# Two-Level-Composite-Hashing Facilitating Highly Efficient Anonymous IoT and D2D Authentication
## 5 Security Analysis and Performance Evaluation
### The Performance Evaluation  
In this section, we evaluated the performance of the proposed schemes, and compare them with its counterparts. Here, we concern the computation cost and the communication cost (the message lengths and the number of message rounds). Even though there are many works addressing either the D2S authentication or the D2D authentication, their target scenarios and functions are quite different. Therefore, we have to sort out the scenarios and the functions first, and then compare our schemes with the counterparts to have a fair comparison. Table 3 lists the target scenarios and functions of several D2S/D2D authentication schemes. In Table 3, Column 2 lists the target scenarios. Chien [11] focuses on the D2S authentication only, and Chien [25] addresses both the D2S authentication and the D2S group authentication; our proposed schemes and the schemes [15; 16; 18] address the D2D authentication, while the schemes [13; 20] addressing the D2D group authentication. SecD2D [18] proposed a near-field D2D authentication, using accelerator sensors, speakers, and microphones; it fits only the near-field D2D cases where the owner of the device should actively participate the authentication process; it is a special application case, and, therefore, we would not include it in the detailed performance comparison. The preproof version [21] still has several typos and errors in the equations, and it would not be included in the comparison. In Table 3, Column 3 lists the main security goals, and Column 4 specifies the mechanisms to achieve the anonymity if it applies. Our schemes and the schemes [12; 13; 15; 16; 18; 22] all address the anonymity challenge while only our schemes and [22] tackling the unlinkability challenge. To achieve anonymity, the schemes [12; 13; 15; 16; 18; 22] adopt pseudonyms, and bind either PKC certificates or certificateless public keys (CLPKs) [12; 22] to the pseudonyms. These pseudonyms and the corresponding certificates (or CLPKs) are valid for a period of time, and need to be renewed periodically [13; 15; 16; 18]. That is why they can only achieve anonymity but not unlinkability. This approach of using pseudonym-bound certificates or pseudonym-bound CLPKs have several critical weaknesses; first, correlating transmissions of the same pseudonyms can link the transmissions and might reveal sensitive information about the entities; second, it is costly to renew the certificates and CLPKs. In [12], the level-1 IoT devices are responsible for the registration and management of the level-2 IoT devices; therefore, the level-1 devices are more like a server but not resource-limited IoT devices; furthermore, a single compromised level-2 device can impersonate any other devices in the D2S group authentication, because the session key computations only use the public values and one single group secret. The D2D group authentication of [22] use lots of intensive computations like signatures, batch signatures, and especially the pairing-based IDPE [26]. Column 5 lists the cryptographic algorithmsused. We can see that several of them adopt pairing-based PKCs or pairing-based CLPKs; these schemes demand intensive computations. After identifying the target scenarios and the security goals in Table 3, we now compare the performances of our schemes with their counterparts in Table 4. Let \(T_{h}\) denote the computation cost for one hashing; \(T_{EC_{M}}\) denotes the cost for one point multiplication in the ECC setting; \(T_{EC_{A}}\) denotes the cost for one point addition in the ECC setting; \(T_{exp}\) denotes the cost for one exponentiation in the GF(\(p\)) field; \(T_{mlp}\) denotes the cost for one multiplication in the GF(\(p\)) field; \(T_{ENC}\) denotes that for either one symmetric encryption or one decryption; \(T_{pair}\) denotes that for one pairing computation; \(T_{SIG}\) denotes that for one ordinary signature generation or one signature verification; and \(T_{PE}\) denotes that for one identity-based prefix encryption. The second column of Table 4 summarizes the computational cost.