Formal Security Analysis. We now show that our key agreement scheme offers session key security under the CK adversary model [3,21] and in the random oracle model, following the method of [10,11,22]. The participants U in our scheme are the SM, SP, TTP or a random oracle O, i.e., U = {SM, SP, TTP, O}. Taking into account the CK adversary model, we assume that the attacker can run the following queries. • Hash queries Hi(m) with i ∈ {0, 1, 2, 3, 4, 5}. If m already exists in the list LHi , the value Hi(m) will be returned. Otherwise, a random value will be generated, added to the list LHi , and returned. – Send(0,SP). A random value r2 is chosen to compute R2 = r2P. The output of the query is M0 = {R2}. – Send(M0,SM). A random value r1 is chosen to compute R1 = (r1 + dA)P. Next, K = H1((r1 + dA)PB) is determined, together with C = EK(IDAǁcertA). Then, h1 = H2(IDAǁIDBǁR1 ǁR2ǁPAǁPB) and h2 = H2(IDBǁIDAǁR2ǁR1ǁPBǁPA) are computed to derive SK = H3((( r1 + dA)h1 + dA)(h2R2 +PB)). Finally, S1 = H4(R1ǁ CǁPAǁSK) is computed. The message M1 = {R1, C, S1} is returned. – Send(M1,SP). First, K = H1(dB R1) is determined, leading to IDAǁcertA = DK(C). Then, PA = H0(certAǁIDA)certA + PTTP is derived. Next, h1 = H2(IDAǁIDBǁR1ǁR2ǁPAǁPB) and h2 = H2(IDBǁIDAǁR2ǁR1ǁPBǁPA) are computed, to find SK = H3((r2h2 + dB)(h1R1 + PA)) and check H4(R1ǁCǁPAǁSK) against S1. If the verification is unsuccessful, the session can stop, otherwise S2 = H5(IDAǁIDBǁR1ǁR2ǁPAǁPBǁSK) is computed and M2 = {S2} is the output of the query. – Send(M2,SP). If S2 = H5(IDAǁIDBǁR1ǁR2ǁPAǁPBǁSK) is not valid, then the session is terminated. Otherwise, both SP and SM have successfully negotiated a common secret key SK. – SSReveal(SM). The output of this query results in r1 + dA, h1, h2, R1, C, S1. – SSReveal(SP). The output of this query results in x0, X0, x0, x0, X0. • Test query. In this query, either the established SK or a random value is returned, dependent on the output c = 1 or c = 0, respectively of a flipped coin c. Note that the test query cannot be issued when the SKReveal query, the SSReveal(SM) and Corrupt(SM), or SSReveal(SP) and Corrupt(SP), have been executed. In order to prove the semantic security of the scheme, we consider the following two definitions. The final goal of the adversary A is to distinguish the difference between a real secret session key or a random value, i.e., to successfully predict the output of the test query. If Pr(succ) denotes the probability that the adversary succeeds in its mission, the advan...
Formal Security Analysis. We choose to use Xxxxx-logic [38] to perform the verification of the protocol, which is a non-monotonic logic based verification method for cryptographic protocols. It has been successfully used in several protocols to verify the security claims [27][17][12] and is in particular practical as it is close to real implementation.
6.2.1 The protocol specifications
Formal Security Analysis. In this analysis, we conduct a formal security analysis to show that the proposed scheme is secure. First, we describe the scheme in algorithmic language. As described in the algorithm, the sensor initiates the authentication scheme. It generates a random nonce N, computes an h(MSIdi, Xxx, N), and sends to the remote user R a message composed of [MSIdi, N, h(MSIdi, Idi, N)]. The remote user receives the message. It verifies the integrity of the message by computing the hash of the message. Then, it compares with the received hash. If the check is successful, it generates a random nonce M, else it sends an authentication failure message F1 to the sensor node SN. The remote user checks the sensor location. If the sensor node SN is not in the same covered area as the remote user, then it computes a h(Idi, N, M), and sends to the gateway node G a message composed of [MSIdi, N, M, h(Xxx, N, M)]. Upon receiving the message by the gateway node, it verifies the integrity of the message by computing the hash of the message. Then, it compares with the received hash. If the check is successful, the gateway node generates a random nonce S, computes T = N S, computes h(Xxx, M, S), and sends to the remote user a message composed of [N, M, T, h(Xxx, M, S)]. In the case of a unsuccessful check, the gateway node sends an authentication failure message F2 to the remote user.
Formal Security Analysis. This section covers the formal security analysis of proposed scheme under Xxxxxxx-Xxxxx-Xxxxxxx (BAN) logic [46] , while, this model analyzes the security based on mutual authentication, key distribution, and the strength against session key disclosure. In this logic analysis, Principals are such agents that are involved in a protocol, while Keys are to be used for symmetric message encryption. Few notations that have been used in the BAN security analysis are given as follows: P |≡ X: The principal P believes X, or alternatively, X believes the statement X. P 𝝰 X: P sees X. P receives some message X and may read or repeat it in any message. P| ~ X: P once said X. Earlier in time; P had sent some message X and P believed that message. : P has got jurisdiction over X; or P has authority over X and could be trusted.
Formal Security Analysis. Compared to the num- ber of cryptographic protocols proposed in the lit- erature, security of very few of them have been proved under a formal model. In this work, apart from informal analysis of protocol goals, we pro- vide the security guarantee of the protocols under provable security model.
Formal Security Analysis. A A We describe a model related to formal security analysis, which is described with the help of a game played between malicious and challenger L. The adversary is modeled as a Turing machine, which is simulated to operate in a possible polynomial amount of time (PPT) [22]. The = challenger L models each oracle in the system. .x represents the xth instance of the interactive participant g (MUi, GRSj, CMDi). These oracles allow opponents to randomly issue a series of queries and trigger corresponding responses. The hash-based oracle keeps the hash list LHs. If would execute hash-based query on message y, the challenger initially verifies the parameter using LHs. Upon the successful verification, the challenger returns the response h(y) to the adversary and stores the vector (y, Y ) in the list LHs. This query indicates the ability of an attacker to destroy a legitimate drone and obtain its private key. After the attacker executes the extraction query on the UAV IDu’s identity, the query returns the relevant key to the attacker. This oracle represents the capability of adversary for initiating an active attack. Upon submitting m to .x, the attacker may receive the response from .x along with message m. In relation to the new oracle instance .x, the attacker may launch submitting “Send (.x, Start)” towards oracle. .return the session key SK for the instance . On the other hand, it will return ⊥. Using the The “Reveal” query models the erroneous use of the session key in the session. Upon the execution of Reveal query, in case the instance is effectively created, the challenger would Execute query (Execute (MUi, CMDi)), the adversary may eavesdrop all communication messages . exchanged previously on insecure channel.
Formal Security Analysis. Theorem 5.1: Let U2L be an event that 𝒜 could control GA procedure between OBU and LE shown in Figure 7. Let D be a password dictionary and |D| denotes its size. Let |Hash| be the capacity of the hash function, which is of 2𝑙, where l is the bit length of hash values. Let 𝒜 runs against general authentication procedure of our scheme by performing 𝑞𝑒𝑥𝑒 (execute), 𝑞𝑠𝑒𝑛𝑑 (send) and 𝑞ℎ𝑎𝑠ℎ (hash) queries. Then, 𝐴𝑑𝑣𝑎𝑘𝑒(𝒜) = 𝑞ℎ𝑎𝑠ℎ2 + 2𝑞 ∗ 𝑚𝑎𝑥 1 , 𝜀) (1) |𝐻𝑎𝑠ℎ| 𝑠𝑒𝑛𝑑 |𝐷|
