## 6 Security Analysis
### Formal Security Analysis Using RoR Model  
As mentioned, I provide the formal security proof of the protocol using the widely accepted ROR model. The analysis is primarily presented for the communication between \(P_{i}\) and \(S_{m}\). The communication between \(P_{i}\) and \(S_{n}\) can also be achieved using similar arguments, so that E2E communication between \(P_{i}\) and \(P_{j}\) is provably secure. In this proof, several games are included where \(\mathcal{A}\) makes various queries discussed in Section 4.3 in order to perform the attacks. The following are the notations used in the proof. * \(L_{hash}\): Length of a hash value. * \(L_{number}\): Length of a random number. * \(L_{biometrics}\): Length of a biometrics value. * \(q_{hash}\): Total number of hash oracle queries. * \(q_{send}\): Total number of _Send_ queries. * \(q_{execute}\): Total number of _Execute_ queries. * \(l_{k}\): List of hash oracle outputs. * \(l_{o}\): List of random oracle results. * \(l_{m}\): List of communicated messages between \(P_{i}\) and \(S_{m}\). * \(\varepsilon_{biometrics}\): Probability of biometrics false positive. * \(C^{\prime},s^{\prime}\): Zipf parameters. Figure 4: Password and biometrics update procedure of the proposed protocol. **Definition 5**. : \(\mathbb{C}\) _enters an accepted state after receiving the last message in the session. All communicated messages \(M_{1}=\{C_{i,m1},C_{i,m2},T_{i,m}\}\) and \(M_{2}=\{\theta_{m,i}\}\) are concatenated, forming a session with the identification \"s_id\"._  
**Definition 6**. : _There are some conditions for \(P_{i}^{T_{c}}\) and \(S_{m}T_{i}^{*}\), as follows: (1) they are in an accepted state; (2) they mutually authenticate each other in the same session s_id; and (3) both are mutual partners of each other. \(P_{i}^{T_{c}}\) and \(S_{m}T_{i}^{*}\) are called \"partners\" if they simultaneously satisfy all the conditions._  
**Definition 7**. : _There are some conditions for \(\mathbb{C}\), as follows: (1) \(\mathbb{C}\) is in an accepted state; (2) the query Reveal(\(\mathbb{C}\)) was never submitted; and (3) fewer than two \(Corrupt(P_{i},x)\) queries were submitted. \(\mathbb{C}\) can satisfy the freshness rule if \(\mathbb{C}\) simultaneously meets all the conditions. In fact, my protocol would still be safe even if \(\mathcal{A}\) submits queries \"\(Corrupt(P_{i},1)\) and \(Corrupt(P_{i},3)\) \" or \"\(Corrupt(P_{i},2)\) and \(Corrupt(P_{i},3)\) \", since \(\mathcal{A}\) is not able to compromise the masked credentials stored on the smart card._  
**Definition 8**. : _Let \(Adv_{\mathcal{A}}^{ECDHP}(t_{\mathcal{A}})\) be the advantage of \(\mathcal{A}\) in breaking the ECDLP assumption. Since the assumption holds, \(Adv_{\mathcal{A}}^{ECDHP}(t_{\mathcal{A}})\) is defined as a negligible probability with execution time \(t_{\mathcal{A}}\)._  
**Definition 9**. : _Let \(Adv_{\mathcal{A}}^{ECDHP}(t_{\mathcal{A}})\) be the advantage of \(\mathcal{A}\) in breaking the ECDHP assumption. Similarly, \(Adv_{\mathcal{A}}^{ECDHP}(t_{\mathcal{A}})\) is defined as a negligible probability with execution time \(t_{\mathcal{A}}\)._  
**Definition 10**. : _The value \(max\Big{\{}C^{\prime}\,d_{send}^{s^{\prime}},q_{send}\Big{(}\frac{1}{2^{l_{ kimetrics}}},e_{biometrics}\Big{)}\Big{\}}\) is sufficiently small, so that \(\mathcal{A}\) cannot guess the credentials of \(P_{i}\)[19]._  
**Theorem 1**. : _Since \(\mathcal{A}\) has the following negligible probability of breaking our security system, the proposed protocol is semantically secure._  
\[ \begin{array}{l}Adv_{\mathbb{C}}^{DNAHC}\leq\frac{(q_{sent}+q_{execute})^{3}+6q_{send}}{2^{l_{ human}}}+\frac{q_{hash}^{2}+14q_{hash}}{2^{l_{hash}}}\\ +2 max\Big{\{}\Big{(}C^{\prime}\,d_{send}^{s^{\prime}}\Big{)},q_{send}\Big{(} \frac{1}{2^{l_{kimetrics}}},e_{biometrics}\Big{)}\Big{\}}\\ +6q_{hash}(q_{send}+q_{execute}+1)Adv_{\mathcal{A}}^{ECDHP}(t_{\mathcal{A}}) \\ +2q_{hash}(q_{send}+q_{execute}+1)Adv_{\mathcal{A}}^{ECDHP}(t_{\mathcal{A}}) \end{array}  \tag{1}\]  
**Proof.