# A Robust and Effective Two-Factor Authentication (2 FA) Protocol Based on ECC for Mobile Computing
## 5 Summary Comparison: Functionality and Performance
### Functionality Comparison  
In the following, a comprehensive functionality comparison between the 2 FA protocol and the five most advanced protocols [5; 35; 36; 37; 38] is presented using the evaluation indicators mentioned in Section 5.1. The comparison results are depicted in Table 6, where the notation \(\sqrt[]{}\) means that the protocol demonstrates the property, and \(\mathsf{X}\) denotes that the protocol does not demonstrate the property. As shown in Table 6, the protocol from [5] cannot fulfill \(EC_{5}\) and \(EC_{9}\), since the smart card in [5] stores an explicit password validation parameter and is not resistant against password-guessing attacks and key-compromise user impersonation attacks. Furthermore, smart card revocation of function is not provided in [5]. The protocol in [35] cannot provide user anonymity given the transmission of plaintext identities over an open channel, and clock synchronization attacks cannot be resisted; that is, the protocol in [35] does not demonstrate \(EC_{1},EC_{8}\), and \(EC_{9}\). Further, [PERSON] et al. 's protocol [34] does not demonstrate \(EC_{9}\) and \(EC_{10}\), and [PERSON] et al. 's protocol [37] does not demonstrate \(EC_{5},EC_{8}\), and \(EC_{10}\). Specifically, the protocol in [36] cannot achieve forward secrecy due to the storage of secret key values in the corresponding device [36]. Although only three chaotic-map operations are performed in the protocol in [37], it is still incapable of maintaining forward secrecy once the long-term key is compromised. In addition, the password validation parameter is stored explicitly in the smart card and the plaintext identity is transmitted over the open channel in [PERSON] et al. 's protocol [37], which makes it easy for the attacker to intercept, resulting in the information from the communicator not being synchronized. Similarly, [PERSON] et al. 's protocol [38] is vulnerable to password-guessing attacks and smart-card-loss attacks due to the smart card storing an explicit password validation parameter. Accordingly, [38] does not demonstrate \(EC_{3}\) and \(EC_{5}\). In general, by observing the Table 6, it can be deduced that the proposed 2 FA protocol is the only one that meets the expected security and usability goals and is immune to various known attacks. The proposed 2 FA protocol is the only protocol that is resistant against diverse known attacks and can meet the ideal safety and availability goals. \begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Protocols**} & \multirow{2}{*}{**Ref.**} & \multicolumn{8}{c}{**Evaluation Criteria**} \\ \cline{2-11}  & & \(EC_{1}\) & \(EC_{2}\) & \(EC_{3}\) & \(EC_{4}\) & \(EC_{5}\) & \(EC_{6}\) & \(EC_{7}\) & \(EC_{8}\) & \(EC_{9}\) & \(EC_{10}\) \\ \hline [PERSON] et al. (2013) & [36] & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) & \(\times\) & \(\times\) \\ \hline [PERSON] et al. (2015) & [38] & \(\surd\) & \(\surd\) & \(\times\) & \(\surd\) & \(\times\) & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) \\ \hline [PERSON] et al. (2016) & [35] & \(\times\) & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) & \(\times\) & \(\times\) & \(\surd\) \\ \hline [PERSON] et al. (2018) & [37] & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) & \(\times\) & \(\surd\) & \(\times\) & \(\surd\) & \(\times\) \\ \hline [PERSON] et al. (2018) & [5] & \(\surd\) & \(\surd\) & \(\surd\) & \(\times\) & \(\surd\) & \(\surd\) & \(\surd\) & \(\times\) & \(\surd\) \\ \hline
2 FA protocol & [-] & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Functionality comparison of relevant AKA protocols.