# Provable Secure and Efficient Digital Rights Management Authentication Scheme Using Smart Card Based on Elliptic Curve Cryptography

Authors: Yuanyuan Zhang; Muhammad Khurram Khan; Jianhua Chen; Debiao He
Journal: Mathematical Problems in Engineering
 (2015)

---

## Abstract

Since the concept of ubiquitous computing is firstly proposed by Mark Weiser, its connotation has been extending and expanding by many scholars. In pervasive computing application environment, many kinds of small devices containing smart cart are used to communicate with others. In 2013, Yang et al. proposed an enhanced authentication scheme using smart card for digital rights management. They demonstrated that their scheme is secure enough. However, Mishra et al. pointed out that Yang et al.’s scheme suffers from the password guessing attack and the denial of service attack. Moreover, they also demonstrated that Yang et al.’s scheme is not efficient enough when the user inputs an incorrect password. In this paper, we analyze Yang et al.’s scheme again, and find that their scheme is vulnerable to the session key attack. And, there are some mistakes in their scheme. To surmount the weakness of Yang et al.’s scheme, we propose a more efficient and provable secure digital rights management authentication scheme using smart card based on elliptic curve cryptography.


---

## Body

## 1. Introduction

In 1991, ubiquitous computing was firstly proposed by Mark Weiser, who thought that ubiquitous computing technology could provide users service with a variety of equipment in environment which would be disappeared from the user’s consciousness [1]. Later, IBM Corporation scientists also raised the idea in 1999, and they forecasted that pervasive computing can be a way to compute everywhere, anytime, and anywhere [2, 3]. Since the computer and internet technology development, multimedia contents (image, document, music, movie, video, etc.) have been greatly enriched all the time, and all of them can be easily redistributed, copied, and downloaded on the internet without authorization. This drawback results in rampant piracy and causes huge revenue to lose to the electronic commerce [4]. As a result, in pervasive computing application environment, the protection of digital publication copyright becomes more and more important. Digital rights management (DRM) technology is developed to overcome the problem [5]. Normally, DRM is only software which usually restricts the usage of the content to protect copy and distributed contents [6–9]. The DRM system manages the procedure of the digital contents including protection, distribution, and authorization. Using DRM technology, intellectual property is respected and protected by data encryption, so it can only be accessed by authorised users without limitless distribution [10, 11].In 2009, the first three-role based DRM implementation scenario authentication scheme using smart card was proposed by Zhang et al. [12]. Then, Yang et al. showed that Zhang et al.’s scheme was vulnerable to the insider attack and the stolen smart card attack [10]. Due to surmounting the weaknesses of Zhang et al.’s scheme, Yang et al. proposed an enhanced digital rights management authentication scheme based on smart card. They demonstrated that their scheme could preclude all the weaknesses existing in Zhang et al.’s scheme. Recently, Mishra and Mukhopadhyay cryptanalyzed Yang et al.’s scheme and found that their scheme cannot resist the password guessing attack and the denial of service attack. Moreover, they also pointed out that Yang et al.’s scheme is not efficient enough when the user inputs an incorrect password, and this drawback may cause a denial of service attack [13]. Except for the attacks mentioned by Mishra et al., we find out that Yang et al.’s scheme does not resist the session key attack. In addition to this, we also discover that there are some mistakes in their scheme.We proposed a new efficient and provable secure digital rights management authentication scheme using smart card based on elliptic curve cryptography [14–16]. To demonstrate the scheme is provable secure, we introduce a security model AFP05 [17, 18] and analyze our scheme in this model. In the following, we will give the proof that our proposed scheme is secure in the AFP05 model. As known to all, one-way hash function is more efficient than the operation of scalar multiplication and pairings [19–21]. Moreover, the pairing operation costs much more than the scalar multiplication operation. The effort of evaluating one pairing operation is approximately three times the effort of evaluating one scalar multiplication operation. So, we cut down some pairings operation of point on elliptic curve and use hash function instead to increase the scheme’s efficiency.The structure of this paper is arranged as follows. In Section2, we introduce the notations and definitions used in this paper. Section 3 reviews Yang et al.’s scheme, and Section 4 discusses its weakness analysis. We show the scheme details we propose in Section 5. Section 6 shows a formal security proof of the scheme, while Section 7 demonstrates the security analysis of our proposed scheme. In Section 8, we compare our proposed scheme with Yang et al.’s and Zhang et al.’s scheme. Section 9 concludes the paper.


## 2. Notations and Definitions

LetG1 be an additive group with an elliptic curve by the generator P and G2 a multiplicative cyclic group by the generator g. And both of them have the prime order q. Let e denote a computable bilinear map e:G1×G1↦G2 satisfying the following three properties [10, 12]:(i)
Computability. Given R,Q∈G1, there is an efficient algorithm to compute e(R,Q).(ii)
Bilinear.eaR,bQ=e(R,Q)ab, where R,Q∈G1 and a,b∈Zq∗.(iii)
Nondegenerate. Let P be the generator of G1, e(P,P)≠1G2.Several commonly used notations and their descriptions are described after the Conclusions Section to facilitate the following references.


## 3. Review of Yang et al.’s Scheme

There are three phases in their scheme; they are, respectively, registration phase, mutual authentication and key agreement phase, and password update phase.


### 3.1. Registration Phase

#### 3.1.1. User’s Registration Section

In this part, a userU requests to be a legal user and the server S conducts the next operations.U1 (U→S: {IDU,PWDU}). The user U generates his/her own identity IDU and password PWU freely. Then, U chooses a nonce NU randomly and computes (1)PWDU=H2PWU⊕NU.After that, U sends {IDU,PWDU} to the server securely.U2 (S→U: {SU,H2·}). After obtaining the message sent by U, the server S begins to compute(2)KU=H2sH1IDU,SU=KU⊕PWDU,TU=PWDU⊕KU.Then, S stores {TU} in the verification table. Afterward, the server issues a smart card containing {SU,H2·} and transmits it to U through a secure channel.U3. The NU is input into the smart card by the U, which contains {SU,NU,H2·}, finally.


#### 3.1.2. Device’s Registration Section

In this section, the deviceV requests to be authorized by the S, and the following steps should be performed together with the server.D1 (V→S: {IDV}). The device V transmits its identity {IDV} to the server S through a secure channel.D2 (S→V: {SV}). After obtaining the message sent by V, the S begins to compute(3)SV=sH1IDV.And it is sent to V via a secure channel. Afterward, the device’s public key and secret key are PV=H1(IDV) and SV.


### 3.2. Mutual Authentication and Key Agreement Phase

M1 (U→V: {MU}). After the U inserts his/her smart card into a smart card reader and inputs his/her identity IDU and password PWU, the smart card randomly chooses a secret number rU and a nonce NU′. And it computes(4)PWDU′=H2PWU⊕NU′,ML1=PWDU′⊕SU,ML2=H2SU⊕PWDU′,PWDU=H2PWU⊕NU,KU=SU⊕PWDU.Next U transmits the message MU={EKUrU,ML1,ML2} to V.M2 (V→S: {IDV,IDU,X,Y,MU}). Upon obtaining the message sent by U, the V chooses a number rV randomly and computes(5)X=rVP,HV=H3IDV∥IDU∥X∥MU,Y=rVPV+HVSV.Then, V transmits the message {IDV,IDU,X,Y,MU} to S.M3 (S→V: {IDS,IDV,IDU,MS1,MS2,MS3,MS4,MS5,MS6}). When the server receives the message, it computes (6)KU=H2sH1IDU,PWDU=TU⊕KU,PWDU′=ML1⊕KU⊕PWDUand checks whether ML2 is equal to H2(KU⊕PWDU⊕PWDU′). If this holds, the S will authenticate U and update TU with TU′=PWDU′⊕KU. Otherwise, this authentication request is rejected. Then, S computes (7)rU′=DKUEKUrU,HV′=H3IDV∥IDU∥X∥MUand checks whether(8)eP,Y=ePV,X+HV′PS.If this holds, the device V is authenticated by S. Otherwise, this authentication request is rejected. After that, the server generates two random strings rS1, rS3, and a random number rS2. S computes(9)MS1=EKUrS1,MS2=ErS1H2IDS∥IDV∥rS1⊕rU′,MS3=rS2P,kSV=H2rVrS2P,kSU=H2rU′∥rS1,MS5=EkSVrS3,MS6=EkSUrS3,hS=H3IDS∥IDV∥IDU∥MS1∥MS2∥MS3∥MS5∥MS6,MS4=rS2PS+PU+shSP.At last, the S replies with the message IDS,IDV,IDU,MS1,MS2,MS3,MS4,MS5,MS6 to V.The correctness of (8) is shown as follows:(10)eP,Y=eP,rV·PV+HV·SV=eP,rV·PVeP,HV·SV=erV·P,PVesP,HV·PV=ePV,XePV,HV·PS=ePV,X+HV·PS=ePV,X+HV′·PS.M4 (V→U: IDS,IDV,MS1,MS2,MS6,ErS3′rV1). After receiving the message from U, V computes(11)hS′=H3IDS∥IDV∥IDU∥MS1∥MS2∥MS3∥MS5∥MS6and checks whether (12)eP,MS4=ePS+PU,MS3ehS′P,PS.If this holds, the server S is authenticated by the device V. Otherwise, this authentication procedure fails. Then, V generates a random string rV1 and computes(13)kSV=H2rVMS3,rS3′=DkSVMS5,ErS3′rV1.Finally, V sends the message IDS,IDV,MS1,MS2,MS6,ErS3′(rV1) to the user U.The correctness of (12) is shown as follows:(14)eP,MS4=eP,rS2PS+PU+shS·P=eP,rS2PS+PUeP,shS·P=erS2·P,PS+PUesP,hS·P=ePS+PU,MS3ehS·P,PS=ePS+PU,MS3ehS′·P,PS.M5 (U→V: ErS3(rU1)). The user U computes (15)rS1′=DKUMS1SU′=SU⊕PWDU⊕PWDU′and checks whether DrS1′(MS2)⊕rU is equal to H2(IDS‖IDV‖rS1′). If it holds, the S is authenticated by the U. Otherwise, this authentication procedure fails. Then, U updates NU and SU with NU′ and SU′, which are saved in the smart card. After that, U generates a random string rU1 and computes(16)kSU=H2rU∥rS1,rS3=DkSUMS6,rV1=DrS3ErS3′rV1,ErS3rU1.Finally, U generates the session key shared with V by computing kUV=H2(rU1rV1 and sends the message ErS3(rU1) back to the device V.M6. After obtaining the message sent by U, the device V computes (17)rU1=DrS3ErS3rU1,kUV=H2rU1∥rV1.The kUV is the session key between U and device V.


### 3.3. Password Update Phase

When the user requests to change the passwordPWU to a new one (PWnew), he/she should perform the next procedures.P1 (U→S: MC). After the U inserts the smart card into a smart card reader and inputs his/her identity IDU, old password PWU and new password PWnew. Then the smart card chooses a secret nonce NU′ randomly to compute the following results:(18)PWDU′=H2PWU⊕NU′,MC1=PWDU′⊕SU,PWDnew=H2PWnew⊕NU′,MC2=H2SU⊕PWDU′⊕PWDnew,MC3=PWDnew⊕SU.Then, U transmits MC={MC1,MC2,MC3} to S.P2 (S→U: MC4). Once obtaining the message sent by U, the S computes(19)KU=H2sH1IDU,PWDU=TU⊕KU,PWDU′=MC1⊕KU⊕PWDU,PWDnew=MC3⊕KU⊕PWDU,MC4=H2PWDnew⊕KU⊕PWDUand checks whether MC2 is equal to H2(KU⊕PWDU⊕PWDU′⊕PWDnew). If it holds, the S will accept the user’s request and update the verifier TU′=PWDnew⊕KU. Otherwise, this request procedure is rejected. Then, the server S transmits the message {MC4} back to the user U.P3. Once the user obtains the message sent by the server, he/she checks whether MC4 is equal to H2(PWDnew⊕SU). If this holds, the user replaces NU and SU with NU′ and SU′, where SU′=SU⊕PWDU⊕PWDnew.


## 3.1. Registration Phase

### 3.1.1. User’s Registration Section

In this part, a userU requests to be a legal user and the server S conducts the next operations.U1 (U→S: {IDU,PWDU}). The user U generates his/her own identity IDU and password PWU freely. Then, U chooses a nonce NU randomly and computes (1)PWDU=H2PWU⊕NU.After that, U sends {IDU,PWDU} to the server securely.U2 (S→U: {SU,H2·}). After obtaining the message sent by U, the server S begins to compute(2)KU=H2sH1IDU,SU=KU⊕PWDU,TU=PWDU⊕KU.Then, S stores {TU} in the verification table. Afterward, the server issues a smart card containing {SU,H2·} and transmits it to U through a secure channel.U3. The NU is input into the smart card by the U, which contains {SU,NU,H2·}, finally.


### 3.1.2. Device’s Registration Section

In this section, the deviceV requests to be authorized by the S, and the following steps should be performed together with the server.D1 (V→S: {IDV}). The device V transmits its identity {IDV} to the server S through a secure channel.D2 (S→V: {SV}). After obtaining the message sent by V, the S begins to compute(3)SV=sH1IDV.And it is sent to V via a secure channel. Afterward, the device’s public key and secret key are PV=H1(IDV) and SV.


