## 4 The Proposed 2 FAKA-C/S Protocol
### Login and Mutual Authentication Phase  
After \(U_{i}\) registers with \(S_{j}\) effectively, \(U_{i}\) runs the login operation (L1) and subsequent authentication steps (Auth.1-Auth.2) with \(S_{j}\).  
**L. 1**.: \(U_{i}\) inputs \(1D_{i}^{\prime}\), \(PW_{i}^{\prime}\) to \(SC_{i}\). Then, \(SC_{i}\) computes value \(A_{i}^{\prime}=H(ID_{i}^{\prime}\parallel PW_{i}^{\prime}\parallel a_{i})\) mod \(n_{0}\) and checks whether \(A_{i}^{\prime}=A_{i}\). If not, \(SC_{i}\) refuses the login request. Otherwise, \(SC_{i}\) computes \(RPW_{i}^{\prime}=H(ID_{i}^{\prime}\parallel PW_{i}^{\prime})\) mod \(n_{0}\) and \((V_{i}\parallel H(x)\parallel R_{i})=B_{i}\oplus H(RPW_{i}^{\prime}\parallel a _{i})\). Subsequently, \(SC_{i}\) picks \(a_{i}\in Z_{p}^{*}\) and computes \(K_{1}=a\cdot P,K_{2}=H(x)\oplus R_{i}\). At this point, \(SC_{i}\) generates a timestamp \(t_{u}\) and computes \(V_{ii}=H(V_{i}\parallel t_{u})\) and \(M_{2}=E_{R_{i}}(PID_{i}^{*}\parallel V_{i}\parallel V_{ii})\), where \(E_{R_{i}}(\cdot)\) is a symmetric encryption algorithm (i.e., AES [30]). Finally, \(SC_{i}\) sends \(\{M_{2},K_{1},K_{2},t_{u}\}\) to \(S_{j}\)._  
**Auth. 1**.: _After obtaining \(\{M_{2},K_{1},K_{2},t_{u}\}\), \(S_{j}\) first verifies the timestamp \(t_{u}\) to ensure that \(|T-t_{u}|<\Delta T\), where \(T\) is the current timestamp and \(\Delta T\) represents the acceptable time gap, thereby ensuring the request falls within the designated time window to prevent DoS attacks. \(S_{j}\) calculates \(R_{i}=H(x)\oplus K_{2},PID_{i}^{*}\parallel V_{i}^{*}\parallel V_{ii}^{*}=D_{ R_{i}}(M_{2})\), where \(D_{K_{2}}(\cdot)\) is a symmetric decryption algorithm. Then, \(S_{j}\) searches \(PID_{i}^{*}\) in its database. If \(PID_{i}^{*}\) cannot be found, or the timestamp \(t_{u}\) is outside the acceptable range, or \(V_{ii}^{*}\) does not match \(H(V_{i}^{*}\parallel t_{u})\), this session is aborted. Otherwise, \(S_{j}\) moves to the next step. \(S_{j}\) extracts \(r_{i}^{*}\) stored in the database and checks whether \(V_{i}^{*}=H(ID_{i}^{*}\parallel x\parallel r_{i}^{*})\). If they are unequal, \(S_{j}\) gets that \(U_{i}\)'s smart card has been broken. Otherwise, \(S_{j}\) picks \(b\in Z_{p}^{*}\) and computes \(K_{3}=b\cdot P,K_{4}=b\cdot K_{1}\), \(M_{3}=H(K_{3}\parallel K_{2}^{*}\parallel V_{i}^{*}\parallel D_{i}^{*} \parallel K_{4})\), \(SK_{s}=H(K_{4}\parallel ID_{i}^{*}\parallel V_{i}^{*})\), \(R_{i}^{new}=H(R_{i})\) (where \(R_{i}^{new}\) is from the Hash-chain), \(PID_{i}^{new}=H(PID_{i}\parallel x),C_{i}=PID_{i}^{new}\oplus V_{i}\). \(S_{j}\) updates its database by storing \(R_{i}^{new}\) and \(PID_{i}^{*}\) replacing the previous values of \(R_{i}\) and \(PID_{i}\), respectively. Lastly, \(S_{j}\) sends the message \(\{K_{3},M_{3},C_{i}\}\) to \(U_{i}\) openly._  
**Auth. 2**.: _On receiving the message \(\{K_{3},M_{3},PD_{i}-V_{i}\}\), \(U_{i}\) computes \(K_{4}^{\prime}=a\cdot K_{3}\), \(SK_{u}=H(K_{4}^{\prime}\parallel ID_{i}\parallel V_{i})\), \(M_{3}^{\prime}=H(K_{3}\parallel K_{2}\parallel V_{i}\parallel ID_{i} \parallel K_{4})\) and verifies if \(M_{3}^{\prime}=M_{3}\). If the verification fails, the integrity of \(M_{3}\) may be corrupted and \(U_{i}\) ceases this session. Otherwise, \(U_{i}\) accepts a shared session key \(SK=SK_{u}=SK_{s}\). Finally, \(U_{i}\) performs the operation \(PID_{i}^{new}=C_{i}\oplus V_{i}\) to update the processed identity \(PID_{i}\). Then \(U_{i}\) computes \(R_{i}^{new}=H(R_{i})\) and stores \(R_{i}^{new}\big{(}i.e.,B_{i}=H(RPW_{i}\parallel a_{i})\oplus(V_{i}\parallel H (x)\parallel R_{i}^{new})\big{)}\)._  
The operations are summarized in Figure 3 to provide researchers with a quick understanding of the login and authentication phase.