# Secure D2D Group Authentication Employing Smartphone Sensor Behavior Analysis
## 6 Security Analysis
### Resistance to Forgery Against Adaptive Chosen Message Attack  
**Definition 2** (Forking Lemma [30; 31]). : _Let \(\mathcal{A}\) be a probabilistic polynomial time Turing machine, given only the public data as an input. Within a certain time bound \(\mathcal{T}\), if \(\mathcal{A}\) can produce, with non-negligible probability, a valid signature \((m,\sigma_{1},h,\sigma_{2})\), where the tuple \((\sigma_{1},h,\sigma_{2})\) can be simulated without knowing the secret key. In this case, with an indistinguishable distribution probability, there is another machine which has control over the machine obtained from \(\mathcal{A}\) replacing interaction with the signer by simulation and produces two valid signatures \((m,\sigma_{1},h,\sigma_{2})\) and \((m,\sigma_{1},h^{\prime},\sigma_{2}^{\prime})\) such that \(h\
eq h^{\prime}\)._  
**Theorem 1**. : _The proposed certificateless authentication protocol could resist forgery towards adaptive chosen message attack in the assumption of random oracles \(H_{1}\), \(H_{2}\), \(H_{3}\)._  
Proof of Theorem 1.: The security of unforgeability can be formally defined under the game \(\mathcal{G}_{1}\). Let \(\mathcal{A}_{1}\) be a probabilistic polynomial time adversary. In this assumption, \(\mathcal{A}_{1}\) is able to break the proposed scheme. In this case, it is claimed that by conducting the following queries from adversary \(\mathcal{A}_{1}\), the challenger \(\mathcal{B}_{1}\) is capable of making use of \(\mathcal{A}_{1}\) to break the randomness of \(H_{1}\), \(H_{2}\), \(H_{3}\) oracles' outputs. Note that in the constructed game \(\mathcal{G}_{1}\), the used hash functions represent the random oracles. Accordingly, the hash lists are maintained by \(\mathcal{B}_{1}\). We assumed that \(\mathcal{B}_{1}\) is able to simulate all the oracles. The following steps to \(\mathcal{B}_{1}\) can be operated by \(\mathcal{A}_{1}\):  
* **Setup Phase. **\(\mathcal{B}_{1}\) chooses the bilinear group \((\mathcal{P},\mathbb{G},\mathbb{G}_{\mathcal{S}},\mathcal{E})\) of prime order \(\mathcal{P}\), as well as the generator \(g,w\in\mathbb{G}\). Thereafter, \(\mathcal{B}_{1}\) randomly chooses the system master key \(mk\in\mathbb{Z}_{\mathcal{P}}\) and computes \(PK=g^{mk}\) accordingly. The public parameters \((\mathcal{P},\mathbb{G},\mathbb{G}_{\mathcal{S}},\mathcal{E},g,w,PK,H_{1},H_{2 },H_{3},H_{4})\) are delivered to \(\mathcal{A}_{1}\), where \(H_{1}\), \(H_{2}\), and \(H_{3}\) are defined as random oracles controlled by \(\mathcal{B}_{1}\). Similarly, \(H_{4}\) is defined as the anti-collision hash function. Note that the system master key \(mk\) is kept secret from the adversary \(\mathcal{A}_{1}\). * **Query Phase. **\(\mathcal{A}_{1}\) adaptively issues the following queries:
* \(H_{1}\) _hash Query:_ Assume that \(\mathcal{A}_{1}\) does not has the ability to calculate the hash function \(H_{1}(.)\). The response to \(H_{1}\) _hash Query_ can be simulated by maintaining a list \(List_{H_{1}}\) initialized to be empty. When the adversary \(\mathcal{A}_{1}\) invokes the \(H_{1}\)_hash Query_ with input values \(ID\), \(\mathcal{B}_{1}\) will then check whether the parameter \(ID\) exists in the hash list \(List_{H_{1}}\). If the tuple \((ID,\zeta)\) has already been stored in \(List_{H_{1}}\), \(\mathcal{B}_{1}\) outputs \(\zeta=H_{1}(ID)\) to \(\mathcal{A}_{1}\). Otherwise, \(\mathcal{B}_{1}\) chooses random \(\zeta\in\mathbb{Z}_{\mathcal{P}}\) and forwards it to \(\mathcal{A}_{1}\). The new tuple \((ID_{i},\zeta)\) will be subsequently added to \(List_{H_{1}}\). * \(H_{2}\) _hash Query:_ Assume that \(\mathcal{A}_{1}\) does not has the ability to calculate the hash function \(H_{2}(.)\). The response to \(H_{2}\)_hash Query_ can be simulated by maintaining a list \(List_{H_{2}}\) initialized to be empty. When the adversary \(\mathcal{A}_{1}\) invokes the \(H_{2}\)_hash Query_ with input values \((\mathit{Tid},\mathcal{T},\eta)\), \(\mathcal{B}_{1}\) will then check whether the record \((\mathit{Tid},\mathcal{T},\eta)\) exists in the hash list \(List_{H_{2}}\).