## 3.1.1. User’s Registration Section

In this part, a userU requests to be a legal user and the server S conducts the next operations.U1 (U→S: {IDU,PWDU}). The user U generates his/her own identity IDU and password PWU freely. Then, U chooses a nonce NU randomly and computes (1)PWDU=H2PWU⊕NU.After that, U sends {IDU,PWDU} to the server securely.U2 (S→U: {SU,H2·}). After obtaining the message sent by U, the server S begins to compute(2)KU=H2sH1IDU,SU=KU⊕PWDU,TU=PWDU⊕KU.Then, S stores {TU} in the verification table. Afterward, the server issues a smart card containing {SU,H2·} and transmits it to U through a secure channel.U3. The NU is input into the smart card by the U, which contains {SU,NU,H2·}, finally.


## 3.1.2. Device’s Registration Section

In this section, the deviceV requests to be authorized by the S, and the following steps should be performed together with the server.D1 (V→S: {IDV}). The device V transmits its identity {IDV} to the server S through a secure channel.D2 (S→V: {SV}). After obtaining the message sent by V, the S begins to compute(3)SV=sH1IDV.And it is sent to V via a secure channel. Afterward, the device’s public key and secret key are PV=H1(IDV) and SV.


## 3.2. Mutual Authentication and Key Agreement Phase

M1 (U→V: {MU}). After the U inserts his/her smart card into a smart card reader and inputs his/her identity IDU and password PWU, the smart card randomly chooses a secret number rU and a nonce NU′. And it computes(4)PWDU′=H2PWU⊕NU′,ML1=PWDU′⊕SU,ML2=H2SU⊕PWDU′,PWDU=H2PWU⊕NU,KU=SU⊕PWDU.Next U transmits the message MU={EKUrU,ML1,ML2} to V.M2 (V→S: {IDV,IDU,X,Y,MU}). Upon obtaining the message sent by U, the V chooses a number rV randomly and computes(5)X=rVP,HV=H3IDV∥IDU∥X∥MU,Y=rVPV+HVSV.Then, V transmits the message {IDV,IDU,X,Y,MU} to S.M3 (S→V: {IDS,IDV,IDU,MS1,MS2,MS3,MS4,MS5,MS6}). When the server receives the message, it computes (6)KU=H2sH1IDU,PWDU=TU⊕KU,PWDU′=ML1⊕KU⊕PWDUand checks whether ML2 is equal to H2(KU⊕PWDU⊕PWDU′). If this holds, the S will authenticate U and update TU with TU′=PWDU′⊕KU. Otherwise, this authentication request is rejected. Then, S computes (7)rU′=DKUEKUrU,HV′=H3IDV∥IDU∥X∥MUand checks whether(8)eP,Y=ePV,X+HV′PS.If this holds, the device V is authenticated by S. Otherwise, this authentication request is rejected. After that, the server generates two random strings rS1, rS3, and a random number rS2. S computes(9)MS1=EKUrS1,MS2=ErS1H2IDS∥IDV∥rS1⊕rU′,MS3=rS2P,kSV=H2rVrS2P,kSU=H2rU′∥rS1,MS5=EkSVrS3,MS6=EkSUrS3,hS=H3IDS∥IDV∥IDU∥MS1∥MS2∥MS3∥MS5∥MS6,MS4=rS2PS+PU+shSP.At last, the S replies with the message IDS,IDV,IDU,MS1,MS2,MS3,MS4,MS5,MS6 to V.The correctness of (8) is shown as follows:(10)eP,Y=eP,rV·PV+HV·SV=eP,rV·PVeP,HV·SV=erV·P,PVesP,HV·PV=ePV,XePV,HV·PS=ePV,X+HV·PS=ePV,X+HV′·PS.M4 (V→U: IDS,IDV,MS1,MS2,MS6,ErS3′rV1). After receiving the message from U, V computes(11)hS′=H3IDS∥IDV∥IDU∥MS1∥MS2∥MS3∥MS5∥MS6and checks whether (12)eP,MS4=ePS+PU,MS3ehS′P,PS.If this holds, the server S is authenticated by the device V. Otherwise, this authentication procedure fails. Then, V generates a random string rV1 and computes(13)kSV=H2rVMS3,rS3′=DkSVMS5,ErS3′rV1.Finally, V sends the message IDS,IDV,MS1,MS2,MS6,ErS3′(rV1) to the user U.The correctness of (12) is shown as follows:(14)eP,MS4=eP,rS2PS+PU+shS·P=eP,rS2PS+PUeP,shS·P=erS2·P,PS+PUesP,hS·P=ePS+PU,MS3ehS·P,PS=ePS+PU,MS3ehS′·P,PS.M5 (U→V: ErS3(rU1)). The user U computes (15)rS1′=DKUMS1SU′=SU⊕PWDU⊕PWDU′and checks whether DrS1′(MS2)⊕rU is equal to H2(IDS‖IDV‖rS1′). If it holds, the S is authenticated by the U. Otherwise, this authentication procedure fails. Then, U updates NU and SU with NU′ and SU′, which are saved in the smart card. After that, U generates a random string rU1 and computes(16)kSU=H2rU∥rS1,rS3=DkSUMS6,rV1=DrS3ErS3′rV1,ErS3rU1.Finally, U generates the session key shared with V by computing kUV=H2(rU1rV1 and sends the message ErS3(rU1) back to the device V.M6. After obtaining the message sent by U, the device V computes (17)rU1=DrS3ErS3rU1,kUV=H2rU1∥rV1.The kUV is the session key between U and device V.


## 3.3. Password Update Phase

When the user requests to change the passwordPWU to a new one (PWnew), he/she should perform the next procedures.P1 (U→S: MC). After the U inserts the smart card into a smart card reader and inputs his/her identity IDU, old password PWU and new password PWnew. Then the smart card chooses a secret nonce NU′ randomly to compute the following results:(18)PWDU′=H2PWU⊕NU′,MC1=PWDU′⊕SU,PWDnew=H2PWnew⊕NU′,MC2=H2SU⊕PWDU′⊕PWDnew,MC3=PWDnew⊕SU.Then, U transmits MC={MC1,MC2,MC3} to S.P2 (S→U: MC4). Once obtaining the message sent by U, the S computes(19)KU=H2sH1IDU,PWDU=TU⊕KU,PWDU′=MC1⊕KU⊕PWDU,PWDnew=MC3⊕KU⊕PWDU,MC4=H2PWDnew⊕KU⊕PWDUand checks whether MC2 is equal to H2(KU⊕PWDU⊕PWDU′⊕PWDnew). If it holds, the S will accept the user’s request and update the verifier TU′=PWDnew⊕KU. Otherwise, this request procedure is rejected. Then, the server S transmits the message {MC4} back to the user U.P3. Once the user obtains the message sent by the server, he/she checks whether MC4 is equal to H2(PWDnew⊕SU). If this holds, the user replaces NU and SU with NU′ and SU′, where SU′=SU⊕PWDU⊕PWDnew.


## 4. Cryptanalysis of Yang et al.’s Scheme

Recently, Mishra and Mukhopadhyay demonstrated Yang et al.’s scheme is vulnerable to the password guessing attack and the denial of service attack. Moreover, they also pointed that Yang et al.’ scheme does not present efficient login and password change phases such that smart card executes the session in case of incorrect input [13]. Based on the attacks and problems mentioned in Mishra et al.’s article, we analyze Yang et al.’s scheme and find out that the scheme does not resist the session key attack. In addition to this, we also discover that there are some mistakes in their scheme. We will introduce our new discoveries in the following.


### 4.1. Session Key Attack

If an attacker intercepted the messageIDS,IDV,IDU,MS1,MS2,MS3,MS4,MS5,MS6 which was sent from the server to the device and modified some data in it, the user and the device may establish different session key. So the attacker A can realize the session key attack as the following steps.(1) The attackerA can intercept and capture the message IDS,IDV,IDU,MS1,MS2,MS3,MS4,MS5,MS6 sent to device by the server. Next, A generates a number r0 randomly and computes(20)MS30=r0P,hS0=H3IDS∥IDV∥IDU∥MS1∥MS2∥MS30∥MS5∥MS6,MS40=r0PS+PU+hS0PS.Then, the message {IDS,IDV,IDU,MS1,MS2,MS30,MS40,MS5,MS6} is sent to the device V by the attacker A.(2) After receiving the message,V computes(21)hS0′=H3IDS∥IDV∥IDU∥MS1∥MS2∥MS30∥MS5∥MS6and checks the equation(22)eP,MS40=ePS+PU,MS30ehS0′P,PS.Obviously, they are equal. Then, V generates a random string rV1 and computes(23)kSV0=H2rVMS30,rS30=DkSV0MS5,ErS30rV1.Finally, V sends the message IDS,IDV,MS1,MS2,MS6,ErS30(rV1) to the user U. In this step, the string rS30 is not equal to the random string rS3 generated by the server.The correctness of (22) is shown as follows:(24)eP,MS40=eP,r0PS+PU+hS0·PS=eP,r0PS+PUeP,hS0·PS=er0·P,PS+PUehS0·P,PS=ePS+PU,MS30ehS0′·P,PS.(3) Because A did not modify the message IDS,IDV,MS1,MS2,, DrS1′(MS2)⊕rU is equal to H2(IDS‖IDV‖rS1′). Then, U updates NU and SU. After that, U generates a random string rU1 and computes(25)kSU=H2rU∥rS1,rS3′=DkSUMS6,rV10=DrS3′ErS30rV1,ErS3′rU1.Finally, U generates the session key kUV=H2(rU1rV10 shared with the device and sends the message ErS3′(rU1) back to the device V. In this step, the string rS3′ is equal to the random string rS3 generated by the server and not equal to the string rS30 computed by the device.(4) Once obtaining the message sent by the user, the device computes(26)rU10=DrS30ErS3′rU1,kUV0=H2rU10∥rV1,kUV0 is the session key shared between the user U and the device V. Obviously, the session key kUV computed by the user is different from the session key kUV0 computed by the device. So Yang et al.’s scheme suffers from the session key attack.


### 4.2. Some Mistakes

In mutual authentication and key agreement phase, the identityIDU has not been sent to the device V. But, when the device computes HV=H3(IDV‖IDU‖X‖MU), it already knows the user’s identity. According to the common sense, if the user has not sent identity to the device, the device cannot obtain the user’s identity. So there is a mistake in this phase. What is more, this mistake also exists in the password update phase of Yang et al.’s scheme.


## 4.1. Session Key Attack

If an attacker intercepted the messageIDS,IDV,IDU,MS1,MS2,MS3,MS4,MS5,MS6 which was sent from the server to the device and modified some data in it, the user and the device may establish different session key. So the attacker A can realize the session key attack as the following steps.(1) The attackerA can intercept and capture the message IDS,IDV,IDU,MS1,MS2,MS3,MS4,MS5,MS6 sent to device by the server. Next, A generates a number r0 randomly and computes(20)MS30=r0P,hS0=H3IDS∥IDV∥IDU∥MS1∥MS2∥MS30∥MS5∥MS6,MS40=r0PS+PU+hS0PS.Then, the message {IDS,IDV,IDU,MS1,MS2,MS30,MS40,MS5,MS6} is sent to the device V by the attacker A.(2) After receiving the message,V computes(21)hS0′=H3IDS∥IDV∥IDU∥MS1∥MS2∥MS30∥MS5∥MS6and checks the equation(22)eP,MS40=ePS+PU,MS30ehS0′P,PS.Obviously, they are equal. Then, V generates a random string rV1 and computes(23)kSV0=H2rVMS30,rS30=DkSV0MS5,ErS30rV1.Finally, V sends the message IDS,IDV,MS1,MS2,MS6,ErS30(rV1) to the user U. In this step, the string rS30 is not equal to the random string rS3 generated by the server.The correctness of (22) is shown as follows:(24)eP,MS40=eP,r0PS+PU+hS0·PS=eP,r0PS+PUeP,hS0·PS=er0·P,PS+PUehS0·P,PS=ePS+PU,MS30ehS0′·P,PS.(3) Because A did not modify the message IDS,IDV,MS1,MS2,, DrS1′(MS2)⊕rU is equal to H2(IDS‖IDV‖rS1′). Then, U updates NU and SU. After that, U generates a random string rU1 and computes(25)kSU=H2rU∥rS1,rS3′=DkSUMS6,rV10=DrS3′ErS30rV1,ErS3′rU1.Finally, U generates the session key kUV=H2(rU1rV10 shared with the device and sends the message ErS3′(rU1) back to the device V. In this step, the string rS3′ is equal to the random string rS3 generated by the server and not equal to the string rS30 computed by the device.(4) Once obtaining the message sent by the user, the device computes(26)rU10=DrS30ErS3′rU1,kUV0=H2rU10∥rV1,kUV0 is the session key shared between the user U and the device V. Obviously, the session key kUV computed by the user is different from the session key kUV0 computed by the device. So Yang et al.’s scheme suffers from the session key attack.


