# Secure and Efficient Authentication Scheme in IoT Environments
## 4 Cryptoanalysis of the Proposed Protocol
### Informal Security Analysis
Therefore, even if the present session key (\(S_{K}\)) is leaked, the adversary cannot determine all the past session keys, as the session key also depends upon the random secrets (\(x_{i}\) and \(x_{j}\)), whose security is protected by the concept of ECDLP; the security of \(S_{K}\) is protected by the concept of ECDLP and CDHP. Hence, the proposed scheme is secure against forward secrecy attacks. Privileged insider attacks: In the proposed scheme, during the registration of a device, \(ED_{i}\) sends \(I_{i}=H(ID_{i}||psw_{i})\), instead of sending the password \((psw_{i})\), securely over the trusted channel (e.g., wolfSSL). After successful registration, the product is handed over to the owner by the company. Since the owner cannot extract any data \(<psw_{i},~{}I_{i},~{}CID_{i},~{}CK^{\prime}>\) from device ED\({}_{i}\) due to its tamper-proof design, the advisor of \(TS\) cannot acquire the secret \(psw_{i}\) because it is ensured by \(ED_{i}^{\prime}s\) identity and \(h(0)\). Thus, the privileged insider from \(ED_{i}\) will fail to impersonate the legitimate \(ED_{i}\). Hence, the proposed scheme is secure against \(ED_{i}\) insider attacks. However, a \(TS\) adversary can steal information from server \(TS\) for the device \(ED_{i}\). Thus, in such a case, the proposed scheme is less secure against privileged insider attacks. * Known session-specific temporary information attacks: After successful authentication, both the communicating \(ED_{i}\) and \(TS\) compute the session key \((S_{K}=x_{i1}.X_{j}.~{}Psw_{i}.P_{ks}=x_{j1}.X_{i}.S.P_{ke})\), whose security is protected by ephemeral secrets \(x_{i1}\) and \(x_{j1}\). Suppose that an adversary somehow discovers the ephemeral secret \(x_{i1}\) or \(x_{j1}\). In this case, the adversary cannot derive the session key \((S_{K})\) only with the knowledge of a single ephemeral secret since the security of \(S_{K}\) still depends on \(Psw_{i}\) or \(s\). Therefore, to derive the session key, the advisor must determine \(<Psw_{i},s>\) from the past session key \((S_{k})\), which, in turn, seems to be computationally infeasible because of the difficulties in solving CDHP and ECDLP for pairs, which are difficult to comprehend using a polynomial-time algorithm. Thus, the proposed scheme is securely infeasible to a known session-specific temporary information attack. * Attacks on user anonymity: Device anonymity implies that an attacker cannot discover the device's concealed identity \((ID_{i})\) by using the transmitted messages during the login and authentication phases. Here, a company that is selling device \(ED_{i}\) does the registration process itself and hides \(ID_{i}\) inside identity \((I_{i})\) using the hash function \(h(0)\). In addition, during the registration process, the company does the registration process with the server by sending \(<I_{i},~{}psw_{i}>\) through a secure channel. Then, the company hands over the tamper-proof product to the owner. Therefore, the security of \(I_{i}\) is well protected by the tamper-proof design of \(ED_{i}\). Furthermore, the security of \(I_{i}\) is well secured in \(CID_{i}\) using a secret key \((s)\) and a random number \((R)\) with the assistance of the hash function \(h()\). Moreover, both \(s\) and the \(R\) are neither sent through any message nor stored in the \(ED_{i}\) and \(TS\) in the plaintext format. Hence, the proposed scheme is securely infeasible to attacks on user anonymity. * Database attacks: In this case, if an attacker makes a server database attack, the attacker will be unsuccessful in breaking the table of the server database as the security of the server and the database is protected by an encryption key \(E_{ks}=s.~{}Id_{TS}.G\), whose security is protected by ECDLP and CDHP. Therefore, an attacker will be unable to extract either \(s\) or \(Id_{TS}\) from \(E_{ks}\). In addition, even if the attacker gets it by any means, the attacker still unable to extract \(Id_{TS}\) from \(E_{ks}\).