# Utilizing Trusted Lightweight Ciphers To Support Electronic-Commerce Transaction Cryptography
## 5 Security and Performance of Proposed E-Commerce Applications
### Security Analysis Using Scyther  
One automated tool for verifying security protocol is called Scyther. It has a number of intriguing characteristics, including the ability to characterize protocols and produce a finite representation of all conceivable protocol behaviors. It can also verify protocols with an infinite number of sessions and nonces. This tool is the result of research by [PERSON] in 2006. During that time, [PERSON] published his research related to a methodology for formal analysis and verification of encryption. It is a tool designed to analyze formal security protocols and their security requirements and was designed assuming full or unbreakable encryption. Furthermore, Scyther is used to verify security claims and to find potential attacks against authentication protocols, for instance, sales, purchases or payment operations in e-commerce. This tool analyzes the secrecy (confidentiality) and authentication property in the cryptographic protocol. Using the Scyther tool can ensure that objectivity of the formal verification of the protocol is performed by means of security analysis and proof. **Scyther description with the proposed e-commerce protocol:** This tool uses security protocol description language (SPDL) and a set of roles depending on the protocol designed. Each role represents an e-commerce network entity. We wrote a set of commands to configure our network entities, which are buyer (\(B\)), seller (\(S\)) and trust authority server (\(TAS\)). These commands simulate the procedures of our methodology. Furthermore, in order to communicate between network entities, Scyther provides us with send() and recv() directives. To verify our protocol, this tool enables us to implement a set of claims and to test events to achieve security and authentication properties and to protect data and e-commerce requests. The scyther tool can be utilized to search problems that emerge from the manner the protocol is constructed. The following claims (Alive, Niagree, Nisynch, Secret and Weakagree) are checked for the elements in the exchanged requests. The process of achieving the intended communication with some events is described as \"Alive\". \"Niagree\" stands for non-injective agreement and ensures that a protocol assures a sender \(B\) non-injective agreement with a receiver \(TAS\) or \(S\) on a set of request elements. \"Nisynch\" stands for non-injective synchronization, which ensures that the intended sender sends all requests received by the receiver in a synchronized manner. \"Secret\" is used to protect secrecy parameters. \"Weakagree\" stands for weak agreement and ensures that a protocol guarantees to a sender \(B\) weak agreement with another entity \(TAS\) or \(S\). If \(B\) completes a run of the protocol, apparently with receiver \(S\), then \(S\) has previously been running the protocol, apparently with \(B\). **Scyther test results:** Here, we describe a test of the proposed e-commerce protocol by the Scyther tool. Figure 10 shows the results of testing our protocol based on the \"Alive\", \"Niagree\", \"Nisynch\", \"Secret\" and \"Weakagree\" claim events. The tests show \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Attack** & [39] & [30] & [40] & [13] & [16] & [41] & [22] & [42] & **Proposed Protocol** \\ \hline DDoS & ✓ & & ✓ & & ✓ & & ✓ & ✓ \\ Phishing & & ✓ & & & ✓ & ✓ & ✓ & ✓ \\ Wiretapping & ✓ & ✓ & & ✓ & & & ✓ \\ Brute force & & ✓ & & & ✓ & & & ✓ \\ Distributed guessing & & ✓ & & & ✓ & & ✓ & ✓ \\ Credit card fraud & & & & & ✓ & ✓ & ✓ \\ Sabotage & & & ✓ & & & & ✓ \\ Data modification & ✓ & ✓ & ✓ & ✓ & ✓ & & ✓ & ✓ \\ Ransomware & & & ✓ & & & ✓ & ✓ & ✓ \\ Sniffing & ✓ & & & & ✓ & & ✓ \\ Zero day & & & & & ✓ & & ✓ \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Comparison of threat resistance between cryptography protocols. that the public (\(BPuK\), \(TASPuK\) and \(SPuK\)) and private keys (\(BPrK\), \(TASPrK\) and \(SPrK\)) and buyer/seller requests (\(BR/SR\)) are secret.