## 4.2. Some Mistakes

In mutual authentication and key agreement phase, the identityIDU has not been sent to the device V. But, when the device computes HV=H3(IDV‖IDU‖X‖MU), it already knows the user’s identity. According to the common sense, if the user has not sent identity to the device, the device cannot obtain the user’s identity. So there is a mistake in this phase. What is more, this mistake also exists in the password update phase of Yang et al.’s scheme.


## 5. Our Proposed Scheme

Based on Yang et al.’s scheme, our protocol also contains four phases: the registration phase, the login phase, the key agreement phase, and the password update phase. Algorithm1 describes our scheme’s registration phase. The login phase and the key agreement phase will be shown in Algorithm 2. At last, we show the password update phase in Algorithm 3. The detail is shown as the following.Algorithm 1:The registration phase.
User’sRegistration Phase:
U                       S
ChooseIDU and PWU
Generate a random noncerU
ComputePWDU=H2(PWU⊕rU)IDDU=H2(IDU⊕rU){IDU,PWDU,IDDU}{IDU,PWDU,IDDU}→ComputeKU=H2(sH1(IDDU))
ComputePWDU=H2(PWU⊕rU)IDDU=H2(IDU⊕rU)→{IDU,PWDU,IDDU}  ComputeQU=H2(sH1(PWDU))
ComputePWDU=H2(PWU⊕rU)IDDU=H2(IDU⊕rU){IDU,PWDU,IDDU}{IDU,PWDU,IDDU}→ComputeSU=KU⊕PWDU⊕H2(IDU)
ComputePWDU=H2(PWU⊕rU)IDDU=H2(IDU⊕rU){IDU,PWDU,IDDU}{IDU,PWDU,IDDU}→ComputeMU=QU⊕IDU
ComputePWDU=H2(PWU⊕rU)IDDU=H2(IDU⊕rU){IDU,PWDU,IDDU}{IDU,PWDU,IDDU}→ComputePU=H2(KU⊕QU)
EnterrU into smart card       ←smart card      Store {SU,PU,MU,P,H2(⋅),EK(⋅)/DK(⋅)}
into smart card
Device’s Registration Phase:
V                       S
InputIDV            →{IDV}←{SV}      Compute SV=sH1(IDV)Algorithm 2:The login phase and the key agreement phase.
U               V           S
Login Phase:
InputIDU and PWU
ComputePWDU=H2(PWU⊕rU)KU′=SU⊕PWDU⊕H2(IDU)QU′=MU⊕IDU
CheckPU≟H2(KU′⊕QU′)
Key agreement Phase:
Generate a random stringrU1
ComputeMU1=H2(KU′⊕QU′⊕rU1)IDDU=H2(IDU⊕rU)
MU2V1={IDDU,EKU′(rU1),ErU1(PWDU),MU1}
→{MU2V1} Generate a random number rV1
→{MU2V1}   ComputeX=rV1⋅P
→{MU2V1} ComputeHV1=H3(IDV∥IDDU∥X∥MU2V1)
→{MU2V1}   ComputeY=rV1⋅PV+HV1⋅sV
→{MU2V1}   MV2S={IDV,X,Y,MU2V1}
→{MU2V1}      →{MV2S} ComputeHV1′=H3(IDV∥IDDU∥X∥MU2V1)Checke(P,Y)≟e(PV,X+HV1′⋅PS)
→{MU2V1}      →{MV2S} ComputeKU=H2(sH1(IDDU))rU1′=DKU(EKU′(rU1))PWDU′=DrU1′(ErU1(PWDU))QU=H2(sH1(PWDU′))CheckMU1≟H2(KU⊕QU⊕rU1′)
→{MU2V1}      →{MS2V}   Generate a random string rS1
→{MU2V1}      ←{MS2V}  ComputekSV=s⋅X=(kSVx,kSVy)SV=s⋅H1(IDV)=(SVx,SVy)MS1=kSVx⊕kSVy⊕rS1MS2=H2(rU1′∥KU)⊕rS1MS3=H2(rU1′⊕KU⊕MS2)
→{MU2V1}      ←{MS2V} ComputeMS4=H2(kSVx∥kSVy∥SVx∥SVy∥MS1∥MS3)
→{MU2V1}      ←{MS2V}  MS2V={MS1,MS2,MS3,MS4}
→{MU2V1}ComputekSV′=rV1⋅PS=(kSVx′,kSVy′)CheckMS4≟H2(kSVx′∥kSVy′∥SSVx∥SSVy∥MS1∥MS3)
→{MU2V1} Generate a random number rV2
→{MU2V1} ComputerS1′=MS1⊕kSVx′⊕kSVy′
CheckMS3≟H2(rU1⊕KU′⊕MS2)←{MS2V}RV=rV2⋅P=(RVx,RVy)HV2=H2(RVx∥RVy∥rS1′)
ComputerS1′′=MS2⊕H2(rU1∥KU′)   MV2U={RV,HV2,MS2,MS3}
CheckHV2≟H2(RVx∥RVy∥rS1′′)
Generate a random numberrU2
ComputeRU=rU2⋅P=(RUx,RUy)HU=H2(RUx∥RUy∥rS1′′)
ComputeRUV=rU2⋅RV     →{MU2V2}  Check        HU≟H2(RUx∥RUy∥rS1′)
ComputekUV=H2(RU∥RV∥RUV)     ComputeRUV′=rV2⋅RU
MU2V2={RU,HU}           ComputekUV′=H2(RU∥RV∥RUV′)Algorithm 3:The password update phase of our scheme.
U                     S
InputIDU,PWU and PWnew
Compute
PW
D
U
=
H
2
(
PW
U
⊕
r
U
)
K
U
′
=
S
U
⊕
PW
D
U
⊕
H
2
(
ID
U
)
Q
U
′
=
M
U
⊕
ID
U
CheckPU≟H2(KU′⊕QU′)
Generate a random stringrC1
Compute
ID
D
U
=
H
2
(
ID
U
⊕
r
U
)
PW
D
new
=
H
2
(
PW
new
⊕
r
U
)
M
U
C
1
=
PW
D
new
⊕
S
U
⊕
H
2
(
ID
U
)
M
U
C
2
=
H
2
(
K
U
′
⊕
Q
U
′
⊕
r
C
1
⊕
PW
D
new
)
MU2S={IDDU,EKU′(rC1),ErC1(PWDU),MUC1,MUC2}
MU2S={IDDU,EKU′(rc1),ErC1(PWDU),MUC1,(MUC2)}→{MU2V1} ComputeKU=H2(sH1(IDDU))
MU2S={IDDU,EKU′(rc1),ErC1(PWDU),MUC1,(MUC2)}→{MU2V1} ComputerC1′=DKU(EKU′(rC1))PWDU′=DrC1′(ErC1(PWDU))QU=H2(sH1(PWDU′))PWDnew′=MUC1⊕KU⊕PWDU′
MU2S={IDDU,EKU′(rc1),ErC1(PWDU),MUC1,(MUC2)}→{MU2V1} CheckMUC2≟H2(KU⊕QU⊕rU1′⊕PWDnew′)
MU2S={IDDU,EKU′(rc1),ErC1(PWDU),MUC1,(MUC2)}→{MU2V1} ComputeQUnew=H2(sH1(PWDnew′))MSC1=QUnew⊕H2(KU⊕rC1′)
Compute
Q
U
new
′
=
M
S
C
1
⊕
H
2
(
K
U
′
⊕
r
C
1
)      ←{MS2V}    ComputeMSC2=H2(QUnew)⊕H2(PWDnew′∥rC1′)
Check
M
S
C
2
≟
H
2
(
Q
U
new
′
)
⊕
H
2
(
PW
D
new
∥
r
C
1
)          MS2U={MSC1,MSC2}
Compute
S
U
new
=
K
U
′
⊕
PW
D
new
⊕
H
2
(
ID
U
)
P
U
new
=
H
2
(
K
U
′
⊕
Q
U
new
′
)
M
U
new
=
Q
U
new
′
⊕
ID
U
Replace
S
U
,
P
U
,
M
U
with
S
U
new
,
P
U
new
,
M
U
new


### 5.1. Registration Phase

In our proposed scheme, the registration phase also can be divided into two parts: the user’s registration phase and the device’s registration phase. Our device’s registration phase is the same as the device’s registration phase in Yang et al.’s scheme. We will describe our user’s registration phase as follows.R1 (U→S: {IDU,PWDU,IDDU}). An identity IDU and password PWU are chosen by user U freely. Then, U generates a nonce rU randomly and computes (27)PWDU=H2PWU⊕rU,IDDU=H2IDU⊕rU.After that, U sends {IDU,PWDU,IDDU} to the server S via a secure channel.R2 (S→U: {SU,PU,MU,P,H2·,EK(·)/DK(·)}). After obtaining the message sent by U, S computes(28)KU=H2sH1IDDU,QU=H2sH1PWDU,SU=KU⊕PWDU⊕H2IDU,MU=QU⊕IDU,PU=H2KU⊕QU.Then, the server U issues a smart card containing {SU,PU,MU,P,H2·,EK(·)/DK(·)} and passes it to U securely.R3. U enters rU into the smart card, so it contains {rU,SU,PU,MU,P,H2·,EK(·)/DK(·)}.


### 5.2. Login Phase

U inserts his/her smart card into a smart card reader and inputs his/her identity IDU and password PWU. Then the smart card begins to compute(29)PWDU=H2PWU⊕rU,KU′=SU⊕PWDU⊕H2IDU,QU′=MU⊕IDUand checks whether PU is equal to H2(KU′⊕QU′). If this holds, it will authenticate the identity and password of the user. Otherwise, this user’s request procedure is rejected.


### 5.3. Key Agreement Phase

There are six steps and five messages during each run of the proposed protocol. The details are as follows.A1 (U→V: {MU2V1}). Then, the smart card generates a secret string rU1 randomly and computes(30)MU1=H2KU′⊕QU′⊕rU1,IDDU=H2IDU⊕rU.Next U transmits the message MU2V1={IDDU,EKU′rU1,ErU1PWDU,MU1} to V.A2 (V→S: {MV2S}). Upon obtaining the message sent by U, the V generates a number rV1 randomly and computes(31)X=rV1·P,HV1=H3IDV∥IDDU∥X∥MU2V1,Y=rV1·PV+HV1·SV.Then, V transmits the message MV2S={IDV,X,Y,MU2V1} to the server S.A3 (S→V: MS2V). When the server received the message, it computes (32)HV1′=H3IDV∥IDDU∥X∥MU2V1and checks whether e(P,Y) is equal to e(PV,X+HV1′·PS). If this holds, the device V is authenticated by S. Otherwise, this authentication request is rejected. Then, S computes (33)KU=H2sH1IDDU,rU1′=DKUEKU′rU1,PWDU′=DrU1′ErU1PWDU,QU=H2sH1PWDU′and checks whether MU1 is equal to H2(KU⊕QU⊕rU1′). If this holds, the user U is authenticated by S. Otherwise, this authentication request is rejected. After that, the server S generates a random string rS1. Then S computes (34)kSV=s·X=kSVx,kSVy,SV=s·H1IDV=SVx,SVy,MS1=kSVx⊕kSVy⊕rS1,MS2=H2rU1′∥KU⊕rS1,MS3=H2rU1′⊕KU⊕MS2,MS4=H2kSVx∥kSVy∥SVx∥SVy∥MS1∥MS3.Finally, theS replies with the message MS2V=MS1,MS2,MS3,MS4 to the device V.A4 (V→U: MV2U). After receiving the message, V computes(35)kSV′=rV1·PS=kSVx′,kSVy′and checks whether MS4 is equal to H2(kSVx′‖kSVy′‖SVx‖SVy‖MS1‖MS3). If this holds, the S is authenticated by the device V. Otherwise, this authentication procedure fails. Then, V generates a random number rV2 and computes(36)rS1′=MS1⊕kSVx′⊕kSVy′,RV=rV2·P=RVx,RVy,HV2=H2RVx∥RVy∥rS1′.Finally, the device V transmits the message MV2U=RV,HV2,MS2,MS3 to the user U.A5 (U→V: MU2V2). The user U checks whether MS3 is equal to H2(rU1⊕KU′⊕MS2). If this holds, the user U authenticates the S. Otherwise, this authentication procedure fails. After that, U computes(37)rS1′′=MS2⊕H2rU1∥KU′.Then, the user U checks whether HV2 is equal to H2(RVx‖RVy‖rS1′′). If this holds, the device V is authenticated by the user U. Otherwise, this authentication procedure fails. U generates a random number rU2 and computes(38)RU=rU2·P=RUx,RUy,HU=H2RUx∥RUy∥rS1′′,RUV=rU2·RV,kUV=H2RU∥RV∥RUV,where kUV is the session key shared between the user U and the device V. Finally, U sends the message MU2V2=RU,HU back to the device V.A6. After obtaining the message sent by the user, the device V checks whether HU is equal to H2(RUx‖RUy‖rS1′). If this holds, the user U is authenticated by the device V. Otherwise, this authentication procedure fails. Then, V computes(39)RUV′=rV2·RU,kUV′=H2RU∥RV∥RUV′.The kUV′ is the session key between the user U and the device V.


