## 4 Repairing the Protocol
### Description of the Repaired Protocol  
As mentioned above, this protocol is a two-party protocol. The reader may assume a duplication of keys for the _SN_-_FN_ and _SN_-_HN_ communications. We call the _UN_ an upstream node that represents either an _FN_ or an _HN_. Unless it is specified, all variables have the same length as the output of a hash function \(\mathrm{length}(h)\).  
A _SN_ should separately register with an _FN_ and an _HN_, and two sets of keys are required. Practically, these two registrations may be simultaneously performed via the _FN_, as long as the process is securely accomplished. Assume that the _SN_ is registering with either of them, denoted as a _UN_. The _SN_ will then be assigned with the followings:  
* \(id_{N}\), a unique secret identity for the _SN_.
* \(a_{N}=id_{N}\oplus h(k_{UN},k_{N})\), where \(k_{UN}\) is the secret key of the _UN_, \(k_{N}\) is a nonce.
* \(b_{N}=a_{N}\oplus k_{UN}\oplus k_{N}\).
* \(c_{N}=h(id_{N},k_{UN})\).  
In this protocol, the _UN_ does not require storing any secret information about the _SN_. If the _UN_ wishes to keep track of the identity of the _SN_, it may keep a truncated or hashed \(id_{N}\). The value of the \(id_{N}\) needs to be unique and a bit of \(id_{N}\) may be used to indicate the association with either of _SN_-_HN_ or _SN_-_FN_, and several bits from the identity of the _UN_.  
When the \(\mathcal{N}\) wishes to initiate a communication with a \(\mathit{UN}\), the \(\mathit{SN}\) will perform the following operations (In case an \(\mathit{FN}\) wishes to initiate the protocol, the protocol will be preceded by a _Hello_ message from the \(\mathit{FN}\) to the \(\mathcal{S}\)\(\mathcal{N}\).). Please also refer to Figure 4.  
1. The \(\mathcal{S}\) generates a random number \(r_{N}\) and a timestamp \(t_{N}\) and computes: \[x_{N}=a_{N}\oplus id_{N},\] (15) \[y_{N}=x_{N}\oplus r_{N},\] (16) \[tid_{N}=h(id_{N},t_{N},c_{N},r_{N}).\] (17) Then, it sends \(\langle tid_{N},y_{N},a_{N},b_{N},t_{N}\rangle\) to the \(\mathit{UN}\).
2. On receiving the request, the \(\mathit{UN}\) first checks if the timestamp is still valid. Then, it computes: \[k_{N}^{*}=k_{\mathit{UN}}\oplus a_{N}\oplus b_{N},\] (18) \[x_{N}^{*}=h(k_{\mathit{UN}}\oplus k_{N}^{*}),id_{N}^{*}=x_{N}^{* }\oplus a_{N},\] (19) \[r_{N}^{*}=x_{N}^{*}\oplus y_{N},c_{N}^{*}=h(id_{N}^{*},k_{ \mathit{UN}}).\] (20) Next, it validates \(tid_{N}\) by \(h(id_{N}^{*},t_{N},c_{N}^{*},r_{N}^{*})\). The protocol will be aborted if this does not hold.
3. The \(\mathit{UN}\) continues the protocols by selecting random numbers \(f_{N},k_{N}^{+}\) and computing the following: \[a_{N}^{+} =id_{N}^{*}\oplus h(k_{\mathit{UN}},k_{N}^{+}),\] (21) \[b_{N}^{+} =a_{N}^{+}\oplus k_{\mathit{UN}}\oplus k_{N}^{+},\] (22) \[\eta =h(f_{N},c_{N}^{*})\oplus a_{N}^{+},\] (23) \[\mu =h(c_{N}^{*},f_{N})\oplus b_{N}^{+},\] (24) \[\alpha =c_{N}^{*}\oplus f_{N},\] (25) \[\beta =h(id_{N}^{*},r_{N}^{*},f_{N},\eta,\mu),\] (26) \[k_{s} =h(id_{N}^{*},r_{N}^{*},f_{N},x_{N}^{*}),\] (27) where \(k_{s}\) represents the session key. Finally, the \(\mathit{UN}\) sends \(\langle\alpha,\beta,\eta,\mu\rangle\) to the \(\mathcal{S}\)\(\mathcal{N}\).
4. The \(\mathcal{S}\)\(\mathcal{N}\) validates the message by computing \(f_{N}^{*}=c_{N}\oplus\alpha\) and checking whether \(\beta\) equals to \(h(id_{N}^{*},r_{N},f_{N}^{*},\eta,\mu)\). If not, it rejects the protocol.
5. Finally, the \(\mathcal{S}\)\(\mathcal{N}\) computes the session keys and updates its keys, as \[a_{N}^{+} =h(f_{N}^{*},c_{N})\oplus\eta,\] (28) \[b_{N}^{+} =h(c_{N},f_{N}^{*})\oplus\mu,\] (29) \[k_{s}^{*} =h(id_{N},r_{N},f_{N}^{*},x_{N}).\] (30) The \(\mathcal{S}\)\(\mathcal{N}\) will compute the same session key \(k_{s}\) as the \(\mathit{UN}\) in the absence of the adversary or noise. It will then replace \((a_{N},b_{N})\) with \((a_{N}^{+},b_{N}^{+})\) in its memory.