## 6 Security Analysis
### ROR Model  
In this section, we use the universally-accepted real-or-random (ROR) model [25] in order to prove the security of the session key in our proposed protocol.We provide the similar proof as adopted in [26,27]. Short Discussion about ROR Model  
In the ROR model [25], the malicious attacker \(\mathcal{A}\) is modeled using the DY model, which interacts with the instance of the participants in the protocol. In our proposed protocol, \(v_{i}\), \(RSU_{j}\) and \(TA\) are considered as participants. Additionally, \(P_{v_{i}}^{t^{1}}\), \(P_{RSU_{j}}^{t^{2}}\), and \(P_{TA}^{d^{3}}\), which are called _oracles_ denoting the instances \(t^{1},t^{2}\), and \(t^{3}\) of \(v_{i}\), \(RSU_{j}\), and \(TA\), respectively. Table 2 shows various queries that simulate attacks, such as eavesdropping, modifying, and deleting or inserting the transmitted messages among the entities. \(h(\cdot)\) and Collision-resistant one-way hash function \(Hash\) are modeled as a random oracle and they can be used by all participants including \(\mathcal{A}\). [PERSON] et al. [28] showed that the password chosen by the user follows the Zipf's law, which is quite different from the uniform distribution. They also found that the size of password dictionary is quite limited in the sense that users do not generally use the entire space of the passwords; instead, they use a small space of the allowed characters space. We apply the [PERSON]'s law in order to prove the session key security of our proposed protocol. Theorem 1: _If \(Adv_{P}\) is the advantage function of an attacker \(\mathcal{A}\) in breaking the session key \(SK\) security of the proposed protocol \(P\), respectively, \(q_{h}\), \(q_{send}\), and \(|Hash|\) are the number of \(Hash\) queries, Send queries, and the range space of the hash function, respectively. Subsequently,_  
\[Adv_{P}\leq\frac{q_{h}^{2}}{|Hash|}+2 max\{C^{{}^{\prime}}\cdot q_{send}^{s^{ \prime}}\}\]  
_where \(C^{{}^{\prime}}\) and \(s^{\prime}\) are the [PERSON]'s parameters [28]._  
Proof: We define four games, called game \(GM_{i}\), \(i\in[0,1,2,3]\). The probability associated with \(GM_{i}\) in which \(\mathcal{A}\) can guess the random bit \(c\) and wins the game and denoted by \(Succ_{i}\). Moreover, \(Pr[. ]\) denotes the probability. We discuss the details for these four defined games below. \begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt}} \hline \hline
**Query** & **Meaning** \\ \hline \(Execute(P_{v_{i}}^{t^{1}},P_{RSU_{j}}^{t^{2}},P_{TA}^{p^{3}})\) & This query means that the model of the eavesdropping attack between the entities \(v_{i}\), \(RSU_{j}\) and \(TA\) via an insecure channels. \\ \hline \(CorruptOBU(P_{v_{i}}^{t^{1}})\) & Under this corrupt on-board-unit (OBU) query, \(\mathcal{A}\) can fetch all sensitive credentials stored in the OBU of \(v_{i}\). This is modeled as an active attack. \\ \hline \(Send(P^{t})\) & Under this query, \(\mathcal{A}\) can transmits a message to \(P^{t}\), and in response, it also receives a message from \(P^{t}\). This is also modeled as an active attack. \\ \hline \(Reval(P^{t})\) & The query means that \(\mathcal{A}\) reveals session key \(SK\) created by \(P^{t}\) and its partner to \(\mathcal{A}\) in the current session. \\ \hline \(Test(P^{t})\) & Before the game begins, under this query, an unbiased coin \(c\) is flipped. Depending on the output, the following decisions are made. \(\mathcal{A}\) executes this query and if the session key \(SK\) among \(v_{i}\) and \(RSU_{j}\) is fresh, \(P^{t}\) returns \(SK\) if \(c=1\) or a random nonce if \(c=0\); otherwise, it returns a null value(\(\bot\)). \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Various queries and their meanings. * **Game \(GM_{0}\)**: in this game, \(\mathcal{A}\) chooses a random bit \(c\). Additionally, this game involves a practical attack executed by \(\mathcal{A}\) against the protocol in the ROR model.