### 5.4. Password Update Phase

When the user requests to update his/her passwordPWU to a new PWnew, he/she should perform the next procedures.C1
U
→
S
:
I
D
D
U
,
E
K
U
′
r
C
1
,
E
r
C
1
P
W
D
U
,
M
U
C
1
,
M
U
C
2. U inserts his/her smart card into a smart card reader and inputs his/her identity IDU, old password PWU, and new password PWnew. Then the smart card checks whether PU is equal to H2(SU⊕H2(PWU⊕rU)⊕MU⊕IDU). If this holds, it will authenticate the identity and password of the user. Otherwise, this user’s password update request procedure is rejected. After this, the smart card generates a secret string rC1 randomly and computes(40)KU′=SU⊕H2PWU⊕rU⊕H2IDU,QU′=MU⊕IDU,IDDU=H2IDU⊕rU,PWDnew=H2PWnew⊕rU,MUC1=PWDnew⊕SU⊕H2IDU,MUC2=H2KU′⊕QU′⊕rC1⊕PWDnew.Next U transmits the message {IDDU,EKU′rC1,ErC1PWDU,MUC1,MUC2} to the S.C2 (S→U: MSC1,MSC2). Once obtaining the message sent by the user, the S computes(41)KU=H2sH1IDDU,rC1′=DKUEKU′rC1,PWDU′=DrC1′ErC1PWDU,QU=H2sH1PWDU′,PWDnew′=MUC1⊕KU⊕PWDU′and checks whether MUC2 is equal to H2(KU⊕QU)⊕rC1′⊕PWDnew′). If this holds, S will accept the user’s request. Otherwise, this request procedure is rejected. Then, the server S computes(42)QUnew=H2sH1PWDnew′,MSC1=QUnew⊕H2KU⊕rC1′,MSC2=H2QUnew⊕H2PWDnew′∥rC1′and sends the message {MSC1,MSC2} back to the user U.C3. When the user received the message from the server, he/she computes(43)QUnew′=MSC1⊕H2KU′⊕rC1and checks whether MSC2 is equal to H2(QUnew′)⊕H2(PWDnew⊕rC1). If not, the request is rejected. Otherwise, the user computes(44)SUnew=KU′⊕PWDnew⊕H2IDU,PUnew=H2KU′⊕QUnew′,MUnew=QUnew′⊕IDUand replaces SU, PU, and MU with SUnew, PUnew, and MUnew, which are all saved in the smart card.


## 5.1. Registration Phase

In our proposed scheme, the registration phase also can be divided into two parts: the user’s registration phase and the device’s registration phase. Our device’s registration phase is the same as the device’s registration phase in Yang et al.’s scheme. We will describe our user’s registration phase as follows.R1 (U→S: {IDU,PWDU,IDDU}). An identity IDU and password PWU are chosen by user U freely. Then, U generates a nonce rU randomly and computes (27)PWDU=H2PWU⊕rU,IDDU=H2IDU⊕rU.After that, U sends {IDU,PWDU,IDDU} to the server S via a secure channel.R2 (S→U: {SU,PU,MU,P,H2·,EK(·)/DK(·)}). After obtaining the message sent by U, S computes(28)KU=H2sH1IDDU,QU=H2sH1PWDU,SU=KU⊕PWDU⊕H2IDU,MU=QU⊕IDU,PU=H2KU⊕QU.Then, the server U issues a smart card containing {SU,PU,MU,P,H2·,EK(·)/DK(·)} and passes it to U securely.R3. U enters rU into the smart card, so it contains {rU,SU,PU,MU,P,H2·,EK(·)/DK(·)}.


## 5.2. Login Phase

U inserts his/her smart card into a smart card reader and inputs his/her identity IDU and password PWU. Then the smart card begins to compute(29)PWDU=H2PWU⊕rU,KU′=SU⊕PWDU⊕H2IDU,QU′=MU⊕IDUand checks whether PU is equal to H2(KU′⊕QU′). If this holds, it will authenticate the identity and password of the user. Otherwise, this user’s request procedure is rejected.


## 5.3. Key Agreement Phase

There are six steps and five messages during each run of the proposed protocol. The details are as follows.A1 (U→V: {MU2V1}). Then, the smart card generates a secret string rU1 randomly and computes(30)MU1=H2KU′⊕QU′⊕rU1,IDDU=H2IDU⊕rU.Next U transmits the message MU2V1={IDDU,EKU′rU1,ErU1PWDU,MU1} to V.A2 (V→S: {MV2S}). Upon obtaining the message sent by U, the V generates a number rV1 randomly and computes(31)X=rV1·P,HV1=H3IDV∥IDDU∥X∥MU2V1,Y=rV1·PV+HV1·SV.Then, V transmits the message MV2S={IDV,X,Y,MU2V1} to the server S.A3 (S→V: MS2V). When the server received the message, it computes (32)HV1′=H3IDV∥IDDU∥X∥MU2V1and checks whether e(P,Y) is equal to e(PV,X+HV1′·PS). If this holds, the device V is authenticated by S. Otherwise, this authentication request is rejected. Then, S computes (33)KU=H2sH1IDDU,rU1′=DKUEKU′rU1,PWDU′=DrU1′ErU1PWDU,QU=H2sH1PWDU′and checks whether MU1 is equal to H2(KU⊕QU⊕rU1′). If this holds, the user U is authenticated by S. Otherwise, this authentication request is rejected. After that, the server S generates a random string rS1. Then S computes (34)kSV=s·X=kSVx,kSVy,SV=s·H1IDV=SVx,SVy,MS1=kSVx⊕kSVy⊕rS1,MS2=H2rU1′∥KU⊕rS1,MS3=H2rU1′⊕KU⊕MS2,MS4=H2kSVx∥kSVy∥SVx∥SVy∥MS1∥MS3.Finally, theS replies with the message MS2V=MS1,MS2,MS3,MS4 to the device V.A4 (V→U: MV2U). After receiving the message, V computes(35)kSV′=rV1·PS=kSVx′,kSVy′and checks whether MS4 is equal to H2(kSVx′‖kSVy′‖SVx‖SVy‖MS1‖MS3). If this holds, the S is authenticated by the device V. Otherwise, this authentication procedure fails. Then, V generates a random number rV2 and computes(36)rS1′=MS1⊕kSVx′⊕kSVy′,RV=rV2·P=RVx,RVy,HV2=H2RVx∥RVy∥rS1′.Finally, the device V transmits the message MV2U=RV,HV2,MS2,MS3 to the user U.A5 (U→V: MU2V2). The user U checks whether MS3 is equal to H2(rU1⊕KU′⊕MS2). If this holds, the user U authenticates the S. Otherwise, this authentication procedure fails. After that, U computes(37)rS1′′=MS2⊕H2rU1∥KU′.Then, the user U checks whether HV2 is equal to H2(RVx‖RVy‖rS1′′). If this holds, the device V is authenticated by the user U. Otherwise, this authentication procedure fails. U generates a random number rU2 and computes(38)RU=rU2·P=RUx,RUy,HU=H2RUx∥RUy∥rS1′′,RUV=rU2·RV,kUV=H2RU∥RV∥RUV,where kUV is the session key shared between the user U and the device V. Finally, U sends the message MU2V2=RU,HU back to the device V.A6. After obtaining the message sent by the user, the device V checks whether HU is equal to H2(RUx‖RUy‖rS1′). If this holds, the user U is authenticated by the device V. Otherwise, this authentication procedure fails. Then, V computes(39)RUV′=rV2·RU,kUV′=H2RU∥RV∥RUV′.The kUV′ is the session key between the user U and the device V.


## 5.4. Password Update Phase

When the user requests to update his/her passwordPWU to a new PWnew, he/she should perform the next procedures.C1
U
→
S
:
I
D
D
U
,
E
K
U
′
r
C
1
,
E
r
C
1
P
W
D
U
,
M
U
C
1
,
M
U
C
2. U inserts his/her smart card into a smart card reader and inputs his/her identity IDU, old password PWU, and new password PWnew. Then the smart card checks whether PU is equal to H2(SU⊕H2(PWU⊕rU)⊕MU⊕IDU). If this holds, it will authenticate the identity and password of the user. Otherwise, this user’s password update request procedure is rejected. After this, the smart card generates a secret string rC1 randomly and computes(40)KU′=SU⊕H2PWU⊕rU⊕H2IDU,QU′=MU⊕IDU,IDDU=H2IDU⊕rU,PWDnew=H2PWnew⊕rU,MUC1=PWDnew⊕SU⊕H2IDU,MUC2=H2KU′⊕QU′⊕rC1⊕PWDnew.Next U transmits the message {IDDU,EKU′rC1,ErC1PWDU,MUC1,MUC2} to the S.C2 (S→U: MSC1,MSC2). Once obtaining the message sent by the user, the S computes(41)KU=H2sH1IDDU,rC1′=DKUEKU′rC1,PWDU′=DrC1′ErC1PWDU,QU=H2sH1PWDU′,PWDnew′=MUC1⊕KU⊕PWDU′and checks whether MUC2 is equal to H2(KU⊕QU)⊕rC1′⊕PWDnew′). If this holds, S will accept the user’s request. Otherwise, this request procedure is rejected. Then, the server S computes(42)QUnew=H2sH1PWDnew′,MSC1=QUnew⊕H2KU⊕rC1′,MSC2=H2QUnew⊕H2PWDnew′∥rC1′and sends the message {MSC1,MSC2} back to the user U.C3. When the user received the message from the server, he/she computes(43)QUnew′=MSC1⊕H2KU′⊕rC1and checks whether MSC2 is equal to H2(QUnew′)⊕H2(PWDnew⊕rC1). If not, the request is rejected. Otherwise, the user computes(44)SUnew=KU′⊕PWDnew⊕H2IDU,PUnew=H2KU′⊕QUnew′,MUnew=QUnew′⊕IDUand replaces SU, PU, and MU with SUnew, PUnew, and MUnew, which are all saved in the smart card.


## 6. Security Model and Proof

In this part, the provable secure method will be employed to prove that our proposed protocol is provable secure in the models in [18].


### 6.1. Security Model

In 2005, Abdalla et al. proposed a security model AFP05, which is suitable for the three-party authenticated key agreement scenario. It contains two types of participants, such as the client and the trusted server [18]. But there are three types of participants in our proposed protocol, a user, a trusted device, and a trusted server. So we add a querySendDevice in our security model. During the execution of the protocol, U and V have many instances, respectively. Ui and Vj denote the ith instance of U and the jth instance of V. There exists one state of accept, reject, and ⊥ in an oracle. If the oracle gets correct message, it turns the accept state; otherwise, it turns reject. ⊥ means that no decision has been reached or no result has been returned. The adversary A, which is abstracted as a probabilistic polynomial time Turing Machine, interacts with other participants through a bounded number of queries which model the capabilities of the adversary in an actual attack. The queries are listed as follows.SendClient
(
U
i
,
m
). After receiving message m sent by the adversary, the Ui generates a message and outputs as the result of this query. A querySendClient(Ui,Start) begins a new key agreement process.SendDevice
(
V
j
,
m
). After receiving message m sent by the adversary, the Vj generates a message and output.SendServer
(
S
,
m
). After receiving message m sent by the adversary, the S generates a message and output.Reveal
(
U
i
/
V
j
). If no session key is defined for instance Ui/Vj or if either Ui/Vj or its partner is asked aTest query, the result of this query is the invalid symbol ⊥. Otherwise the session key generated by the instance Ui/Vj is returned.Test
(
U
i
/
V
j
). If no session key is defined for instance Ui/Vj or if either Ui/Vj or its partner is asked aReveal query, the result of this query is the invalid symbol ⊥. Otherwise, the oracle flips a coin b. If b=1, the session key is output. Otherwise, a value randomly chosen from the distribution space of session key is output.The queries defined in our improved AFP05 security model can be simulated using theSendClient,SendDevice, andSendServer queries repeatedly if we assume that there is at least one benign adversary which faithfully relays message flows. In our improved AFP05 security model, the notion of freshness is already embedded in the definition of the oracles. A Find-Then-Guess (FTG) model exists in our improved AFP05 security model, in which the semantic security is defined by a game with two phases. In the first phase, the adversary is able to adaptively executeSendClient,SendDevice,SendServer,Reveal, andTest query. In the second, A executes a singleTest query and guesses a bit b′ for b, where b is selected in theTest query. If b′=b, the adversary wins the game. Let Succ denote the event that the adversary correctly guesses the bit b, and the advantage of A that attacks the protocol S is defined as (45)AdvSFTG-3PAKAA=2Pr⁡Succ-1.A 3PAKA protocolS is considered semantically secure in FTG model if and only if AdvSFTG-3PAKAt,Q=maxA{AdvSFTG-3PAKA(A)} is negligible, where the maximum time executed by all the adversaries with time-complexity at most t and the number of queries at most Q.


