# Key Agreement and Authentication Protocols in the Internet of Things: A Survey
## 4 Discussion
These attacks can lead to the loss of a significant amount of information, necessitating protection against them in IoT environments. The attacker can combine different techniques when carrying out an attack. An attacker can listen to and intercept network traffic and then retransmit it to convince the recipient to perform specific actions. The attack results depend on the attacker's knowledge, skills and imagination and the vulnerability and specificity of the attacked environment. One of the most dangerous outcomes of an attacker may be the loss of confidential information. Protection against this type of attacker activity should consider using message timestamps and one-time session keys during communication. Table 5 summarizes the security aspects of the analyzed protocols. Moreover, in this table, we have included only those protocols for which the authors conducted formal and informal proofs of security and indicated the security aspects that their protocols provide. In some papers (e.g., [90; 91; 100; 101]), the authors did not include the list of aspects. In this table, we have included a list of aspects with an annotation of whether the protocol meets the property (designation +). The designation - means that there is no information about the assurance of ownership by the investigated protocol. The analysis showed forward security is the most desirable security property, a specific feature of the session key agreement protocols. \begin{table}
\begin{tabular}{|c|c c  
The authors of all overviewed papers have also conducted performance studies of their protocols. The authors compared their proposals with similar solutions in terms of communication and calculation costs and energy consumption. The authors found that the proposed protocols achieve better performance in all studies than comparable solutions. To summarize the overviewed protocols, the authentication process is the essential communication element in IoT environments. The process consists of confirming the identity of the communicating parties. One or more factors may be used during authentication; the more factors, the greater the safety of the entire process. If only passwords are used for authentication, this can be a weak and vulnerable security. An attacker can intercept, guess or crack passwords. Hence, a better solution is to use biometrics as it will avoid spoofing or impersonating attacks. Authentication is vulnerable to rogue users. Attackers can launch attacks to obtain private user information, block the operation of selected system components, or cause the system to malfunction. The most dangerous attacks are MITM attacks, replay attacks, and the impersonation mentioned above because they can lead to the loss of user data and the compromise of essential security properties. The desynchronization attack can be equally dangerous because, in many IoT environments (for example, medical), proper data synchronization is crucial to the entire system's operation. An essential element of securing communication is using session keys, which are used to encrypt it. To protect communication against a replay attack or MITM attack, it is worth using one-time session keys, and messages should be timestamped. Thanks to this, the system will unequivocally determine whether a legitimate network node generated the processed message or whether it was intercepted by the attacker and resent by him. In addition to the security aspects, we should also bear in mind the issues related to the scalability of protocols in the IoT environment. Devices used in IoT environments, or WSN sensors, have limited computing power. For this reason, calculations performed on individual devices while the protocol is running should not drain its energy.