Multi-factor simple password exponential key exchange (SPEKE) authentication

A non-transitory machine-readable storage medium storing instructions which, when executed, cause a processing device to:

• receive, by the processing device of an authentication server over a public network, an authentication request and a first public key from a client device, wherein the first public key generated by the client device, and wherein the authentication request comprising:
• a user identifier;
• first factor data associated with the user identifier, wherein the first factor data comprises a password, and wherein the password is stored in a storage associated with the authentication server prior to receiving the authentication request;
• and
• second factor data associated with the user identifier, wherein the second factor data comprises one of:
• a one-time password, wherein the one-time password is different than the password;
• or
• biometric data;
• and
• generate a session key that is a function of a combination of the first factor data, the second factor data, and the first public key received from the client device, wherein the combination comprises determining a generator value by:
• combine, by the processing device of an authentication server over a public network, the first factor data with the second factor data to generate a combined value, wherein combining comprises one of concatenating the first factor data with the second factor data or calculating an exclusive-OR of the first factor data and the second factor data;
• and
• calculate a hash value of the combined value.

A server, comprising:

• a memory to store a first factor data and a second factor data;
• and
• a processing device, operatively coupled to the memory, the processing device to:
• receive, over a public network, an authentication request and a first public key from a client device, wherein the first public key generated by the client device, and wherein the authentication request comprising:
• a user identifier;
• first factor data associated with the user identifier, wherein the first factor data comprises a password, and wherein the password is stored in the memory prior to receiving the authentication request;
• and
• second factor data associated with the user identifier, wherein the second factor data comprises one of:
• a one-time password, wherein the one-time password is different than the password;
• or
• biometric data;
• and
• generate a session key that is a function of a combination of the first factor data, the second factor data, and the first public key received from the client device, wherein the combination comprises determining a generator value by:
• combine, by the processing device of an authentication server over a public network, the first factor data with the second factor data to generate a combined value, wherein combining comprises one of concatenating the first factor data with the second factor data or calculating an exclusive-OR of the first factor data and the second factor data;
• and
• calculate a hash value of the combined value.