### 6.2. Mathematical Computational Problems [10]

Letp, r be two large prime numbers and r∣(p-1). Let G be a multiplicative subgroup of Zp∗, with prime number r order and element g0 generator.Computational Diffie-Hellman Problem (CDH). Given {g0,g0a,g0b∈G} and a,b∈RZr∗, it is hard to compute gab mod p.The probabilistic polynomial time Turing Machine denoted asΔ, the probability of which could successfully solve CDH problem in G, is defined as(46)SuccGCDHΔ=Pr⁡Δga,gb=gabmodp:a,b∈RZr∗.CDH Assumption. For any probabilistic Turing Machine Δ, the probability of SuccGCDHΔ is negligible.Elliptic Curve Computational Diffie-Hellman (ECCDH) Assumption. Let G1 be an additive point group with an elliptic curve by the generator P and aP and bP are elements of G1. A is able to compute the value of abP only with aP and bP in time t at most(47)SuccG1ECCDHΔ,t=Pr⁡ΔaP,bP=abP:a,b∈RZq∗.The factSuccG1ECCDH(Δ,t) is negligible means that the ECCDH assumption holds.


### 6.3. Security Proof

Theorem 1.
The hash functionsH1(·), H2(·), and H3(·) are modeled as random oracles. Let A be an adversary against our protocol S within time t. We denote that q1, q2, and q3, respectively, represent the number of H1(·), H2(·), and H3(·) oracle queries executed by A, and qsc,qsv, and qss denote the number ofSendClient queries,SendDevice queries, andSendServer queries. Then,(48)AdvSFTG-DRMt,Q≤q12+q32+qss+10q2+2q3q-1+q22+2qss+4qsc+4qsv2l+2q2SuccP,G1CDHt′,where Q={q1,q2,q3,qsc,qsv,qss} and t′≤t+(qsc+qsv+qss)Ts, with Ts denoting the computational time of one scalar multiplication in G1.Proof.
We define several attack games from GameGM0 to Game GM6. For each game GMi, Succi denotes the event that A has successfully guessed the bit b in the test session. The games are listed as follows.
Hash, Reveal, Test Queries.(i)
For a hash queryHi,∗,h, i∈{1,2,3}, we proceed as follows:
(a)
RuleH(1): If a record i,∗,h exists on list Lh, h is returned. Otherwise, h←G1(i=1)/0,1l(i=2)/Zq∗(i=3) and h is returned. Record i,∗,h is added to list Lh. If the adversary directly issues this query, the record i,∗,h is added to list LA.(ii)
For a queryReveal(Ui/Vj), we proceed as follows:
(a)
If no session key is defined for instanceUi/Vj or if either Ui/Vj or its partner is asked aTest query, the output is ⊥. Otherwise the output of this query is kUV which is defined for the instance Ui/Vj.(iii)
For a query Test(Ui/Vj), we proceed as follows:
(a)
If no session key is defined for instanceUi/Vj or if either Ui/Vj or its partner is asked aReveal query, the output is ⊥. Otherwise, the oracle flips a bit b. If b=1, the session key is output. Otherwise, a value randomly chosen from the distribution space of session key is output.
Game
G
M
0. This is the actual attack game. According to the definition, we have (49)AdvPFTG-DRMA=2Pr⁡Succ0-1.Otherwise, we randomly generate a bit b′ if the game aborts or stops without answer from A or A has not finished the game.
Game
G
M
1
. We simulate all the oracles for each query and keep three lists to store the oracles answers. Lh stores answers of random oracles H1(·), H2(·), and H3·. LA is denoted for random oracle query asked by A. LS is for the transcripts in the channel. We simulate theSendClient,SendDevice,SendServer,Reveal, andTest queries as in the actual attack. We list hash,Reveal,Test queries inHash, Reveal, Test Queries andSendClient,SendDevice,SendServer queries inSendClient,SendDevice,SendServer Queries. Obviously, game GM0 and game GM1 are indistinguishable. So we have(50)Pr⁡Succ1=Pr⁡Succ0.
Game
G
M
2
. In this game, all the oracles simulated are almost the same as in the game GM1, but here, we avoid some collisions in the transcripts. The hash oracles H1(·), H2(·), and H3(·) may collide with different input values. We use the following rule.
Rule
H
(
2
). If this query is directly issued by the adversary, and i,∗,hi∈{1,2,3}∈LA, the game abort; Otherwise, h is returned.
Given that hash valueh is selected from a random uniform distribution, the probability of collisions is at most q12/2(q-1)+q22/2l+1+q32/2(q-1) [22].
GameGM2 and game GM1 are perfectly indistinguishable unless the abovementioned rule causes the game abort. Hence,(51)Pr⁡Succ2-Pr⁡Succ1≤q122q-1+q222l+1+q322q-1,
Game
G
M
3. The game GM3 is defined by aborting the executions in which the adversary has obtained a valid authenticator without asking the corresponding hash query by guessing Y, MU1, MS4, MS3, HV2, or HU. The following rules are used.
Rule
S
1
(
3
): HV1′←H3(IDV‖IDDU‖X‖MU2V1). We check the equation eP,Y=e(PV,X+HV1′·PS). If it does not hold, S terminates without accepting; else we verify whether {IDDU,∗,∗,∗, IDV,∗,Y,∗, ∗,∗,∗,∗, ∗,∗,∗,∗, (∗,∗)}∈LS or (3,IDV‖IDDU‖X‖MU2V1,HV1)∈LA. If the two tests fail, S rejects the authenticator and terminates without accepting; otherwise, S accepts and continues.
Rule
S
2
(
3
): KU←H2(sH1(IDDU)), rU1′←DKU(EKU′rU1), PWDU′←DrU1′(ErU1(PWDU)), QU←H2(sH1(PWDU′)). We check the equation H2KU⊕QU⊕rU1′=MU1. If it does not hold, S terminates without accepting; else we verify whether (2,KU⊕QU⊕rU1′,MU1)∈LA or {IDDU,∗,∗,MU1, IDV,∗,∗,∗, ∗,∗,∗,∗, ∗,∗,∗,∗, (∗,∗)}∈LS. If the two tests fail, S rejects the authenticator and terminates without accepting; Otherwise, S accepts and continues.
SendClient, SendDevice, SendServer Queries.(i)
For a querySendClient(Ui, Start), we proceed as follows:
(a)
RuleU1(1): rU1←{0,1}l, MU1←H2(KU′⊕QU′⊕rU1), IDDU←H2(IDU⊕rU) and MU2V1={IDDU,EKU′rU1,ErU1PWDU,MU1} is returned. Then, instance Ui proceeds to an expecting state.(ii)
For a querySendClient(Ui, MV2U), we proceed as follows if instance Ui is in an expecting state:
(a)
RuleU2(1): We check whether H2rU1⊕KU′⊕MS2=MS3. If the equation does not hold, instance Ui terminates without accepting. Otherwise, instance Ui accepts and applies the following rule.(b)
RuleU3(1): rS1′′←MS2⊕H2(rU1‖KU′), and we check whether H2RVxRVyrS1′′=HV2. If the equation does not hold, instance Ui terminates without accepting. Otherwise, instance Ui accepts and applies the following rule.(c)
RuleU4(1): rU2←Zq∗, RU←rU2·P,HU←H2(RUx‖RUy‖rS1′′), and instance Ui accepts and applies the following rule.(d)
RuleU5(1): RUV←rU2·RV, kUV←H2(RU‖RV‖RUV), and MU2V2={RU,HU} is returned. Then, instance Ui terminates and record {(IDDU,EKU′rU1,ErU1PWDU,MU1), IDV,X,Y,MU2V1,MS1,MS2,MS3,MS4, (RV,HV2,MS2,MS3),(RU,HU)} is added to list LS.(iii)
For a querySendDevice(Vj, MU2V1), we proceed as follows:
(a)
RuleV1(1): rV1←Zq∗, X←rV1·P, HV1←H3(IDV‖IDDU‖X‖MU2V1), Y←rV1·PV+HV1·SV, and MV2S={IDV,X,Y,MU2V1} is returned. Then, instance Vj proceeds to an expecting state.(iv)
For a querySendDevice(Vj, MS2V), we proceed as follows if instance Vj is in an expecting state:
(a)
RuleV2(1): kSV′←rV1·PS=(kSVx′,kSVy′), and we check whether MS4=H2(kSVx′‖kSVy′‖SVx‖SVy‖MS1‖MS3). If the equation does not hold, instance Vj terminates without accepting. Otherwise, instance Vj accepts and applies the following rule.(b)
RuleV3(1): rV2←Zq∗, rS1′←MS1⊕kSVx′⊕kSVy′, RV←rV2·P, HV2←H2(RVxRVyrS1′), and MV2U={RV,HV2,MS2,MS3} is returned. Then, instance Vj proceeds to an expecting state.(v)
For a querySendDevice(Vj,MU2V2), we proceed as follows if instance Vj is in an expecting state:
(a)
RuleV4(1): We check whether H2RUxRUyrS1′=HU. If the equation does not hold, instance Vj terminates without accepting. Otherwise, instance Vj accepts and applies the following rule.(b)
RuleV5(1): RUV′←rV2·RU, kUV′←H2(RU‖RV‖RUV′), and instance Vj terminates.(vi)
For a querySendServer(S,MV2S), we proceed as follows:
(a)
RuleS1(1):HV1′←H3(IDV‖IDDU‖X‖MU2V1), and we check whether eP,Y=e(PV,X+HV1′·PS). If the equation does not hold, instance S terminates without accepting. Otherwise, instance S accepts and applies the following rule.(b)
RuleS2(1):KU←H2(sH1(IDDU)), rU1′←DKU(EKU′rU1), PWDU′←DrU1′(ErU1(PWDU)), QU←H2(sH1(PWDU′)) and we check whether H2KU⊕QU⊕rU1′=MU1. If the equation does not hold, instance S terminates without accepting. Otherwise, instance S accepts and applies the following rule.(c)
RuleS3(1): rS1←{0,1}l, kSV←s·X, SV←s·H1(IDV), MS1←kSVx⊕kSVy⊕rS1, MS2←H2(rU1′‖KU)⊕rS1, MS3←H2(rU1′⊕KU⊕MS2), MS4←H2(kSVx‖kSVy‖SVx‖SVy‖MS1‖MS3), and MS2V={MS1,MS2,MS3,MS4} is returned. Then, instance S terminates.
Rule
V
2
(
3
): kSV′←rV1·PS=(kSVx′,kSVy′). We check the equation MS4=H2(kSVx′‖kSVy′‖SVx‖SVy‖MS1‖MS3). If it does not hold, Vj terminates without accepting; else we verify whether (2, kSVx′‖kSVy′‖SVx‖SVy‖MS1‖MS3, MS4)∈LA or {IDDU,∗,∗,∗, IDV,∗,∗,∗, ∗,∗,∗,MS4, ∗,∗,∗,∗, (∗,∗)}∈LS. If the two tests fail, Vj rejects the authenticator and terminates without accepting; otherwise, Vj accepts and continues.
Rule
U
2
(
3
). We check the equation H2rU1⊕KU′⊕MS2=MS3. If it does not hold, Ui terminates without accepting; else we verify whether {IDDU,∗,∗,∗,IDV,∗,∗,∗,∗,∗,MS3,∗,∗,∗,MS2,∗, (∗,∗)}∈LS or (2,rU1⊕KU′⊕MS2,MS3)∈LA. If the two tests fail, Ui rejects the authenticator and terminates without accepting; otherwise, Ui accepts and continues.
Rule
U
3
(
3
): rS1′′←MS2⊕H2(rU1‖KU′). We check the equation H2RVxRVyrS1′′=HV2. If it does not hold, Ui terminates without accepting; else we verify whether {IDDU,∗,∗,∗,IDV,∗,∗,∗,∗,∗,∗,∗,∗,HV2,∗,∗,(∗,∗)}∈LS or (2,RVx‖RVy‖rS1′′,HV2)∈LA. If the two tests fail, Ui rejects the authenticator and terminates without accepting; otherwise, Ui accepts and continues.
Rule
V
4
(
3
). We check the equation H2RUxRUyrS1′=HU. If it does not hold, Vj terminates without accepting; else we verify whether {IDDU,∗,∗,∗,IDV,∗,∗,∗,∗,∗,∗,∗,∗,∗,∗,∗,(∗,HU)}∈LS or (2,RUx‖RUy‖rS1′,HU)∈LA. If the two tests fail, Vj rejects the authenticator and terminates without accepting; otherwise, instance Vj accepts and continues.
GameGM3 and Game GM2 are almost indistinguishable only if the rules mentioned above cause the instance to reject a valid authenticator. Because the adversary deduces the authenticator without issuing the corresponding hash queries, the probability of guessing is at most qss/2(q-1)+qss/2l+qsv/2l+qsc/2l+qsc/2l+qsv/2l. Hence,(52)Pr⁡Succ3-Pr⁡Succ2≤qss+2qsc+2qsv2l+qss2q-1.
Game
G
M
4. We define game GM4 by aborting the executions in which the adversary may have obtained valid authenticator Y, MU1, MS4, MS3, HV2, or HU by guessing the corresponding secret messages and querying the corresponding hash function. We use the following rules.
Rule
S
1
(
4
): HV1′←H3(IDV‖IDDU‖X‖MU2V1). We check the equation eP,Y=e(PV,X+HV1′·PS). If it does not hold, S terminates without accepting; else we confirm whether {IDDU,∗,∗,∗,IDV,∗,Y,∗,∗,∗,∗,∗,∗,∗,∗,∗, (∗,∗)}∈LS. If the test fails, S rejects the authenticator and terminates without accepting; otherwise, we check whether (3,IDV‖IDDU‖X‖MU2V1,HV1)∈LA. If this is the case, we abort the game.
Rule
S
2
(
4
): KU←H2(sH1(IDDU)), rU1′←DKU(EKU′rU1), PWDU′←DrU1′(ErU1(PWDU)), QU←H2(sH1(PWDU′)). We check the equation H2KU⊕QU⊕rU1′=MU1. If it does not hold, S terminates without accepting; else we confirm whether {IDDU,∗,∗,MU1,IDV,∗,∗,∗,∗,∗,∗,∗,∗,∗,∗,∗,(∗,∗)}∈LS. If the test fails, S rejects the authenticator and terminates without accepting; otherwise, we check whether (2,KU⊕QU⊕rU1′,MU1)∈LA. If this is the case, we abort the game.
Rule
V
2
(
4
): kSV′←rV1·PS=(kSVx′,kSVy′). We check the equation MS4=H2(kSVx′‖kSVy′‖SVx‖SVy‖MS1‖MS3). If it does not hold, Vj terminates without accepting; else we confirm whether {IDDU,∗,∗,∗,IDV,∗,∗,∗,∗,∗,∗,MS4,∗,∗,∗,∗, (∗,∗)}∈LS. If the test fails, Vj rejects the authenticator and terminates without accepting; otherwise, we check whether(2,kSVx′‖kSVy′‖SVx‖SVy‖MS1‖MS3,MS4)∈LA. If this is the case, we abort the game.
Rule
U
2
(
4
). We check the equation H2rU1⊕KU′⊕MS2=MS3. If it does not hold, Ui terminates without accepting; else we confirm whether {IDDU,∗,∗,∗,IDV,∗,∗,∗,∗,∗,MS3,∗,∗,∗,MS2,∗,(∗,∗)}∈LS. If the test fails, Ui rejects the authenticator and terminates without accepting; otherwise, we check whether (2,rU1⊕KU′⊕MS2,MS3)∈LA. If this is the case, we abort the game.
Rule
U
3
(
4
): rS1′′←MS2⊕H2(rU1‖KU′). We check the equation H2RVxRVyrS1′′=HV2. If it does not hold, Ui terminates without accepting; else we confirm whether {IDDU,∗,∗,∗,IDV,∗,∗,∗,∗,∗,∗,∗,∗,HV2,∗,∗, (∗,∗)}∈LS. If the test fails, Ui rejects the authenticator and terminates without accepting; otherwise, we check whether (2,RVx‖RVy‖rS1′′,HV2)∈LA. If this is the case, we abort the game.
Rule
V
4
(
3
). We check the equation H2(RUx‖RUy‖rS1′)≟HU. If it does not hold, Vj terminates without accepting; else we confirm whether {IDDU,∗,∗,∗,IDV,∗,∗,∗, ∗,∗,∗,∗,∗,∗,∗,∗,(∗,HU)}∈LS. If the test fails, Vj rejects the authenticator and terminates without accepting; otherwise, we check whether (2,RUx‖RUy‖rS1′,HU)∈LA. If this is the case, we abort the game.
GamesGM4 and GM3 are almost indistinguishable only if the rules mentioned above cause the game to abort. Because the secret messages corresponding to valid authenticators MU1, Y, MS4, MS2, HV2, and HU are deduced by the adversary, the probability of guessing is at most q3+q2+q2+q2+q2+q2/q-1. Hence,(53)|Pr⁡Succ4-Pr⁡Succ3|≤5q2+q3q-1.
Game
G
M
5. Here we simulate a private hash function H4·:0,1∗↦0,1l and take place of random oracle H2(·) with H4(·). Then, we do not use the RUV or RUV′ to generate session key kUV or kUV′. As the result, the session key is completely independent of H2(·) and either RUV or RUV′.
Rule
U
5
(
5
): RUV←rU2·RV, kUV←H2(RU‖RV), and MU2V2={RU,HU} is returned. Then, instance Ui terminates and record {IDDU,EKU′rU1,ErU1PWDU,MU1,IDV,X,Y,MU2V1,MS1,MS2,MS3,MS4, RV,HV2,MS1,MS2,(RU,HU)} is added to list LS.
Rule
V
5
(
5
): RUV′←rV2·RU, kUV′←H2(RU‖RV), and instance Vj terminates.
GamesGM5 and GM4 are almost indistinguishable only if the following event AskH5occurs: A queries the hash function H2(·) on (RU‖RV‖RUV) or on (RU‖RV‖RUV′). Because the H4(·) is a private oracle, the probability that A correctly guesses the value of b is 1/2. Hence,(54)Pr⁡Succ5-Pr⁡Succ4≤Pr⁡AskH5,Pr⁡Succ5=12.
Game
G
M
6. In this game, the random self-reducibility of the CDH problem is used to simulate the executions. Given a CDH instance (A,B), where A,B∈G1, the next rules are listed.
Rule
V
3
(
6
): a←Zq∗, rS1′←MS1⊕kSVx′⊕kSVy′, RV←a·A, HV2←H2(RVx‖RVy‖rS1′). The message MV2U=RV,HV2,MS2,MS3 is returned. Then, instance Vj proceeds to an expecting state.
Rule
U
4
(
6
): b←Zq∗, RU←b·B,HU←H2(RUx‖RUy‖rS1′′). Instance Ui accepts and proceeds.
By the definition of event AskH5, event AskH6 means that the adversary has issued a query to random oracle on (RU‖RV‖CDH(RU,RV)). The number of records, such as (2,∗,∗) in the list LA, is q2, and the probability of obtaining the CDH(RU,RV) value from list LA is 1/q2. Hence, the accumulated probability is (1/q2)×Pr⁡[AskH6]. Besides, the CDH problem is random characteristics of the self-reducibility, and the equation CDHRU,RV=CDH(A,B)ab holds. Thus,(55)Pr⁡AskH5=Pr⁡AskH6,Pr⁡AskH6=q2SuccP,G1CDHt′.Finally, we summarize all the relationships and complete the proof.From (50) to (53), we could derive(56)Pr⁡Succ0-Pr⁡Succ4≤q12+q32+qss+10q2+2q32q-1+q22+2qss+4qsc+4qsv2l+1.From (54) to (55), we obtain(57)Pr⁡Succ4-12≤q2SuccP,G1CDHt′.From (56) and (57), we have(58)Pr⁡Succ0-12≤q12+q32+qss+10q2+2q32q-1+q22+2qss+4qsc+4qsv2l+1+q2SuccP,G1CDHt′.From (49) and (58), we obtain (48) and the Theorem 1.


