## 3 Results and Discussion
### The AVISPA Results
* Replay attack: Assume that the adversary intercepts the messages \(M_{1}=[SN_{ID},TID_{i}\), \(CT_{i}]\), \(M_{2}=SN_{ID},CT_{j}\), \(M_{3}=SN_{ID},B_{i},Z_{i},TS_{3}\), and tries to tamper with the content before passing it to the receiver so that the receiver will not be aware of the modified messages. In the proposed scheme, the messages are encrypted, say \(CT_{j}=E_{SK_{j}}[HGW_{ID},SN_{ID},PID_{i},N_{i}^{*},N_{j},P_{i},TS_{2}]\), which involves random nonce, timestamp, and \(PID_{i}\). The receiver checks the condition of the timestamp and random nonce before any processing of the received message. Furthermore, the parameters are encrypted using the shared key \(SK_{j}\), which is computationally infeasible for the attacker to generate and obtain the parameters. If the attacker generates the secret key, he/she does not know \(PID_{i}^{*}=h(U_{ID}\parallel R^{*})\) because it is protected using a one-way hash function and involves a secret value \(R^{*}\). Therefore, the proposed scheme withstands a man-in-the-middle attack. * Smart card stolen attack: Assume that an attacker steals the user's smart-card SC and extracts the value \(TID_{i},\sigma,T_{i}\) and \(S_{i}\). The attacker will not be able to compute \(T_{i}=h(U_{ID}\parallel\sigma)\oplus R,S_{i}=h(PID_{i}\parallel PVR_{i} \parallel\sigma)\) since they are computed using the biometric key data. Furthermore, the adversary cannot compute \(PID_{i}=h(U_{ID}\parallel R)\) because it is protected using a one-way hash function. Thus, without knowing the user information, the adversary cannot generate the login message. Therefore. the proposed scheme protects against smart card stolen attacks. * Sensor Capture attack: In a harsh environment, the attackers quickly capture the sensor nodes. If the attacker captures the node SN, he/she will extract the secret information \((SN_{ID},A_{j})\), where \(A_{j}=h(SN_{ID}\parallel SN_{MSK})\) is computed using the \(SN_{MSK}\), which is a secret value not known to other participants. Therefore, identifying the sensor secured with the one-hash function cannot negatively affect the sensor node nor can it disrupt the authentication process between the agricultural professional and the sensor node. Therefore, the proposed scheme protects against sensor capture attacks. * Agriculture professional/sensor node untraceability: Assume that the attacker eaves-drops on the authentication messages from different sessions and checks whether the messages are the same. If they are the same, both messages are sent by identical identities, e.g., agriculture professional or sensor node. However, despite recording the authentication message and stealing \(M_{1}=[SN_{ID},TID_{i},CT_{i}]\), \(M_{2}=SN_{ID},CT_{j}\), \(M_{3}=SN_{ID},B_{i},Z_{i},TS_{3}\), the adversary cannot trace the agriculture professional or the sensor node because these messages are comprised of the random nonces \(N_{i}^{*},N_{j}\), and timestamps \(TS_{1},TS_{4}\), which are generated freshly in every session separately, leading to a new formation of the messages. Therefore, the user anonymity and sensor node cannot be traced. * User anonymity: The adversary in this attack tries to obtain the user information when the messages are transmitted via a public channel in their original form. The user sendsthe messages, say \(M_{1}=[SN_{ID},TID_{i},CT_{i}]\), \(M_{2}=SN_{ID},CT_{j}\), \(M_{3}=SN_{ID},B_{i},Z_{i},TS_{3}\) to the gateway, and the transmitted messages do not contain any identity of the agriculture professionals. Additionally, the messages are sent in encrypted form where \(CT_{i}=E_{SK_{i}}[HGW_{ID},SN_{ID},W_{i},N_{i},TS_{1}]\) using the freshly generated shared secret key. The messages are further formed using an irreversible hash operation. Thus, each message that comes from the same user is different from one session to another. Therefore, the scheme guarantees user anonymity. * Forward secrecy: In the proposed scheme, the long-term key \(SK_{i}\) is disclosed to the user only, and the session key is also kept securely.