Informal Security Analysis. We now informally discuss the strength of the proposed protocol with respect to the required security features for an identity-based mutual authentication scheme, to be applied in a SG context [10,11]. • Resistance against replay attacks. There are two options, either M1 is replayed in the same period of R2 usage or it is replayed when a new R2 is determined by the SP. In the first case, the same key as before is derived. However by capturing M2, which is a hash value containing the SK, no additional information can be derived by the attacker. If the server keeps track of the parameters R1 sent during the period in which R2 remains constant, further action of the SP can be avoided. In the second case, a new session key is generated by the SP. However, when checking the hash value S1 a contraction is found by the SP as the SK is different. The session is then stopped immediately. • Resistance against impersonation attacks. There are again two options, impersonation of messages M0 and M1. First, it is impossible to impersonate the message M0 as it is used to construct the SK by both the SM and the SP. Even if the SM is using R2, sent from a malicious entity, the corresponding SK computed by the SM will not correspond with the SK computed by the SP and at the point where S1 is validated. At that moment, the session will be terminated. Also impersonation of the message M1 sent by the SM is impossible. This follows from the fact that M1 consists of the parameter R1. Only the SP is able to derive from R1 the common shared key K with the SM in order to decrypt the ciphertext C for finding the identity and certificate of the SM. From these two parameters and the strength of the ECQV certificate mechanism, the SP can construct the corresponding public key PA of the SM. The construction of the SK by the SP exploits the usage of this public key PA and its own private key dB, which is also derivable by the SM who is in possession of the correct corresponding private key dA and the public key PB of the SP. Consequently, it is impossible for an attacker to impersonate M1 without knowledge of a valid private-public key pair of a SM or to impersonate M2 without knowledge of the private key dB of the SP. • Anonymity. From the messages X0, X0, X0 sent in the protocol, no information on the identity of the SM can be derived. The only identity related information is hidden in the message C, which is encrypted using a key only derivable by the SP. • Resistance against DoS atta...
Informal Security Analysis. It is proved in this section that the proposed protocol provides security measures for D2D key agreement protocol. Table 4 compares the proposed protocol with other existing protocols in features and resisting known attacks.
Informal Security Analysis. In this subsection we give informal proof of the security of M2MAKA-FS basing on CK security model. Firstly, we show that the protocol M2MAKA-FS is SK secure under CK SK security and that it satisfies the AKA protocol properties as well as the security and privacy goals. Proposition 1: M2MAKA-FS is SK secure under the CK model.
Informal Security Analysis. Thus, it is difficult for an adversary to identify a particular UAV and this forms the basis for the proposed protocol’s robustness against attacks on UAV anonymity.
Informal Security Analysis i. Resistance to UKS Attack: This attack [23] is an attack whereby 𝑂𝐵𝑈𝑖 ends up have confidence in that he has key shared with 𝑂𝐵𝑈𝑗 and although in fact the case, 𝑂𝐵𝑈𝑗 shares the key with adversary who is not 𝑂𝐵𝑈𝑖. This attack targets the protocols with good authentication and freshness in key. Adding of user identity to the message will restrict the unknown key share attack. In the proposed technique, vehicle identity is encrypted and then communicated to the other vehicle which is involved in the communication.
ii. Session key leakage. The secret variables used in the session are generated from random numbers and common key agreed by both the vehicles involved in the communication, hence it changes at each session. The leakage of key in a session does not compromise in security of other session keys.
iii. Key control attack: The common SK is calculated by using random numbers, session key T and both vehicle identities. Consequently, if the attacker corrupts one of the entities, it will still not be able to determine the SK derived from the corrupted values.
iv. User obscurity and untraceability: An attacker, may be a mischievous device or a software, cannot retrieve the identities of the on board units even if it intercepts all the messages which are exchanged during the key agreement phase. Indeed, the identities are shared in encrypted form. Moreover, session key value is depending on random numbers 𝑁𝑖 and 𝑁𝑗.
v. Resistance to insider attack enhancement: In general, the password is stored on TA in the form of plain text, the TA may carelessly use of it. So, in the proposed technique, the user decides his ID and password, send (𝐼𝐷𝑖, ℎ(𝑝𝑤𝑖)) to XX.xx, TA is not required to recalculated because of the one-way feature of the hash function. So, TA cannot misuse the password.
Informal Security Analysis. 47 Within this subsection, we illustrate the resilience of USAF- 48 IoD by evaluating its resistance to the following significant 49 potential security threats.
50 1) Replay Attack
Informal Security Analysis. This section addresses a detailed security evaluation to indicate that the proposed scheme is secure against various known security attacks. Suppose that an adversary A can eavesdrop, intercept, modify, delete or replay the transmission over a public channel.
Informal Security Analysis