## 6.1. Security Model

In 2005, Abdalla et al. proposed a security model AFP05, which is suitable for the three-party authenticated key agreement scenario. It contains two types of participants, such as the client and the trusted server [18]. But there are three types of participants in our proposed protocol, a user, a trusted device, and a trusted server. So we add a querySendDevice in our security model. During the execution of the protocol, U and V have many instances, respectively. Ui and Vj denote the ith instance of U and the jth instance of V. There exists one state of accept, reject, and ⊥ in an oracle. If the oracle gets correct message, it turns the accept state; otherwise, it turns reject. ⊥ means that no decision has been reached or no result has been returned. The adversary A, which is abstracted as a probabilistic polynomial time Turing Machine, interacts with other participants through a bounded number of queries which model the capabilities of the adversary in an actual attack. The queries are listed as follows.SendClient
(
U
i
,
m
). After receiving message m sent by the adversary, the Ui generates a message and outputs as the result of this query. A querySendClient(Ui,Start) begins a new key agreement process.SendDevice
(
V
j
,
m
). After receiving message m sent by the adversary, the Vj generates a message and output.SendServer
(
S
,
m
). After receiving message m sent by the adversary, the S generates a message and output.Reveal
(
U
i
/
V
j
). If no session key is defined for instance Ui/Vj or if either Ui/Vj or its partner is asked aTest query, the result of this query is the invalid symbol ⊥. Otherwise the session key generated by the instance Ui/Vj is returned.Test
(
U
i
/
V
j
). If no session key is defined for instance Ui/Vj or if either Ui/Vj or its partner is asked aReveal query, the result of this query is the invalid symbol ⊥. Otherwise, the oracle flips a coin b. If b=1, the session key is output. Otherwise, a value randomly chosen from the distribution space of session key is output.The queries defined in our improved AFP05 security model can be simulated using theSendClient,SendDevice, andSendServer queries repeatedly if we assume that there is at least one benign adversary which faithfully relays message flows. In our improved AFP05 security model, the notion of freshness is already embedded in the definition of the oracles. A Find-Then-Guess (FTG) model exists in our improved AFP05 security model, in which the semantic security is defined by a game with two phases. In the first phase, the adversary is able to adaptively executeSendClient,SendDevice,SendServer,Reveal, andTest query. In the second, A executes a singleTest query and guesses a bit b′ for b, where b is selected in theTest query. If b′=b, the adversary wins the game. Let Succ denote the event that the adversary correctly guesses the bit b, and the advantage of A that attacks the protocol S is defined as (45)AdvSFTG-3PAKAA=2Pr⁡Succ-1.A 3PAKA protocolS is considered semantically secure in FTG model if and only if AdvSFTG-3PAKAt,Q=maxA{AdvSFTG-3PAKA(A)} is negligible, where the maximum time executed by all the adversaries with time-complexity at most t and the number of queries at most Q.


## 6.2. Mathematical Computational Problems [10]

Letp, r be two large prime numbers and r∣(p-1). Let G be a multiplicative subgroup of Zp∗, with prime number r order and element g0 generator.Computational Diffie-Hellman Problem (CDH). Given {g0,g0a,g0b∈G} and a,b∈RZr∗, it is hard to compute gab mod p.The probabilistic polynomial time Turing Machine denoted asΔ, the probability of which could successfully solve CDH problem in G, is defined as(46)SuccGCDHΔ=Pr⁡Δga,gb=gabmodp:a,b∈RZr∗.CDH Assumption. For any probabilistic Turing Machine Δ, the probability of SuccGCDHΔ is negligible.Elliptic Curve Computational Diffie-Hellman (ECCDH) Assumption. Let G1 be an additive point group with an elliptic curve by the generator P and aP and bP are elements of G1. A is able to compute the value of abP only with aP and bP in time t at most(47)SuccG1ECCDHΔ,t=Pr⁡ΔaP,bP=abP:a,b∈RZq∗.The factSuccG1ECCDH(Δ,t) is negligible means that the ECCDH assumption holds.


