# Key Agreement and Authentication Protocols in the Internet of Things: A Survey
## 3 Security Protocols for the Internet of Things
An informal protocol security analysis showed its resistance to MITM attacks, smart card stolen attacks, publisher, subscriber, or broker impersonation attacks, known session key attacks, offline password guessing attacks, replay attacks, and privileged-insider attacks. In addition, the protocol provides confidentiality, mutual authentication and perfect forward secrecy. The formal safety analysis was performed by using the Scyther tool. The authors also showed that, compared to similar protocols, the proposed protocol saves bandwidth and communication energy while reducing resource-constrained sensor nodes' computation and communication costs. [PERSON] et al. in [128] focused on the weaknesses of existing IoT authentication protocols. The authors opposed a two-factor authentication protocol by using ECC, passwords, and smart cards. The authors conducted formal (using the ProVerif tool) and informal verification of their protocol. Based on analyses, they showed that the protocol is resistant to impersonation attacks, offline password guessing attacks, replay attacks, and sensor node captured attacks. In addition, they found the proposed protocol to be secure, meeting user and session key security requirements. In addition, it achieves satisfactory results in terms of computational costs. [PERSON] et al. in [129] introduced a two-factor authentication protocol based on a symmetric key, by using biometrics and a password. The proposed protocol consists of six phases: the initialization, the smart device enrollment, the gateway node enrollment, the user enrollment, the login and authentication and the password and biometric update. The authors conducted formal (using the Avispa tool) and informal analyses of the safety of the proposed protocol. Research has shown that the protocol ensures security properties such as session key freshness property, perfect forward secrecy, user anonymity, and untraceability. In addition, it is resistant to replay attacks, impersonation attacks, and MITM attacks. The authors also showed that their protocol has lower computational costs than similar protocols. [PERSON] et al. in [130] focused on IoT solutions for vehicles. The authors proposed an authentication protocol based on RFID and PUF technologies. The protocol assumes the presence of three roles: a tag, a reader, and a cloud server, and each of the components can operate independently. The tag is responsible for initiating communication with the reader, and the reader must validate the message sent by the tag and send it to the server. The server is responsible for tag and reader authentication. The authors tested the safety of the proposed protocol by using the ROR model and informal analyses. Research has shown that the protocol is resistant to ephemeral secret leakage attacks, MITM attacks,insider attacks, replay attacks, impersonation attacks, offline password-guessing attacks, and desynchronization attacks. Moreover, the proposed protocol maintains the following security properties: location privacy, mutual authentication and session key agreement, forward secrecy, and message authentication. Furthermore, the authors compared their protocol with other schemes regarding security and computational and communication costs with satisfactory results. [PERSON] et al. in [131] proposed an authentication protocol for IoT solutions for vehicles. The authors based the security of their protocol on identity-based cryptography [132] and lattice cryptography [133]. The authors verified the correctness and security of their protocol by using the ROM model. Research has shown that the protocol is resistant to MITM attacks, Unknown key-share attacks, and known-key security attacks and provides perfect forward secrecy. In addition, the authors compared the protocol with similar solutions in terms of reference and communication costs. The authors concluded that the proposed protocol is computationally efficient and can be implemented in real IoT solutions for vehicles. [PERSON] et al.