  Continuous authentication has been proposed as a complementary security
mechanism to password-based authentication for computer devices that are
handled directly by humans, such as smart phones. Continuous authentication has
some privacy issues as certain user features and actions are revealed to the
authentication server, which is not assumed to be trusted. Wei et al. proposed
in 2021 a privacy-preserving protocol for behavioral authentication that
utilizes homomorphic encryption. The encryption prevents the server from
obtaining sampled user features. In this paper, we show that the Wei et al.
scheme is insecure regarding both an honest-but-curious server and an active
eavesdropper. We present two attacks: The first attack enables the
authentication server to obtain the secret user key, plaintext behavior
template and plaintext authentication behavior data from encrypted data. The
second attack enables an active eavesdropper to restore the plaintext
authentication behavior data from the transmitted encrypted data.
