Analysis of the Computation Cost rA US, RA2 QIDA + KAS2, and VA H2(sid ǁ ǁ ǁ ←− ∗ ∗ ∗ ←− ←− ǁ ǁ ǁ ǁ ǁ ǁ ǁ ←− − QIDAx QIDBx KAS1x RA1x). The computation cost is three TH plus three TECM plus one TECADD . (2.) In Round 3, A recovers the point XXX0 XXX XXX0, X0(xxx QIDAx QIDBx KAS2x RA1x RB1x KAS3x), KAB dA KAS3 + rA RB1, and SKAB ←− ǁ ǁ ǁ H2(sid KABx RA1x RB1x). The computation cost is two TH plus two TECM plus two TECADD . ←− ∗ ←− ∗ ←− ∗ Xxxxxx X (1.) In Round 2, B calculates QIDB , RB1 rA Q, KBS1 dB US , KBS2 rB US , ←− ǁ ǁ ǁ ǁ ←− − and VB H2(sid QIDBx KBS1x RA1x RB1x). The computation cost is two TH plus three TECM . (2.) In Round 3, B recovers the point KBS3 RSB KBS2, ←− ∗ ∗ ←− ǁ ǁ ǁ ǁ ǁ H2(sid QIDBx KBS2x RA1x RB1x KBS3x), KAB dB KBS3 + rB RA1, and XXXX ǁ ǁ ǁ X0(xxx XXXx XX0x XX0x). The computation cost is two TH plus two TECM plus two TECADD . Server S (1.) In Round 3, S calculates KAS2 ←− dS ∗ RA, QIDA ←− RA2 − KAS2, KAS1 ←− dS ∗ UA, QIDB , H2(sid ǁ QIDAx ǁ QIDBx ǁ KAS1x ǁ RA1x), KBS1 ←− dS ∗ UB, and H2(sid ǁ QIDBx ǁ KBS1x ǁ RA1x ǁ RB1x). The computation cost is three TH We assume that T EXP is the time of one modular expo-
Analysis of the Computation Cost. KAS3x), KAB →− dA ∗ KAS3 + rA ∗ RB1, and SKAB →− H2(sid KABx RA1x RB1x). The computation cost is two TH plus two TECM plus two TECADD . Xxxxxx X (1.) In Round 2, B calculates QIDB , RB1 →− rA ∗ Q, KBS1 →− dB ∗ US, KBS2 →− rB ∗ US, and VB →− H2(sid QIDBx KBS1x RA1x RB1x). The computation cost is two TH plus three TECM . (2.) In Round 3, B recovers the point KBS3 →− RSB −KBS2, H2(sid QIDBx KBS2x RA1x RB1x KBS3x), KAB →− dB ∗ KBS3 + rB ∗ RA1, and SKAB →− H2(sid KABx RA1x RB1x). The computation cost is two TH plus two TECM plus two TECADD . Server S (1.) In Round 3, S calculates KAS2 →− dS ∗ RA, QIDA →− RA2 − KAS2, KAS1 →− dS ∗ UA, QIDB , H2(sid QIDAx QIDBx KAS1x RA1x), KBS1 →− dS ∗ UB, and H2(xxx XXXXx KBS1x We assume that T is the time of one modular expo- RA1x RB1x). The computation cost is three TH EXP nential operation over a large prime number; TH is the plus three TECM plus one TEC ADD
