# Secure and Efficient Authentication Scheme in IoT Environments
## 4 Cryptoanalysis of the Proposed Protocol
### Informal Security Analysis  
For ensuring the security of the proposed scheme, we used the collision-free one-way hash function and two hard problems: the ECDHP and the CDHP. We analyze and summarize the main security benefits of our proposed scheme. The proposed scheme targets optimized performance at a lower cost. Therefore, in this subsection, we present how the proposed scheme is secure against various cryptographic attacks that affect the performance of the authentication scheme. Furthermore, we compare the proposed scheme with the existing approaches by utilizing security attributes to explain its efficiency, as follows:  
* Replay attacks: In this attack, an adversary may impersonate a legitimate user by reusing the message \(<CID_{i},\ X_{i},Y_{i}>\), obtained from a previous protocol run, and transferring it to the \(TS\). After receiving the login request, \(TS\) computes and verifies whether \(h(X_{i}.CK)=?Y_{i}\) and sends back new challenges \(<X_{j},Y_{j},T>\) to \(ED_{i}\). However, after impersonating the messages \(<X_{j},Y_{j},T>\) sent to \(ED_{i}\), the attacker would be unable to compute \(A=T\oplus I_{i}\oplus CK^{\prime}\) without knowing \(I_{i}\) and \(CK^{\prime}\). Notably, both \(CK^{\prime}\) and \(I_{i}\) are neither sent through any messages over public channels nor can they be acquired from the embedded device \((ED_{i})\) because of its tamper-proof design. Thus, it cannot verify the challenge \(C_{i}=H(Y_{i}||A)\). Without the knowledge of the secret key \(x_{i1}\) and \(x_{j1}\) of the device and server, the attacker cannot compute the valid session key \((S_{k}=x_{i1}.X_{i}.Psw_{i}.P_{ks}=x_{j1}.X_{i}.S_{Rce})\). Additionally, the security of the session key is well protected by ECDLP and CDHP. Therefore, it almost impossible to extract the private key \(<Psw_{i},\ s>\) of the device and the server in polynomial time. Hence, the proposed scheme is secure against replay attacks. * Password-guessing attacks (or confidentiality): In the proposed scheme, an embedded device password \(psw_{i}\) is stored in the form of a password generator (i.e., public key \((E_{ke}=psw_{i}.G)\)) and wrapped in the form of \(I_{i}=H(ID_{i}||psw_{i})\). Consequently, the attacker cannot guess the password \(psw_{i}\) without knowing \(I_{i}\) and \(P_{ke}\). Therefore, the proposed scheme maintains the security of the password by using ECDLP and a hash function \((h())\). Notably, \(I_{i}\) of \(ED_{i}\) is neither sent through any messages over an open public channel nor can it be acquired from the embedded device \((ED_{i})\) because of its tamper-proof design (i.e., nor is it stored in the \(ED_{i}\) or \(TS\)). Therefore, the proposed scheme prevents password-guessing attacks. * Embedded device impersonation attacks (or key compromise impersonation attacks): In this case, an attacker impersonates real embedded devices \((ED_{i})\) by replaying a previously intercept message to the server (\(TS\)). However, an attacker will still lack \(ED_{i}\)'s secret parameters \(<psw_{i},\ I_{i},\ CK^{\prime}>\) because the secret parameters are protected due to the tamper-proof design of \(ED_{i}\). In addition, \(psw_{i}\) of \(ED_{i}\) in \(I_{i}=H(ID_{i}||psw_{i})\) and in \(E_{ke}=psw_{i}.G\) is protected by hash function \(h()\) and ECDLP, respectively. Therefore, the attacker unable to compute \(A=T\oplus I_{i}\oplus\ CK^{\prime}\) correctly without knowing parameters \(<I_{i},\ CK^{\prime}>\). This will result in an incorrect deduction \(h(X_{j}.A)=?Y_{j}\), which will lead to the termination of the session. Furthermore, an attacker will be unsuccessful in extracting \(Psw_{i}\) from the past session key (\(S_{k}=x_{i1}.X_{i}.Psw_{i}.P_{ks}\)), whose security is protected by ECDLP and CDHP. Therefore, an attacker is unable to compute a session key \(S_{k}\) for a current session without knowing \(Psw_{i}\). Therefore, for the above reasons, an attacker will fail to launch embedded device impersonation attacks on \(ED_{i}\).