# Lightweight and Security-Enhanced Key Agreement Protocol Using PUF for IoD Environments
## 6 Proposed Protocol
### Drone Revocation Phase
#### 7.1.7. RoR Model  
This section presents a formal security analysis of the proposed protocol using the RoR model [15]. The RoR model is a formal proof analysis that can verify the session key security of authentication protocols. We define \(p^{k}\) as a participant in the \(k^{th}\) instance. Thus, \(p_{MD_{i}}^{k_{1}}\), \(p_{GCS}^{k_{2}}\), and \(p_{D_{j}}^{k_{3}}\) are participants \(MD_{i}\), \(GCS\), and \(D_{j}\) in the \(k_{1}^{th},k_{2}^{th}\), and \(k_{3}^{th}\) instances, respectively. Under the RoR model, \(A\) performs passive and active attacks using various queries to determine the session key. We illustrate the queries performed by \(A\) in Table 4.  
Let \(SC_{A}(P)\) be the probability of \(A\)'s advantage in compromising the session key. Then, the following equation can be derived:  
\[SC_{A}(P)\leq\frac{q_{h}^{2}}{|Hash|}+\frac{q_{p}^{2}}{|Puf|}+2 max\{C^{{}^{ \prime}}\cdot q_{s}^{{}^{\prime}},\frac{q_{s}}{2!}\}, \tag{1}\]  
where \(q_{h}\), \(|Hash|\), \(q_{s}\), \(q_{p}\), and \(|Puf|\) represent the number of hash functions, the range space of the \(|Hash|\) query, the number of \(Send\) queries, the number of \(|Puf|\) queries, and the range space of the \(PUF(\cdot)\), respectively. Moreover, \(l\) is the length of the mobile user's identity, and the Zipf parameters are \(C^{{}^{\prime}}\) and \(v^{{}^{\prime}}\). Proof. : We denote the game played by \(A\) as \(G_{i}(i=0,1,2,3,4)\). In addition, we define \(AW_{GA_{i}}\) as the probability of \(A\) winning the game and \(Adv[AW_{GA_{i}}]\) as the advantage of \(AW_{GA_{i}}\). * \(G_{0}\): After the game starts, \(A\) chooses a random bit (\(r\)). Then, The following equation is derived: \[SC_{A}(P)=|Adv[AW_{GA_{0}}]-1|.\] (2)
* \(G_{1}\): In \(G_{1}\), \(A\) uses the _Execute_ query to intercept messages transmitted during authentication by performing an eavesdropping attack. Next, \(A\) performs the _Test_ query to determine the session key. To determine the session key, \(A\) must be able to calculate random numbers \(r_{3}\), \(r_{4}\), and \(r_{5}\). However, these random numbers cannot be acquired through the eavesdropping attack. There is no advantage for \(A\) via the _Execute_ query. Therefore, we obtain the following equation: \begin{table}
\begin{tabular}{c l} \hline \hline
**Query** & **Description** \\ \hline \(Execute(p_{MD_{i}}^{k_{1}},p_{GCS}^{k_{2}},p_{D_{j}}^{k_{3}})\) & This query enables adversary \(A\) to execute an eavesdropping attack. Adversary \(A\) has the ability to intercept messages transmitted during authentication among \(p_{MD_{i}}^{k_{1}}\), \(p_{GCS}^{k_{2}}\), and \(p_{D_{j}}^{k_{3}}\). \\ \hline \(CorruptMD(p_{MD_{i}}^{k_{1}})\) & Using this query, \(A\) can steal the mobile device of \(p_{MD_{i}}^{k_{1}}\) and obtain the secret credentials stored in \(MD_{i}\). \\ \hline \(Send(p_{x}^{k_{a}},M)\) & Adversary \(A\) can utilize this query to send message \(M\) to participant \(p_{x}^{k_{a}}\) and receive the response message. \\ \hline \(Test(p_{x}^{k_{a}})\) & Before the start of the game, \(A\) uses this query to flip an unbiased coin (\(c\)). If \(A\) obtains \(c=1\), \(p_{x}^{k_{a}}\) returns the correct \(SK\), and if \(A\) obtains \(c=0\), \(p_{x}^{k_{a}}\) returns a random number. Otherwise, \(p_{x}^{k_{a}}\) returns a \(NULL\) value. Adversary \(A\) must be able to distinguish between the session key and the random number to win the game. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Query and description of the RoR model. \[Adv[AW_{GA_{1}}]=Adv[AW_{GA_{0}}]. \tag{3}\]
* \(G_{2}\): In \(G_{2}\), \(A\) performs active attacks using the \(Hash\) and \(Send\) queries to determine the session key. However, all messages are masked using a cryptographic hash function that prevents hash collisions. Thus, \(A\) cannot calculate the session key (\(SK\)).