## 6.3. Security Proof

Theorem 1.
The hash functionsH1(·), H2(·), and H3(·) are modeled as random oracles. Let A be an adversary against our protocol S within time t. We denote that q1, q2, and q3, respectively, represent the number of H1(·), H2(·), and H3(·) oracle queries executed by A, and qsc,qsv, and qss denote the number ofSendClient queries,SendDevice queries, andSendServer queries. Then,(48)AdvSFTG-DRMt,Q≤q12+q32+qss+10q2+2q3q-1+q22+2qss+4qsc+4qsv2l+2q2SuccP,G1CDHt′,where Q={q1,q2,q3,qsc,qsv,qss} and t′≤t+(qsc+qsv+qss)Ts, with Ts denoting the computational time of one scalar multiplication in G1.Proof.
We define several attack games from GameGM0 to Game GM6. For each game GMi, Succi denotes the event that A has successfully guessed the bit b in the test session. The games are listed as follows.
Hash, Reveal, Test Queries.(i)
For a hash queryHi,∗,h, i∈{1,2,3}, we proceed as follows:
(a)
RuleH(1): If a record i,∗,h exists on list Lh, h is returned. Otherwise, h←G1(i=1)/0,1l(i=2)/Zq∗(i=3) and h is returned. Record i,∗,h is added to list Lh. If the adversary directly issues this query, the record i,∗,h is added to list LA.(ii)
For a queryReveal(Ui/Vj), we proceed as follows:
(a)
If no session key is defined for instanceUi/Vj or if either Ui/Vj or its partner is asked aTest query, the output is ⊥. Otherwise the output of this query is kUV which is defined for the instance Ui/Vj.(iii)
For a query Test(Ui/Vj), we proceed as follows:
(a)
If no session key is defined for instanceUi/Vj or if either Ui/Vj or its partner is asked aReveal query, the output is ⊥. Otherwise, the oracle flips a bit b. If b=1, the session key is output. Otherwise, a value randomly chosen from the distribution space of session key is output.
Game
G
M
0. This is the actual attack game. According to the definition, we have (49)AdvPFTG-DRMA=2Pr⁡Succ0-1.Otherwise, we randomly generate a bit b′ if the game aborts or stops without answer from A or A has not finished the game.
Game
G
M
1
. We simulate all the oracles for each query and keep three lists to store the oracles answers. Lh stores answers of random oracles H1(·), H2(·), and H3·. LA is denoted for random oracle query asked by A. LS is for the transcripts in the channel. We simulate theSendClient,SendDevice,SendServer,Reveal, andTest queries as in the actual attack. We list hash,Reveal,Test queries inHash, Reveal, Test Queries andSendClient,SendDevice,SendServer queries inSendClient,SendDevice,SendServer Queries. Obviously, game GM0 and game GM1 are indistinguishable. So we have(50)Pr⁡Succ1=Pr⁡Succ0.
Game
G
M
2
. In this game, all the oracles simulated are almost the same as in the game GM1, but here, we avoid some collisions in the transcripts. The hash oracles H1(·), H2(·), and H3(·) may collide with different input values. We use the following rule.
Rule
H
(
2
). If this query is directly issued by the adversary, and i,∗,hi∈{1,2,3}∈LA, the game abort; Otherwise, h is returned.
Given that hash valueh is selected from a random uniform distribution, the probability of collisions is at most q12/2(q-1)+q22/2l+1+q32/2(q-1) [22].
GameGM2 and game GM1 are perfectly indistinguishable unless the abovementioned rule causes the game abort. Hence,(51)Pr⁡Succ2-Pr⁡Succ1≤q122q-1+q222l+1+q322q-1,
Game
G
M
3. The game GM3 is defined by aborting the executions in which the adversary has obtained a valid authenticator without asking the corresponding hash query by guessing Y, MU1, MS4, MS3, HV2, or HU. The following rules are used.
Rule
S
1
(
3
): HV1′←H3(IDV‖IDDU‖X‖MU2V1). We check the equation eP,Y=e(PV,X+HV1′·PS). If it does not hold, S terminates without accepting; else we verify whether {IDDU,∗,∗,∗, IDV,∗,Y,∗, ∗,∗,∗,∗, ∗,∗,∗,∗, (∗,∗)}∈LS or (3,IDV‖IDDU‖X‖MU2V1,HV1)∈LA. If the two tests fail, S rejects the authenticator and terminates without accepting; otherwise, S accepts and continues.
Rule
S
2
(
3
): KU←H2(sH1(IDDU)), rU1′←DKU(EKU′rU1), PWDU′←DrU1′(ErU1(PWDU)), QU←H2(sH1(PWDU′)). We check the equation H2KU⊕QU⊕rU1′=MU1. If it does not hold, S terminates without accepting; else we verify whether (2,KU⊕QU⊕rU1′,MU1)∈LA or {IDDU,∗,∗,MU1, IDV,∗,∗,∗, ∗,∗,∗,∗, ∗,∗,∗,∗, (∗,∗)}∈LS. If the two tests fail, S rejects the authenticator and terminates without accepting; Otherwise, S accepts and continues.
SendClient, SendDevice, SendServer Queries.(i)
For a querySendClient(Ui, Start), we proceed as follows:
(a)
RuleU1(1): rU1←{0,1}l, MU1←H2(KU′⊕QU′⊕rU1), IDDU←H2(IDU⊕rU) and MU2V1={IDDU,EKU′rU1,ErU1PWDU,MU1} is returned. Then, instance Ui proceeds to an expecting state.(ii)
For a querySendClient(Ui, MV2U), we proceed as follows if instance Ui is in an expecting state:
(a)
RuleU2(1): We check whether H2rU1⊕KU′⊕MS2=MS3. If the equation does not hold, instance Ui terminates without accepting. Otherwise, instance Ui accepts and applies the following rule.(b)
RuleU3(1): rS1′′←MS2⊕H2(rU1‖KU′), and we check whether H2RVxRVyrS1′′=HV2. If the equation does not hold, instance Ui terminates without accepting. Otherwise, instance Ui accepts and applies the following rule.(c)
RuleU4(1): rU2←Zq∗, RU←rU2·P,HU←H2(RUx‖RUy‖rS1′′), and instance Ui accepts and applies the following rule.(d)
RuleU5(1): RUV←rU2·RV, kUV←H2(RU‖RV‖RUV), and MU2V2={RU,HU} is returned. Then, instance Ui terminates and record {(IDDU,EKU′rU1,ErU1PWDU,MU1), IDV,X,Y,MU2V1,MS1,MS2,MS3,MS4, (RV,HV2,MS2,MS3),(RU,HU)} is added to list LS.(iii)
For a querySendDevice(Vj, MU2V1), we proceed as follows:
(a)
RuleV1(1): rV1←Zq∗, X←rV1·P, HV1←H3(IDV‖IDDU‖X‖MU2V1), Y←rV1·PV+HV1·SV, and MV2S={IDV,X,Y,MU2V1} is returned. Then, instance Vj proceeds to an expecting state.(iv)
For a querySendDevice(Vj, MS2V), we proceed as follows if instance Vj is in an expecting state:
(a)
RuleV2(1): kSV′←rV1·PS=(kSVx′,kSVy′), and we check whether MS4=H2(kSVx′‖kSVy′‖SVx‖SVy‖MS1‖MS3). If the equation does not hold, instance Vj terminates without accepting. Otherwise, instance Vj accepts and applies the following rule.(b)
RuleV3(1): rV2←Zq∗, rS1′←MS1⊕kSVx′⊕kSVy′, RV←rV2·P, HV2←H2(RVxRVyrS1′), and MV2U={RV,HV2,MS2,MS3} is returned. Then, instance Vj proceeds to an expecting state.(v)
For a querySendDevice(Vj,MU2V2), we proceed as follows if instance Vj is in an expecting state:
(a)
RuleV4(1): We check whether H2RUxRUyrS1′=HU. If the equation does not hold, instance Vj terminates without accepting. Otherwise, instance Vj accepts and applies the following rule.(b)
RuleV5(1): RUV′←rV2·RU, kUV′←H2(RU‖RV‖RUV′), and instance Vj terminates.(vi)
For a querySendServer(S,MV2S), we proceed as follows:
(a)
RuleS1(1):HV1′←H3(IDV‖IDDU‖X‖MU2V1), and we check whether eP,Y=e(PV,X+HV1′·PS). If the equation does not hold, instance S terminates without accepting. Otherwise, instance S accepts and applies the following rule.(b)
RuleS2(1):KU←H2(sH1(IDDU)), rU1′←DKU(EKU′rU1), PWDU′←DrU1′(ErU1(PWDU)), QU←H2(sH1(PWDU′)) and we check whether H2KU⊕QU⊕rU1′=MU1. If the equation does not hold, instance S terminates without accepting. Otherwise, instance S accepts and applies the following rule.(c)
RuleS3(1): rS1←{0,1}l, kSV←s·X, SV←s·H1(IDV), MS1←kSVx⊕kSVy⊕rS1, MS2←H2(rU1′‖KU)⊕rS1, MS3←H2(rU1′⊕KU⊕MS2), MS4←H2(kSVx‖kSVy‖SVx‖SVy‖MS1‖MS3), and MS2V={MS1,MS2,MS3,MS4} is returned. Then, instance S terminates.
Rule
V
2
(
3
): kSV′←rV1·PS=(kSVx′,kSVy′). We check the equation MS4=H2(kSVx′‖kSVy′‖SVx‖SVy‖MS1‖MS3). If it does not hold, Vj terminates without accepting; else we verify whether (2, kSVx′‖kSVy′‖SVx‖SVy‖MS1‖MS3, MS4)∈LA or {IDDU,∗,∗,∗, IDV,∗,∗,∗, ∗,∗,∗,MS4, ∗,∗,∗,∗, (∗,∗)}∈LS. If the two tests fail, Vj rejects the authenticator and terminates without accepting; otherwise, Vj accepts and continues.
Rule
U
2
(
3
). We check the equation H2rU1⊕KU′⊕MS2=MS3. If it does not hold, Ui terminates without accepting; else we verify whether {IDDU,∗,∗,∗,IDV,∗,∗,∗,∗,∗,MS3,∗,∗,∗,MS2,∗, (∗,∗)}∈LS or (2,rU1⊕KU′⊕MS2,MS3)∈LA. If the two tests fail, Ui rejects the authenticator and terminates without accepting; otherwise, Ui accepts and continues.
Rule
U
3
(
3
): rS1′′←MS2⊕H2(rU1‖KU′). We check the equation H2RVxRVyrS1′′=HV2. If it does not hold, Ui terminates without accepting; else we verify whether {IDDU,∗,∗,∗,IDV,∗,∗,∗,∗,∗,∗,∗,∗,HV2,∗,∗,(∗,∗)}∈LS or (2,RVx‖RVy‖rS1′′,HV2)∈LA. If the two tests fail, Ui rejects the authenticator and terminates without accepting; otherwise, Ui accepts and continues.
Rule
V
4
(
3
). We check the equation H2RUxRUyrS1′=HU. If it does not hold, Vj terminates without accepting; else we verify whether {IDDU,∗,∗,∗,IDV,∗,∗,∗,∗,∗,∗,∗,∗,∗,∗,∗,(∗,HU)}∈LS or (2,RUx‖RUy‖rS1′,HU)∈LA. If the two tests fail, Vj rejects the authenticator and terminates without accepting; otherwise, instance Vj accepts and continues.
GameGM3 and Game GM2 are almost indistinguishable only if the rules mentioned above cause the instance to reject a valid authenticator. Because the adversary deduces the authenticator without issuing the corresponding hash queries, the probability of guessing is at most qss/2(q-1)+qss/2l+qsv/2l+qsc/2l+qsc/2l+qsv/2l. Hence,(52)Pr⁡Succ3-Pr⁡Succ2≤qss+2qsc+2qsv2l+qss2q-1.
Game
G
M
4. We define game GM4 by aborting the executions in which the adversary may have obtained valid authenticator Y, MU1, MS4, MS3, HV2, or HU by guessing the corresponding secret messages and querying the corresponding hash function. We use the following rules.
Rule
S
1
(
4
): HV1′←H3(IDV‖IDDU‖X‖MU2V1). We check the equation eP,Y=e(PV,X+HV1′·PS). If it does not hold, S terminates without accepting; else we confirm whether {IDDU,∗,∗,∗,IDV,∗,Y,∗,∗,∗,∗,∗,∗,∗,∗,∗, (∗,∗)}∈LS. If the test fails, S rejects the authenticator and terminates without accepting; otherwise, we check whether (3,IDV‖IDDU‖X‖MU2V1,HV1)∈LA. If this is the case, we abort the game.
Rule
S
2
(
4
): KU←H2(sH1(IDDU)), rU1′←DKU(EKU′rU1), PWDU′←DrU1′(ErU1(PWDU)), QU←H2(sH1(PWDU′)). We check the equation H2KU⊕QU⊕rU1′=MU1. If it does not hold, S terminates without accepting; else we confirm whether {IDDU,∗,∗,MU1,IDV,∗,∗,∗,∗,∗,∗,∗,∗,∗,∗,∗,(∗,∗)}∈LS. If the test fails, S rejects the authenticator and terminates without accepting; otherwise, we check whether (2,KU⊕QU⊕rU1′,MU1)∈LA. If this is the case, we abort the game.
Rule
V
2
(
4
): kSV′←rV1·PS=(kSVx′,kSVy′). We check the equation MS4=H2(kSVx′‖kSVy′‖SVx‖SVy‖MS1‖MS3). If it does not hold, Vj terminates without accepting; else we confirm whether {IDDU,∗,∗,∗,IDV,∗,∗,∗,∗,∗,∗,MS4,∗,∗,∗,∗, (∗,∗)}∈LS. If the test fails, Vj rejects the authenticator and terminates without accepting; otherwise, we check whether(2,kSVx′‖kSVy′‖SVx‖SVy‖MS1‖MS3,MS4)∈LA. If this is the case, we abort the game.
Rule
U
2
(
4
). We check the equation H2rU1⊕KU′⊕MS2=MS3. If it does not hold, Ui terminates without accepting; else we confirm whether {IDDU,∗,∗,∗,IDV,∗,∗,∗,∗,∗,MS3,∗,∗,∗,MS2,∗,(∗,∗)}∈LS. If the test fails, Ui rejects the authenticator and terminates without accepting; otherwise, we check whether (2,rU1⊕KU′⊕MS2,MS3)∈LA. If this is the case, we abort the game.
Rule
U
3
(
4
): rS1′′←MS2⊕H2(rU1‖KU′). We check the equation H2RVxRVyrS1′′=HV2. If it does not hold, Ui terminates without accepting; else we confirm whether {IDDU,∗,∗,∗,IDV,∗,∗,∗,∗,∗,∗,∗,∗,HV2,∗,∗, (∗,∗)}∈LS. If the test fails, Ui rejects the authenticator and terminates without accepting; otherwise, we check whether (2,RVx‖RVy‖rS1′′,HV2)∈LA. If this is the case, we abort the game.
Rule
V
4
(
3
). We check the equation H2(RUx‖RUy‖rS1′)≟HU. If it does not hold, Vj terminates without accepting; else we confirm whether {IDDU,∗,∗,∗,IDV,∗,∗,∗, ∗,∗,∗,∗,∗,∗,∗,∗,(∗,HU)}∈LS. If the test fails, Vj rejects the authenticator and terminates without accepting; otherwise, we check whether (2,RUx‖RUy‖rS1′,HU)∈LA. If this is the case, we abort the game.
GamesGM4 and GM3 are almost indistinguishable only if the rules mentioned above cause the game to abort. Because the secret messages corresponding to valid authenticators MU1, Y, MS4, MS2, HV2, and HU are deduced by the adversary, the probability of guessing is at most q3+q2+q2+q2+q2+q2/q-1. Hence,(53)|Pr⁡Succ4-Pr⁡Succ3|≤5q2+q3q-1.
Game
G
M
5. Here we simulate a private hash function H4·:0,1∗↦0,1l and take place of random oracle H2(·) with H4(·). Then, we do not use the RUV or RUV′ to generate session key kUV or kUV′. As the result, the session key is completely independent of H2(·) and either RUV or RUV′.
Rule
U
5
(
5
): RUV←rU2·RV, kUV←H2(RU‖RV), and MU2V2={RU,HU} is returned. Then, instance Ui terminates and record {IDDU,EKU′rU1,ErU1PWDU,MU1,IDV,X,Y,MU2V1,MS1,MS2,MS3,MS4, RV,HV2,MS1,MS2,(RU,HU)} is added to list LS.
Rule
V
5
(
5
): RUV′←rV2·RU, kUV′←H2(RU‖RV), and instance Vj terminates.
GamesGM5 and GM4 are almost indistinguishable only if the following event AskH5occurs: A queries the hash function H2(·) on (RU‖RV‖RUV) or on (RU‖RV‖RUV′). Because the H4(·) is a private oracle, the probability that A correctly guesses the value of b is 1/2. Hence,(54)Pr⁡Succ5-Pr⁡Succ4≤Pr⁡AskH5,Pr⁡Succ5=12.
Game
G
M
6. In this game, the random self-reducibility of the CDH problem is used to simulate the executions. Given a CDH instance (A,B), where A,B∈G1, the next rules are listed.
Rule
V
3
(
6
): a←Zq∗, rS1′←MS1⊕kSVx′⊕kSVy′, RV←a·A, HV2←H2(RVx‖RVy‖rS1′). The message MV2U=RV,HV2,MS2,MS3 is returned. Then, instance Vj proceeds to an expecting state.
Rule
U
4
(
6
): b←Zq∗, RU←b·B,HU←H2(RUx‖RUy‖rS1′′). Instance Ui accepts and proceeds.
By the definition of event AskH5, event AskH6 means that the adversary has issued a query to random oracle on (RU‖RV‖CDH(RU,RV)). The number of records, such as (2,∗,∗) in the list LA, is q2, and the probability of obtaining the CDH(RU,RV) value from list LA is 1/q2. Hence, the accumulated probability is (1/q2)×Pr⁡[AskH6]. Besides, the CDH problem is random characteristics of the self-reducibility, and the equation CDHRU,RV=CDH(A,B)ab holds. Thus,(55)Pr⁡AskH5=Pr⁡AskH6,Pr⁡AskH6=q2SuccP,G1CDHt′.Finally, we summarize all the relationships and complete the proof.From (50) to (53), we could derive(56)Pr⁡Succ0-Pr⁡Succ4≤q12+q32+qss+10q2+2q32q-1+q22+2qss+4qsc+4qsv2l+1.From (54) to (55), we obtain(57)Pr⁡Succ4-12≤q2SuccP,G1CDHt′.From (56) and (57), we have(58)Pr⁡Succ0-12≤q12+q32+qss+10q2+2q32q-1+q22+2qss+4qsc+4qsv2l+1+q2SuccP,G1CDHt′.From (49) and (58), we obtain (48) and the Theorem 1.


