge. The key uses hidden local data to solve the challenge and send back temporary proof values. The server then checks the math to confirm identity. In tests using a 64-bit setup, the full login took about 0.5476 s, while the server took only 0.0031 s to verify.
Imagine you want to prove to a security guard that you know the code to a locker without telling him the digits. You write the code on a piece of paper, seal it in an envelope, and hand it over. On a new piece of paper, he writes a random question: 'What is the third digit?' You peek at your envelope, write the answer on a slip, and seal it. He opens his own copy and checks that your answer matches his expectation—but he never opened your envelope. In this paper, the USBKEY holds the secret like the sealed envelope, and the server's challenge is the random question, so the server verifies the proof without ever learning the actual credentials.
IoT devices like sensors and controllers are too weak to run heavy encryption. This means they often rely on passwords or certificates that can be stolen, replayed, or faked. This paper shows a way for those tiny devices to prove who they are—using a cheap USB key—without ever sending their secret across the wire, keeping credentials safe even if the network is tapped.
The abstract reports performance for one specific parameter set (64-bit prime field, n_C=4, k_C=3, d_C=3, ℓ=2, t=7) on a PowerPC USBKEY prototype. It does not evaluate security against all possible attacks or compare directly to deployed systems. It also does not discuss power consumption, latency on other hardware platforms, or usability in large-scale networks with many simultaneous authentication requests.
Ask anything about this paper. Answers come from its abstract, and say so when the abstract doesn't cover your question.
Hardware-assisted zero-knowledge authentication scheme for resource-constrained IoT terminals: USBKEY implementation and evaluation based on GSVOLE-2DLC — Jianxin Wang, Zifan Xu, Runze Zhou et al. — Journal of King Saud University - Computer and Information Sciences — doi:10.1007/s44443-026-01300-6
Abstract licence: CC BY
Explanation generated by Synthesis from the abstract — it is not the original paper.