## Security Analysis
### Informal Security Analysis  
During this phase, we employ an informal security analysis to demonstrate the robustness of our proposed scheme against a range of well-known attacks. * Anonymity and unlinkability: In the user authentication of our scheme, the OBU sends the dynamic identity \(DID_{v}=PID_{v}^{*}\bigoplus h(R_{1}\|t_{0})\) instead of real identity \(ID_{v}\) on the wireless channel. The adversary may listen and intercept information from the common channel to obtain \(DID_{v}\), but it cannot obtain \(ID_{v}\) because it is hidden in a pseudonym \(PID_{v}\) and only TA can decrypt \(PID_{v}\), and \(DID_{v}\) includes a one-way hash function, a random number, and other parameters. Moreover, the RSU only knows the pseudonym \(PID_{v}^{*}=DID_{v}\bigoplus h(R_{1}\|t_{0})\) and does not know the real identity \(ID_{v}\) of the vehicle during the authentication process. Even if the RSU is dishonest, it is not a privacy breach. In addition, the authentication messages \(\{CID_{v},DID_{v},M_{1},R_{0},t_{0}\}\) in each session are different because they are all made up of random numbers, timestamps, and other parameters. Thus, the protocol provides user anonymity and unlinkability. * Perfect forward secrecy: In proposed scheme, the session key \(SK=h(d,R_{0},R_{2},(s\cdot R_{0}),PID_{v}^{*},ID_{T})=h(d,R_{0},R_{2},(r\cdot R _{2}),PID_{v}^{*},ID_{T})\) are composed of random number \(d\), ECDLP \(R_{0}=r\cdot P\), \(R_{2}=k\cdot P\), and CDHP \((s\cdot R_{0})\) or \((r\cdot R_{2})\), the pseudonym of vehicle \(PID_{v}^{*}\), and identity of RSU \(ID_{T}\). Even if the attacker \(\mathcal{A}\) knows these parameters and the current \(SK\), \(\mathcal{A}\) cannot obtain random numbers and cannot compute previous or future session keys. Thus, the scheme has perfect forward secrecy. * Known key secrecy: In our scheme, the session key \(SK=h(d,R_{0},R_{2},(s\cdot R_{0}),PID_{v}^{*},ID_{T})=h(d,R_{0},R_{2},(r\cdot R _{2}),PID_{v}^{*},ID_{T})\) is based on a random number, ECDLP, Diffie-Hellman, and one-way hash function. Even if the attacker \(\mathcal{A}\) gains the session key, they cannot obtain any long-term keys. * Replay attacks: In our scheme, every message that is sent via the wireless channel contains random numbers and timestamps to ensure the integrity and freshness of the message. For example, in the user authentication phase, the sent message is \(\{CID_{v},DID_{v},M_{1},R_{0},t_{0}\}\), where \(R_{0}=r\cdot P\) (\(r\) is random number), \(CID_{v}=d\bigoplus h(t_{0}\|R_{1})\) (\(d\) is random number), \(DID_{v}=PID_{v}\bigoplus h(R_{1}\|t_{0})\), \(M_{1}=h(d,ID_{v}^{*},PID_{v}^{*},DID_{v},A_{v}^{*},t_{0},ID_{T})\) and \(t_{0}\) (timestamp). So, the proposed scheme has the ability to resist replay attacks. * Password guessing attacks: If \(\mathcal{A}\) can know the user's biometric template \(BIO_{v}\) and all information stored in smart card, it can guess \(ID_{v}^{*}\) and \(PW_{v}^{*}\) such that \(h\Big{(}ID_{v}^{*},PW_{v}^{*},BSK_{v}\Big{)}\,mod\ n\). However, there are \(|D_{PW}|*|D_{ID}|/n\approx 2^{32}\) candidates of the \((ID_{v},PW_{v})\) pair to satisfy this equation when \(n=256\)[28]. Therefore, our protocol meets resistance password guessing attacks. * Three-factory secrecy: If \(\mathcal{A}\) obtains the date from the smart card through side-channel attacks and knows the user's \(BIO_{v}\), and cannot know the correct \((ID_{v},PW_{v})\), \(\mathcal{A}\) cannot launch any attacks without knowing \(PID_{v}\) and \(A_{v}\). For the same reasons, if \(\mathcal{A}\) knows the user's \((BIO_{v},PW_{v})\), or knows the user's \(PW_{v}\) and information stored in the smart card, \(\mathcal{A}\) still cannot launch any attacks. Thus, the proposed protocol can achieve three-factor secrecy. * Identity guessing attacks: In our scheme, \(\{CID_{v},DID_{v},M_{1},R_{0},t_{0}\}\), \(\{ID_{r},DID_{v},AID_{v},\)\(M_{1},t_{0},t_{1}\}\), \(\{BID_{v},t_{2}\}\) are transmitted via the wireless channel, and \(<G,p,P,\epsilon_{v},C_{v},\)\(PPID_{v},h(\cdot),PA_{v}>\) stored into a smart card.