## 7. Security Analysis of Our Scheme

To get over the problems existing in Yang et al.’s scheme, we proposed a provable secure and efficient authentication scheme using smart card based on elliptic curve cryptography. In this part, we will show that the scheme we proposed is secure against various attacks [23, 24].


### 7.1. Smart Card Loss Attack

The smart card of userU contains {rU,SU,PU,MU,P,H2·,EK(·)/DK(·)}. If the smart card of the user U is stolen by the attacker, he/she could only get the secret data rU, SU, PU, and MU from it; other data in the smart card is public to all clients. However, he/she does not know the identity IDU or the password PWU of U. As a result, he/she cannot use the secret data rU, SU, PU, and MU to impersonate the user U to pass the authentication of the server and the device. As the result, our scheme can resist the smart card loss attack.


### 7.2. Denial of Service Attack

In some schemes [10, 25–27], both of the server and user need to update some shared data in their smart card or verifier table after the key agreement phase or the authentication phase. The attacker can eavesdrop, intercept, and modify any transmitted messages on the public channel. And the behavior of the attacker may cause the difference of the shared data between the user and the server. So, these schemes cannot resist the denial of service attack. In our proposed scheme, the user and the server have not needed to update some data in their smart card or verifier table. Thus, the attacker no longer can perform the denial of service attack.


### 7.3. Efficient Login Phase

To improve the efficiency of our proposed scheme, before the key agreement phase, the smart card checks the correctness of user’s identity and password. In the login phase of our scheme, when the userU inputs his/her identity IDU and password PWU, the smart card checks the correctness of IDU and PWU firstly through the equation PU=H2(SU⊕H2(PWU⊕rU)⊕MU⊕IDU). If it does not hold, the smart card reject U’s request. Otherwise, it authenticates the legality of the user U and turns to the key agreement phase.


### 7.4. Session Key Attack

Firstly, the security of the session key in our scheme is based on the computational Diffie-Hellman problem. Secondly, the session key is generated by the random numbers, which are randomly selected by the user and the device, respectively. At last, before computing a session key, both of them must authenticate each other [28]. Based on the reasons mentioned above, the attacker cannot perform the session key attack.


### 7.5. Insider Attack

Because of without verifier table in this system, the insider cannot acquire any secret data from the server’s system. In addition, the insider cannot obtainKU without the server’s private key. And the adversary has no idea to derive the secret data KU from all messages he/she can achieve. Thus, he/she cannot impersonate a legal user U′ to pass the authentication of the server and the device, or the server S′ to deceive a legal user. Therefore, the proposed scheme is able to withstand the insider attack.


### 7.6. Replay Attack

If theU’s message MU2V1is intercepted and resent to the device by the attacker, the message MV2S is computed and sent to the server by the device. Obviously the user and the device can through the server’s certification, and the server responses the message MS2V to the device. After that, the device can authenticate the server and sends the message MV2U to the attacker. The attacker can acquire nothing from MV2U. So, he/she cannot send a legality message MU2V2 to the device. The device must not establish a session key with the attacker [29]. In the same way, if the attacker replays the device’s message, he/she also cannot pass the user’s authentication.


## 7.1. Smart Card Loss Attack

The smart card of userU contains {rU,SU,PU,MU,P,H2·,EK(·)/DK(·)}. If the smart card of the user U is stolen by the attacker, he/she could only get the secret data rU, SU, PU, and MU from it; other data in the smart card is public to all clients. However, he/she does not know the identity IDU or the password PWU of U. As a result, he/she cannot use the secret data rU, SU, PU, and MU to impersonate the user U to pass the authentication of the server and the device. As the result, our scheme can resist the smart card loss attack.


## 7.2. Denial of Service Attack

In some schemes [10, 25–27], both of the server and user need to update some shared data in their smart card or verifier table after the key agreement phase or the authentication phase. The attacker can eavesdrop, intercept, and modify any transmitted messages on the public channel. And the behavior of the attacker may cause the difference of the shared data between the user and the server. So, these schemes cannot resist the denial of service attack. In our proposed scheme, the user and the server have not needed to update some data in their smart card or verifier table. Thus, the attacker no longer can perform the denial of service attack.


## 7.3. Efficient Login Phase

To improve the efficiency of our proposed scheme, before the key agreement phase, the smart card checks the correctness of user’s identity and password. In the login phase of our scheme, when the userU inputs his/her identity IDU and password PWU, the smart card checks the correctness of IDU and PWU firstly through the equation PU=H2(SU⊕H2(PWU⊕rU)⊕MU⊕IDU). If it does not hold, the smart card reject U’s request. Otherwise, it authenticates the legality of the user U and turns to the key agreement phase.


## 7.4. Session Key Attack

Firstly, the security of the session key in our scheme is based on the computational Diffie-Hellman problem. Secondly, the session key is generated by the random numbers, which are randomly selected by the user and the device, respectively. At last, before computing a session key, both of them must authenticate each other [28]. Based on the reasons mentioned above, the attacker cannot perform the session key attack.


## 7.5. Insider Attack

Because of without verifier table in this system, the insider cannot acquire any secret data from the server’s system. In addition, the insider cannot obtainKU without the server’s private key. And the adversary has no idea to derive the secret data KU from all messages he/she can achieve. Thus, he/she cannot impersonate a legal user U′ to pass the authentication of the server and the device, or the server S′ to deceive a legal user. Therefore, the proposed scheme is able to withstand the insider attack.


## 7.6. Replay Attack

If theU’s message MU2V1is intercepted and resent to the device by the attacker, the message MV2S is computed and sent to the server by the device. Obviously the user and the device can through the server’s certification, and the server responses the message MS2V to the device. After that, the device can authenticate the server and sends the message MV2U to the attacker. The attacker can acquire nothing from MV2U. So, he/she cannot send a legality message MU2V2 to the device. The device must not establish a session key with the attacker [29]. In the same way, if the attacker replays the device’s message, he/she also cannot pass the user’s authentication.


## 8. Performance Comparisons

In this part, our proposed scheme’s performance will be evaluated compared with some other schemes [10, 12]. The comparison is summarized in Table 1. We define seven parameters of time complexity which are adopted in the schemes mentioned above as follows.(i)
TH1: The time complexity of executing a hash function H1·.(ii)
TH2: The time complexity of executing a hash function H2·.(iii)
TH3: The time complexity of executing a hash function H3·.(iv)
TP: The time complexity of executing a pairings operation of point on elliptic curve.(v)
TM: The time complexity of executing a scalar multiplication operation of point on elliptic curve.(vi)
TA: The time complexity of executing an addition operation of point on elliptic curve.(vii)
TS: The time complexity of executing a symmetric key computation.Table 1
Performance comparisons.
Our proposed scheme
Yang et al.’s scheme
Zhang et al.’s scheme
Registration phase
U
2
T
H
2
1
T
H
2
—
S
3
T
H
1
+
3
T
H
2
+
3
T
M
2
T
H
1
+
1
T
H
2
+
2
T
M
2
T
H
1
+
4
T
H
2
+
2
T
M
Login phase and key agreement phase
U
9
T
H
2
+
2
T
M
+
2
T
S
6
T
H
2
+
6
T
S
7
T
H
2
+
7
T
S
V
4
T
H
2
+
1
T
H
3
+
6
T
M
+
1
T
A
2
T
H
2
+
2
T
H
3
+
3
T
P
+
6
T
M
+
2
T
A
+
3
T
S
3
T
H
2
+
2
T
H
3
+
3
T
P
+
6
T
M
+
2
T
A
+
3
T
S
S
3
T
H
1
+
6
T
H
2
+
1
T
H
3
+
1
T
P
+
5
T
M
+
1
T
A
+
2
T
S
1
T
H
1
+
5
T
H
2
+
2
T
H
3
+
2
T
P
+
7
T
M
+
3
T
A
+
5
T
S
5
T
H
2
+
2
T
H
3
+
2
T
P
+
7
T
M
+
3
T
A
+
6
T
S
Password update phase
U
9
T
H
2
+
2
T
S
4
T
H
2
—
S
3
T
H
1
+
7
T
H
2
+
3
T
M
+
2
T
S
1
T
H
1
+
3
T
H
2
4
T
H
2
Total
9
T
H
1
+
40
T
H
2
+
2
T
H
3
+
1
T
P
+
19
T
M
+
2
T
A
+
4
T
S
4
T
H
1
+
22
T
H
2
+
4
T
H
3
+
5
T
P
+
15
T
M
+
5
T
A
+
8
T
S
2
T
H
1
+
23
T
H
2
+
4
T
H
3
+
5
T
P
+
15
T
M
+
5
T
A
+
9
T
SA comparison of our proposed scheme and that of Zhang et al. and Yang et al. is summarized in Table1. It is known to all that one-way hash function is more efficient than the operation of scalar multiplication. Moreover, the pairing operation costs much more than the scalar multiplication operation. The effort of evaluating one pairing operation is approximately three times the effort of evaluating one scalar multiplication operation. Therefore our proposed scheme performs better than Zhang et al.’s scheme and Yang et al.’s scheme. Consequently, our proposed scheme is much more suitable for practical applications.


## 9. Conclusions

We have analyzed the scheme of Yang et al. and pointed out, except the attacks mentioned in Mishra et al. paper, their scheme suffers from the session key attack and has some mistakes. We propose a new provable secure and efficient digital rights management authentication scheme using smart card based on elliptic curve cryptography to surmount the problems in Yang et al.’s. And we demonstrate that the new scheme is provable secure under the model AFP05 introduced in this paper. Because hash function is used to replace the operations of point on elliptic curve and the symmetric key computation in our scheme, our scheme is more efficient than Yang et al.’s scheme. As a result, our proposed scheme is more suitable for practical applications in ubiquitous computing.



---

*Source: 807213-2015-07-26.xml*