# Secure and Efficient Authentication Scheme in IoT Environments
## 4 Cryptoanalysis of the Proposed Protocol
### Informal Security Analysis
Furthermore, if the encryption key of the server is compromised somehow, the attacker will be unable to extract security parameter \(<T,~{}A,~{}E_{t}>\) from \(<t^{\prime},~{}a^{\prime},~{}e^{\prime}_{t}>\). This is due to parameter security is still protected by \(Id_{TS}\) and \(s\). Therefore, the proposed scheme is preventive against database attacks. * Cookie-theft attacks: In the proposed scheme, the session cookie \((C_{k})\) is stored and sent in the form of \(CK^{\prime}=h(R||s||E_{t}||CID_{i}).G\), (i.e., an ECC point multiplication) in the embedded device \((ED_{i})\). Therefore, it is very difficult to extract \(CK\) from \(CK^{\prime}\) because of the complexity of ECDLP. In addition, because of the tamper-proof design of \(ED_{i}\), it is impossible for an attacker to extract \(CK^{\prime}\) from it [43]. In addition, \(CK^{\prime}\) is sent through a secure, trusted channel during the registration step, which we have explained in Section 3.2. Consequently, the attacker cannot get the cookie \((CK^{\prime})\). Therefore, the proposed scheme is secure against cookie-theft attacks. * Server-spoofing attacks: In these attacks, an adversary may masquerade as a server \((TS)\) to uncover the secret credential of a device \((ED_{i})\). \(ED_{i}\)/secret credential \(CID_{i}\) comprises the hashing of the random secret (R), the secret identity \((I_{i})\), and the server secret (s). In addition, \(CID_{i}\) is stored in the \(TS\)'s encrypted database (i.e., \(E_{ks}=s\). \(Id_{TS}\).\(G\)) in the form of \(CID^{\prime}_{i}=CID_{i}\).\(G\). Since the security of \(E_{ks}\) is protected by ECDLP and CDHP, it is impossible for an attacker to extract \(CID_{i}\) from \(CID^{\prime}_{i}=CID_{i}\).\(G\). Thus, an attacker cannot get \(ED_{i}\)'s secret credentials \(CID_{i}\) by any means due to the complexity of solving ECDLP and CDHP and the device's tamper-proof nature. Therefore, the proposed scheme is secure against server-spoofing attacks. * Stolen-verifier attack: If the attacker somehow discovers a smart card/smart device of server \(TS\), the attacker could launch a power-analysis attack to uncover the secret information stored inside. However, in the proposed scheme, during the registration phase, \(TS\) stores \(t^{\prime}=T\oplus CID_{i}\oplus s\oplus ID_{TS}\), \(a^{\prime}=A_{i}\oplus CID_{i}\oplus s\oplus ID_{TS}\) and \(e^{\prime}_{t}=E_{t}\oplus CID_{i}\oplus s\oplus ID_{TS}\) against \(CID_{i}\). Even if the attacker somehow steals those records, the attacker cannot perform the malicious activity because he/she would be unable to access the plain text \((T,A,E_{t})\) as the record is protected using the secret key (s) and \(ID_{TS}\) of \(TS\) and \(CID_{i}\). The security of \(s\) and \(ID_{TS}\) in \(E_{ks}=s\). \(Id_{TS}\).\(G\) is well protected by the concept of ECDLP and CDHP. In addition, the attacker cannot create a substantial login solicitation to pass the verification stage without knowing \(CK^{\prime}\) as it is not stored in the server's database. Furthermore, cookic computation, i.e., \(CK^{\prime}=CK.G\), depends on the correct computation of \(CK=h(R||s||E_{t}||CID_{i})\). Without knowing the server's secret key (\(s\)), the attacker cannot compute a substantial cookie \((CK)\) and, hence, cannot make a legitimate login request. In addition, it is impossible for an attacker to extract information stored in \(ED_{i}\) due to its tamper-proof design. Therefore, the proposed scheme can withstand stolen-verifier attacks. * Man-in-the-middle attacks: Mutual authentication prevents man-in-the-middle attacks. We verified the mutual authentication of the proposed scheme using the ProVerif tool in Section 4.3. Thus, the proposed scheme successfully supports mutual authentication between \(ED_{i}\) and \(TS\). Consequently, the proposed scheme is secure against man-in-the-middle attacks. * Brute-force attacks: To launch a brute-force attack, an attacker must extract the security parameters \(X_{i},Y_{i},X_{j},Y_{j}\), and \(T\) from the transmitted messages.