Known-Key Attack. Xxxxx [28] proved that his protocol could withstand the known-key attack. Similarly, our extended protocol can also withstand the known-key attack [19]. We suppose two parties use the 12 common session keys. Our rA3 = g k’A3 mod p, extended protocol may withstand the known key attack. We derive gxAxB as follows: gxAxB = g(xXxX + rA1kA)(sBrB+rB1kB) mod p = gsAsBrArB · gsArArB1kB · g sBrBrA1kA · g kAkBrA1rB1 mod p = gsAsBrArB · gsArArB1kB · g sBrBrA1kA s’A r’A = x’A− r’A1k’A1 mod q. Because the message cannot pass verification Equation (1), xxx will reject the transmitted message sent from the intruder. · (g (kA1+ kA2+ kA3)(kB1+ kB2+ kB3) rA1rB1 mod p Efficiency Analysis: In Table 1, we can see that our scheme is more = gsAsB rArB ·gsA rA rB1kB · g sBrB rA1kA ·(9 rA1 rB1 efficient than Xxxx-Xxx’x protocol [7], Xxxxx’x mod p i=1Ki) Suppose two parties adopt and publish the common session keys K1, K2, · · · , K10 = gKB1⊕gKB2, and K11 = gKB1 ⊕gKB3, an eavesdropper is still hard to derive the key protocol [28], Shao’s protocol [23], and Xxx et al.’s protocol [16]. Xxxx-Xxx’x protocol establishes n2 common secret session keys in one session within two parties, but only (n2 − 1) can be used for withstanding the known-key attack. In Xxxxx’x protocol, the n2 K12 = gkBrA mod p owing to unknowning common secret keys can be used without suffering from the attack. An improvement of Xxxxx’x protocol secrets rA and rB. Furthermore, if an intruder can obtain all the common session keys from K1 to K12, where the transmitted message involves (rA1, rA2, rA3, rB1, rB2, rB3, sA, sB, proposed by Shao establishes n2 common secret session keys and n2 keys can be used. The first protocol of Xxx et al.’s protocols establishes n2 keys gKB1 ⊕gKB2, gKB1 ⊕gKB3, and gkBrA mod p), and only (n2 − 1) keys can be used. The second it is still hard for the intruder to calculate protocol of Xxx et al.’s protocols establishes n keys gxAxB by intercepting the transmitted message between the two parties. The intruder cannot derive rA and rB from any transmitted message. The security is based on the difficulty of calculating discrete logarithms. Consequently, the extended protocol can also withstand the known-key attack.
Known-Key Attack. When an IoT device shares a secure session key with another device in the network, an adversary 𝒜 who seizes the key cannot obtain the keys of other devices because each key has its own specific parameters 𝑥, 𝑦, 𝐾𝑖 , 𝐾𝑗 , and temporary 𝑇𝐼𝐷. To overcome this challenge, the adversary must solve Elliptic Curve Discrete Logarithm (ECDL) problem, ECDHP problem, and one-way hash function, which is practically infeasible. 𝑝
Known-Key Attack. If an adversary achieves a session key, where session key sk = H(IDU IDL ulP SU ). It does not mean that other session keys can compromise. Because, each session key involves independent short-term se- cret values u and l which are different for each session. Forward secrecy If an adversary achieves entities private keys then, − H alf forward Secrecy: Compromise of the private key (xU , SKU ) of user does not reveal previously established session keys because to achieve a session key, short time secret keys information is needed. Moreover, for given ⟨P, uP, lP⟩ to computation ulP is equivalent to CDH problem. − ⟨ ⟩
Known-Key Attack. In [32], Xxxxx proved that his protocol could resist the known-key attack. For the same reason, our extended protocol can also with- stand the known-key attack [29]. In our extended Xxx will rejects the transmitted message from the intruder because the message cannot pass verification Equation (1).
