# A Lightweight Chaotic Map-Based Key Agreement Scheme for the Advanced Metering Infrastructure
## 5 Security Analysis and Comparison
### Formal Security Proof  
According to [2], we rigorously test the security of the proposed scheme via formal security analysis under the widely accepted random oracle model, and prove that the proposed scheme can effectively resist the adversary A defined in the adversarial model. **Definition 3**. : _We use Game\({}^{AKA}(I,\ A)\) to simulate the security of the scheme. Though the game, [PERSON] can send multiple queries to participant \(I\), but [PERSON] can perform Test\((I)\) query at most once, and I returns \(b^{\prime}\in\{0,1\}\). The goal of [PERSON] is to correctly guess the value of \(b\) in the Test\((I)\) session. The probability that [PERSON] wins in Game\({}^{AKA}(I,\ A)\) is defined as \(Pr[\text{Succ}(A)]\). The advantage that [PERSON] destroys the semantic security of the proposed scheme in polynomial time is defined as:_  
\[Adv_{p}^{AKA}(A)=\left|2 Pr[\text{Succ}(A)]\text{-}1\right|=\left|2 Pr[b^{\prime }=b]\text{-}1\right| \tag{33}\]  
_This scheme is secure if adversary A's advantage of destroying semantic security \(Adv_{p}^{AKA}(A)\) can be ignored._  
**Lemma 1**. : _Suppose that \(E_{1},\ E_{2},\ F\) and \(F\) are events defined in a probability distribution, and assume that \(E_{1}\wedge-F\Longleftrightarrow E_{2}\wedge-F\). This means that \(|Pr[E_{1}]-Pr[E_{2}]|\leq Pr[F]\)._  
**Theorem 1**. : _Assuming that A can perform at most \(q_{h}\) hash queries, \(q_{e}\) Execute queries, and \(q_{s}\) Send queries, then the advantage of A is_  
\[Adv_{p}^{AKA}(A)\leq\frac{\left(q_{s}+2q_{h}^{2}\right)}{2^{l}}+\frac{2\left( q_{s}+q_{e}\right)^{2}}{p}+2q_{h}Adv_{\text{CMCDH}}(A) \tag{34}\]  
_where \(l\) is the length of the hash value._  
Proof. : The proof consists of the game order \(GM_{i}(i=0,1,2,3,4,5)\). For each game, \(A\) wins the game when \(A\) guesses the value of \(b\) successfully. \(\square\)  
\(GM_{0}\): The game simulates attacks which are carried out under the standard model, therefore  
\[Adv_{p}^{AKA}(A)=\left|2 Pr[GM_{0}]-1\right| \tag{35}\]  
\(GM_{1}\): Through the query of \(Execute\big{(}SM_{i},DC_{j}\big{)}\), \(A\) can obtain all the messages \(\{PID_{i},M_{1},M_{3},M_{4}\}\) and \(\{M_{5},M_{7},M_{8}\}\) exchanged between \(SM_{i}\) and \(DC_{j}\). \(A\) can verify whether the calculated key \(SK\) is real by executing the query. It can be seen that the security of the key cannot be disclosed from the exchanged information. Therefore  
\[\left|Pr[GM_{1}]-Pr[GM_{0}]\right|=0 \tag{36}\]  
\(GM_{2}\): The game simulates all types of queries, and as in \(GM_{1}\), the game is suspended when the following two situations occur: (1) _Hash_ queries conflict in output, and (2) \(\{PID_{i},M_{1},M_{3},M_{4}\}\) and \(\{M_{5},M_{7},M_{8}\}\) are not uniformly distributed. From the birthday paradox, therefore,  
\[\left|Pr[GM_{2}]-Pr[GM_{1}]\right|\leq\frac{q_{h}^{2}}{2^{l+1}}+\frac{\left(q_ {s}+q_{e}\right)^{2}}{2p} \tag{37}\]  
\(GM_{3}\): When \(A\) successfully guesses \(M_{4}\) and \(M_{8}\) without querying the participants, the game will be suspended, which is different from other games. Therefore,  
\[\left|Pr[GM_{3}]-Pr[GM_{2}]\right|\leq\frac{q_{s}}{2^{l}} \tag{38}\]  
\(GM_{4}\): In this game, the key \(SK\) can be guessed without querying for the corresponding random oracle. The game is no different from the above games, except that \(A\) performs a hash query on the random oracle on the \(\left(ID_{i}||CID_{i}||E_{i}||E_{i}||E_{i}^{new}||C_{2}||K\right)\), where \(K=CMDH(C_{1},C_{5})=T_{iw}(x)\). Therefore,  
\[\left|Pr[GM_{4}]-Pr[GM_{3}]\right|\leq q_{h}Adv_{\text{CMCDH}}(A)+\frac{q_{s}} {2^{l}} \tag{39}\]where \(A\) queries the random tuple \(\langle T_{\theta}(x),T_{\varphi}(x)\rangle\) from the \(h\) oracle to calculate _CMCDH_\((T_{\theta}(x),T_{\varphi}(x))\), where \(\theta,\ \varphi\in Z_{p}^{*}\). \(GM_{5}\): \(A\) executes the _Test_ query in this game, which is different from the above game.