## 3 Security Weaknesses of Cao et al.'s Scheme
### Formal Security Analysis
\begin{table}
\begin{tabular}{l l} \hline \hline
**Queries** & **Descriptions** \\ \hline \(Execute(\Pi_{UE}^{inst_{1}}\), \(\Pi_{SN}^{inst_{2}})\) & This query is an eavesdropping attack that \(A\) can control the exchanged messages over the public network. \\ \hline \(CorruptUE(\Pi_{UE}^{inst_{1}})\) & This query is device stolen attacks that \(A\) can retrieve the data stored in device \(UE_{i}\) using this query. \\ \hline \(Send(\Pi^{inst},Msg)\) & This query is an attack that \(A\) can send a message and obtain a response from the oracle \(P^{inst}\). \\ \hline \(Test(\Pi^{inst})\) & This query is an attack to guess the probabilistic result for an unbiased coin \(c\). When the \(P^{inst}\) and \(A\) establish the session key \(SK\) which is fresh, \(A\) sends this query. If its result is \(c=0\) or \(c=1\), \(A\) get a random number or the \(SK\), respectively. Otherwise, _Tset_ query returns the NULL (\(\bot\)). \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Queries and descriptions. * Game \(G_{1}\): This game is an eavesdropping attack by \(A\) which \(A\) can control the all the exchanged messages using \(Execute(\Pi_{UE}^{inst_{1}},\Pi_{SN}^{inst_{2}})\) query. After that, \(A\) executes the \(Test(\Pi^{t})\) query to find whether its output is a correct \(SK\) or a random value. In [PERSON] et al. 's scheme, UE and SN exchange the session key \(SK\) which is computed by \(SK_{ij}=H_{2}(T_{y_{i}}(T_{x_{i}}(K_{sn}||ID_{SN_{j}})\) mod \(p)\) mod \(p||K_{1}^{\prime}||K_{2}^{\prime}||K_{3}||ID_{UE}||ID_{SN_{j}})\) and \(SK_{ij}^{\prime}=H_{2}(T_{y_{i}}(T_{x_{i}}(K_{sn}||ID_{SN_{j}})\) mod \(p)\) mod \(p||K_{1}||K_{2}||K_{3}^{\prime}||ID_{UE}||ID_{SN_{j}})\). If \(A\) want to correctly guess it, \(A\) must break the difficulty of solving CMDLP. However, \(A\) should get the temporary private key of UE and SN from the \(SK\). It is computationally hard to find the temporary private key because the \(SK\)'s security is based on the difficulty of solving CMDLP. Thus, \(G_{0}\) and \(G_{1}\) are indistinguishable. Then, \[Pr[Succ_{1}]=Pr[Succ_{0}]\] (3)
* Game \(G_{2}\): Finally, \(A\) performs the final attack and tries to impersonate the legal UE and SN using \(Send(\Pi^{inst},Msg)\), \(CorruptUE(\Pi_{UE}^{inst_{1}})\) and some \(Hash\) queries. \(A\) execute the \(CorruptUE(\Pi_{UE}^{inst_{1}})\) query, and then extract the values \(u_{i}\) and \(s_{j}\) stored in the memory of UE and SN. \(A\) successfully break the session key security using the obtained private key because \(A\) can properly proceed the authentication and key agreement phase without solving the CMDLP. Therefore, \(G_{1}\) and \(G_{2}\) are distinguishable. Then, \[|Pr[Succ_{1}]-Pr[Succ_{2}|\geq\frac{q_{h}^{2}}{2|Hash|}\] (4) After finishing all the games \((G_{0},G_{1},G_{2})\), \(A\) tries to correctly find the \(c\) using \(Test\) query. Therefore, \[Adv\mathcal{\hat{P}}_{\mathcal{G}_{2}}=\frac{1}{2}\] (5) We can obtain the following result using the Equations (2), (3) and (5). \[\frac{1}{2}.Adv\mathcal{\hat{P}}_{\mathcal{G}_{2}} = |Pr[Succ_{0}]-\frac{1}{2}|\] (6) \[= |Pr[Succ_{1}]-\frac{1}{2}|\] \[= |Pr[Succ_{1}]-Pr[Succ_{2}]|\] After that, we can obtain the following result with (4), (5) and (6): \[|Pr[Succ_{1}]-Pr[Succ_{2}]| \geq \frac{q_{h}^{2}}{2|Hash|}+Adv\mathcal{\hat{P}}^{ CMDLP}(t)\] (7) Then, we obtain the final result by multiplying 2 both sides of (7): \[Adv\mathcal{\hat{P}}\geq\frac{q_{h}^{2}}{|Hash|}+2 Adv\mathcal{ \hat{C}}^{ CMDLP}(t)\] (8) Finally, we can remove the probability \(2 Adv^{CMDLP}(t)\) in Equation (8) because we break the session key security without solving the CMDLP. Therefore, we prove that [PERSON] et al. 's scheme does not achieves the session key security using this formal proof.