## 3 Security Weaknesses of Cao et al.'s Scheme
### Formal Security Analysis  
We prove that Cao et al. 's scheme does not achieve the session key security using Real-or-Random (ROR) model [17] which is broadly accepted formal proof [18; 19; 20]. We first present the basic concept of ROR model, and then perform the formal security analysis through this proof. * Participants We denote \(\Pi_{UE}^{inst_{1}}\) and \(\Pi_{SN}^{inst_{2}}\) as the instance \(inst_{1}\) and \(inst_{2}\) of UE and SN, respectively. * Accepted state After exchanging the last messages, the oracle \(\Pi^{\prime}inst\) moves to an accepted state. When all the messages are concatenated in order, a current session identifier _csid_ of \(\Pi^{inst}\) is defined. * Partnering When \(\Pi_{UE}^{inst_{1}}\) and \(\Pi_{SN}^{inst_{2}}\) are in the shared same \(sid\) and the accepted state, and then complete mutual authentication and key agreement, \(\Pi_{UED}^{inst_{1}}\) and \(\Pi_{SN}^{inst_{2}}\) are defined as partners. * Freshness To perform the ROR proof, the instances (\(\Pi_{UE}^{inst_{1}}\), \(\Pi_{SN}^{inst_{2}}\)) are considered fresh if the session key between UE and SN is not compromised to attacker \(A\) at present. * Attacker Under the threat model of [PERSON] et al. [9], an \(A\) has a complete control over the communication network. \(A\) also access to the queries presented in Table 2 to break the security of [PERSON] et al. 's scheme. * Semantic Security Under the this model, \(A\) attempt to find an instance's correct session key from a random nonce. \(A\) has to utilize the ROR queries, and then guesses a bit \(c\). When \(A\) correctly find a bit \(c\), \(A\) win the game ans destroy the semantic security of protocol. We define that \(Win\) is event of winning the game by \(A\) and \(Adv_{p}=|2 Pr[Win]-1|\) is advantage in breaking the session key of [PERSON] et al. 's scheme \(P\). * Random Oracle In [PERSON] et al. 's scheme, all participants can utilize a random oracle which is a one-way hash function \(H\). Here, we prove that [PERSON] et al. 's scheme does not achieve the session key security by the following Definition 1 and Theorem 1. Definition 1: Chaotic Map-based Discrete Logarithm Problem (CMDLP): Given \(x\) and \(y\), it is computationally hard to find integer \(i\) such that \(T_{i}(x)=y(mod~{}p)\). Theorem 1: Suppose that \(A\) is an adversary running in a polynomial time \(t\) against LASS and \(Adv_{p}^{A}\) is the advantage of \(A\) in breaking the session key security of [PERSON] et al. 's scheme. Then,  
\[Adv_{p}^{A}\geq\frac{q_{h}^{2}}{|\text{Hash}|}+2 Adv^{CMDLP}(t), \tag{1}\]  
where \(q_{h}\), \(Hash\), and \(Adv^{CMDLP}(t)\) denote the number of \(Hash\) queries, \(Hash\) is a one-way hash function \(H\), and \(Adv^{CMDLP}(t)\) is the breaking advantage of CMDLP by \(A\), respectively. We define the following games \(G_{i}(i=0,1,2)\) with the event \(Succ_{i}\) in which \(A\) wins the game \(G_{i}\). The formal proofs using ROR model are below:  
* Game \(G_{0}\): This game is a direct attack by \(A\) against the protocol. The \(c\) is first randomly selected at the beginning of this game and its winning advantage is: \[Adv_{p}^{A}=|2.Pr[Succ_{0}]-1|\]