Length of the parameters. We first start with a discussion on the required minimum lengths of the parameters in our system aiming 128 bit security. 1 – |ci |, |cm| ≥ 256: For an attacker eavesdropping on the channel, the hash function H1 should be resistant for pre-image attacks. It should not be possible to derive DKi, given the intercepted message containing DIDi, R1, ci . This would lead to another value for DKi satisfying the first part of the hash function. However, the probability decreases to 2(|ci |+|ci |+|ci |+|ci |)/2 in order to be the correct one as the resulting session key is built using the next three output values of the hash function. The main security problem comes from an active attacker that can launch a desynchronization attack if the length of ci is smaller than 256 bits. In this attack, the active attacker intercepts all messages during a fixed period sent from the MEC node to the devices in the field such that the final response never receives the IoT device with identifier DIDi, while the TTP at the cloud server has updated its database. In normal circumstances, this is not a problem as the TTP has stored also the previous identity and key values of the device. But in the case of the active attacker, it can cause final desynchronization if (s)he intercepts the request of XXXx for the second time and replaces it by DIDi, R1∗, ci , where DK∗, R∗ are other values for which the hash operation results in the same output ci , corresponding with a pre-image attack. As a consequence, the TTP considers the request valid and proceeds the process in which again the identity and key values are updated, removing now the original parameters of the device definitely. The same reasoning holds for the length of cm. 3 4 – |ci |, |ci |, |ci |, |cm|, |cm|, |cm| ≥ 128: The next output values of H1, being c2, c3, c4 for both IoT and MEC node, correspond with the dynamic identity, dynamic key and session key respectively. Their constraint on the minimum size is de- termined by offering sufficient resistance for brute force attacks since the xor operation is guaranteeing perfect security. – |d3| ≥ 256: The length of d3 equals the minimum output length of a secure hash function, being 256 bits. However, in theory, also a 128 bit output should be sufficient because of the following reasoning. There is due to the birthday attack, a probability of 2|d3 |/2 for a pre-image attack to retrieve another value for SK satisfying H2(SK R1). However, the probability of being the correct one eq...
