## 6 Security Analysis
### Informal Security Analysis  
In this subsection, I further discuss the various security features of the proposed protocol and explain its resistance to multiple well-known attacks. The analysis primarily involves the communication between \(P_{i}\) and \(S_{m}\). Similar arguments can be used to analyze the communication between \(P_{j}\) and \(S_{n}\), thereby assuring \(P_{i}\) and \(P_{j}\) securely share an E2E common key. The details are as follows. _User anonymity, user untraceability and message unlinkability:_ The identity \(ID_{i}\) of \(P_{i}\) is masked in \(c_{i,m21}\) of the message sent by \(P_{i}\). The message conveyed by \(S_{m}\) also does not make the \(ID_{i}\) publicly visible. Therefore, \(ID_{i}\) cannot be revealed to \(\mathcal{A}\) during transmission of the messages. Each value contained in message \(\{C_{i,m1},C_{i,m2},T_{i,m}\}\), message \(\{\delta_{m},Cert_{m}\}\) and message \(\{\theta_{m,i}\}\) of each session is completely not identical, since they are computed using different random numbers and timestamps. Therefore, it is not possible for \(\mathcal{A}\) to identify any two transcripts conveyed by a single \(P_{i}\). In addition, there are no constants found when linking each value of \(\{C_{i,m1},C_{i,m2},T_{i,m},\delta_{m},Cert_{m},\theta_{m,i}\}\) with each other for the purpose of tracing. Thus, the proposed protocol simultaneously achieves user anonymity, user untraceability and message unlinkability. _Robust mutual authentication:_ Based on the login request message \(\{C_{i,m1},C_{i,m2},T_{i,m}\}\) from \(P_{i}\), \(S_{m}\) computes \(Z_{m,i}\) using its private key \(prk_{m}\) in order to retrieve \(u_{i,m},ID_{i}\). \(S_{m}\) verifies the legitimacy of \(P_{i}\) by checking whether \(u_{m,i}=h(ID_{i}||prk_{m})\). On the other hand, upon receiving the message, \(P_{i}\) decrypts \(\theta_{m,i}\) using \(R_{i,m}\). \(P_{i}\) checks the legitimacy of \(S_{m}\) by confirming whether \(\beta_{i,m}=h(Y_{i,m}||K_{m,i}||ID_{i}||ID_{S_{m}})\). Value \(Y_{n,j}\) sent from \(S_{n}\) is also reliable upon successful checks on \(\delta_{n},Cert_{n}\). If one of the above checks do not hold, the communication will be terminated; otherwise, it allows \(P_{i}\) to compute the E2E key \(K_{i,j}\). Furthermore, in Section 6.2, a mutual authentication proof of communication between \(P_{i}\) and \(P_{j}\) is provided. Thus, my protocol achieves robust mutual authentication. _Perfect forward secrecy:_ Suppose \(\mathcal{A}\) somehow obtained secret values, random numbers or even a session key communicated in the current session. \(\mathcal{A}\) intends to use these values to attack past communications. Since the values are completely different in each communication session, it is not possible for \(\mathcal{A}\) to carry out these attacks. For example, \(\mathcal{A}\) is not able to use the current key \(K_{i,j}^{*}=a_{i,m}^{*}a_{j,n}^{*}b_{m,i}^{*}b_{n,j}^{*}.G\) to decrypt a ciphertext encrypted using a past key \(K_{i,j}=a_{i,m}.a_{j,n}.b_{m,i}.b_{n,j}.G\). Therefore, the conclusion is established. _E2E keysecurity:_ If \(S_{m}\) acts as \(\mathcal{A}\) and attempts to attack the shared key of \(P_{i}\) and \(P_{j}\), \(\mathcal{A}\) needs to know the number \(a_{i,m}\) randomly selected by \(P_{i}\) used to compute \(K_{i,j}=a_{i,m}.K_{m,j}\). Due to the ECDLP, it is not possible to retrieve \(a_{i,m}\) from the given \(R_{i,m}\), where \(R_{i,m}=a_{i,m}.G\). In addition, \(\mathcal{A}\) will not compute the key \(K_{i,j}=(a_{i,m}.b_{m,i}). (a_{j,n}.b_{n,j}).G\) successfully given the values \(Y_{m,i}=(a_{i,m}.b_{m,i}).G\) and \(\big{(}a_{j,n}.b_{n,j}\big{)}.G\) unless \(\mathcal{A}\) is able to break the ECCDHP. Thus, the security of the E2E key is assured. _Resistance to DoS attacks:_ Defending against a DoS attack is one of the toughest tasks in cyber security, since its attack mechanism is mostly based on computer or network resources. In this analysis, I discuss the resistance of the protocol to possible risks of a DoS attack, which may affect communication performance.