Effective And Secure Two-Factor Multi Server Authentication Scheme Without Password

This paper presents a secure two-factor, password-less authentication scheme designed for multi-server environments. The proposed approach eliminates the use of traditional passwords to address common security vulnerabilities and enhance system security. It combines asymmetric cryptography with Time-Based One-Time Passwords (TOTP) to provide strong user authentication. In this scheme, a user signs a server-generated challenge using a private key, which is verified by the server through the corresponding public key. An additional layer of security is provided by validating a TOTP generated through an authenticator application within a defined time window. The architecture separates registration and authentication across multiple servers, improving scalability and flexibility. The scheme effectively resists brute-force, phishing, and replay attacks while maintaining a smooth and user-friendly authentication experience.