## 6 Security Analysis
### Formal Security Analysis Using RoR Model
** Six simulated games are included in the proof, namely \(Game_{0}\), \(Game_{1}\), \(Game_{2}\), \(Game_{3}\), \(Game_{4}\), \(Game_{5}\), so that the success probability of \(\mathcal{A}\)'s attack gradually increases. The ultimate purpose of \(\mathcal{A}\) is to retrieve the bit \(c\) with the _Test_ query after each game finishes. \(Pr[S_{i}]\) denotes the success probabilities where \(S_{i}\) (\(i=0,1,2,3,4,5\)) are the events in different games. A protocol simulator \(\mathcal{B}\) is set to play the role of the challenger \(\mathbb{C}\). \(Game_{0}\): This game starts the simulation, and it is identical to the real protocol in the random oracles. \(c\) is tossed by \(\mathcal{B}\) to start the game. We have  
\[Adv_{\mathbb{C}}^{DNAHC}=|2 Pr[S_{0}]-1| \tag{2}\]  
\(Game_{1}\): This game presents all the queries discussed in Section 4.3. Table 2 describes a simulation of the queries in accordance with the rule of the proposed protocol. \(G_{1}\) creates three lists: \(l_{h}\), \(l_{r}\) and \(l_{m}\). Because of the indistinguishability between \(G_{0}\) and \(G_{1}\), we obtain  
\[Pr[S_{1}]=Pr[S_{0}] \tag{3}\]\(Game_{2}\): The collision probabilities of the hash oracle and random oracle queries are considered in this game for all transcripts communicated between \(P_{i}\) and \(S_{m}\). Based on the birthday paradox, we can obtain the highest probability of hash queries as \(\frac{q_{\textit{last}}2^{2}}{2^{t_{\textit{last}}}!^{\top}}\). In the login and authentication phase, there are three random numbers \(a_{i,m},s_{i,m},p_{i,j}\) generated by \(P_{i}\) and \(S_{m}\) to construct two messages \(\{C_{i,m1},C_{i,m2},T_{i,m}\}\) and \(\{\theta_{m,i}\}\). Its collision probability is at most \(\frac{(q_{\textit{last}}+q_{\textit{next}})^{3}}{2^{t_{\textit{last}}}!^{ \top}}\). As \(G_{1}\) and \(G_{2}\) are indistinguishable, we have  
\[|Pr[S_{2}]-Pr[S_{1}]|\leq\frac{(q_{\textit{last}}+q_{\textit{next}})^{3}}{2^{ t_{\textit{last}}}!^{\top}+1}+\frac{q_{\textit{last}}2^{2}}{2^{t_{\textit{last}}}!^{\top}} \tag{4}\]  
\(Game_{3}\): This game is similar to the previous game, but the queries are executed for each specific transcript. \(G_{3}\) consists of two cases consistent with two transcripts sent by \(P_{i}\) and \(S_{m}\). + _Case 1_: The query \(Send(S_{m},M_{1})\) is considered in this case. The messages \(C_{1}\) are computed from four values \(C_{i,m1},c_{i,m21},\ c_{i,m22},\ c_{i,m23}\), which result in a probability of \(4\frac{q_{\textit{last}}}{2^{t_{\textit{last}}}! }\) in total. Note that I do not consider \(T_{i,m}\) in \(M_{1}\) for the hash oracle, as the timestamp is not difficult to retrieve or generate. On the other hand, the random numbers \(a_{i,m},s_{i,m}\) contained in \(M_{1}\) have a probability of \(2\frac{q_{\textit{last}}}{2^{t_{\textit{last}}}!}\). Based on Equations (2)-(9), we can achieve the following equation:  
\[ \begin{array}{l}\frac{1}{2}Adv_{\mathbb{C}}^{DNAHC}=\left|Pr[S_{0}]-\frac{1}{2} \right|\\ \leq\frac{(q_{start}+q_{execute})^{3}}{2^{n_{number}}v^{1}}+\frac{q_{task}}{2^{ n_{task}+1}}\\ \qquad\qquad+7\frac{q_{task}}{2^{n_{task}}}+3\frac{q_{task}}{2^{n_{task}}}\\ +max\Big{\{}\Big{(}C^{\prime}.q_{send}^{s^{\prime}}\Big{)},q_{send}\Big{(} \frac{1}{2^{n_{t}}{n_{t}}},\varepsilon_{biometrics}\Big{)}\Big{\}}\\ \qquad\qquad+3q_{hash}(q_{send}+q_{execute}+1)Adv_{\mathcal{A}}^{ECDLP}(t_{ \mathcal{A}})\\ \qquad\qquad+q_{hash}(q_{send}+q_{execute}+1)Adv_{\mathcal{A}}^{ECDHP}(t_{ \mathcal{A}})\end{array}  \tag{10}\]  
The final result can be easily achieved as follows:  
\[ \begin{array}{l}Adv_{\mathbb{C}}^{DNAHC}\ \leq\frac{(q_{start}+q_{execute})^{3}+6q_{ send}}{2^{n_{number}}}+\frac{q_{hash}^{2}+14q_{hash}}{2^{n_{task}}}\\ +2 max\Big{\{}\Big{(}C^{\prime}.q_{send}^{s^{\prime}}\Big{)},q_{send}\Big{(} \frac{1}{2^{n_{t}}{n_{t}}},\varepsilon_{biometrics}\Big{)}\Big{\}}\\ \qquad\qquad+6q_{hash}(q_{send}+q_{execute}+1)Adv_{\mathcal{A}}^{ECDLP}(t_{ \mathcal{A}})\\ \qquad\qquad+2q_{hash}(q_{send}+q_{execute}+1)Adv_{\mathcal{A}}^{ECDHP}(t_{ \mathcal{A}})\end{array}