# Cryptanalysis and Security Enhancement of Three Authentication Schemes in Wireless Sensor Networks

Authors: Wenting Li; Bin Li; Yiming Zhao; Ping Wang; Fushan Wei
Journal: Wireless Communications and Mobile Computing
 (2018)

---

## Abstract

Nowadays wireless sensor networks (WSNs) have drawn great attention from both industrial world and academic community. To facilitate real-time data access for external users from the sensor nodes directly, password-based authentication has become the prevalent authentication mechanism in the past decades. In this work, we investigate three foremost protocols in the area of password-based user authentication scheme for WSNs. Firstly, we analyze an efficient and anonymous protocol and demonstrate that though this protocol is equipped with a formal proof, it actually has several security loopholes been overlooked, such that it cannot resist against smart card loss attack and violate forward secrecy. Secondly, we scrutinize a lightweight protocol and point out that it cannot achieve the claimed security goal of forward secrecy, as well as suffering from user anonymity violation attack and offline password guessing attack. Thirdly, we find that an anonymous scheme fails to preserve two critical properties of forward secrecy and user friendliness. In addition, by adopting the “perfect forward secrecy (PFS)” principle, we provide several effective countermeasures to remedy the identified weaknesses. To test the necessity and effectiveness of our suggestions, we conduct a comparison of 10 representative schemes in terms of the underlying cryptographic primitives used for realizing forward secrecy.


---

## Body

## 1. Introduction

Currently, wireless sensor networks (WSNs) have become one of the most standard services employed in commercial and industrial applications and proved to be a leading area of research [1–3]. Like many advanced technologies, the original appliance of WSNs can be found in military and heavy industrial applications. In the 1950s, the first modern WSN—the Sound Surveillance System (SOSUS)—is developed by the United States Military and used for detecting Soviet submarines [4]. Nowadays, WSNs thrive in industrial and consumer applications, including machine health monitoring, environmental sensing, natural disaster prevention, and health care monitoring [5–7].A wireless sensor network generally includes a central gateway node (GWN, so-called base station), a large number of circulating, self-directed and low powered devices named sensor nodes, and a set of end users. TheGWN acts as a bridge between WSNs and the other networks and also a powerful data managing and processing center. Sensor nodes are multifunctional, energy efficient devices and are spatially distributed over the networks for caringly collecting, processing, and transferring data.In many critical applications, remote users are usually keen on real-time accessing with sensor nodes [8, 9], yet if data queries are carried out by the gateway node, efficiency and accuracy might not be guaranteed over the long transmission path betweenGWN and the sensors. Accordingly, password-based user authentication proves to be a proper solution for this issue as its security, simplicity, and portability [10–12]. That is, users are first authenticated by remote sensor nodes before being permitted to access data.In 2006, Wong et al. [13] proposed the first password-based authentication scheme for wireless sensor networks that allows legitimate users to query sensitive information at every sensor of the network. However, shortly after this protocol was presented, Tseng et al. [14] and Das et al. [15] pointed out that Wong et al.’s scheme [13] is vulnerable to replay attack, forgery attack, and node capture attack separately, then an enhanced one based on smart card was firstly proposed by Das et al. [15]. Unfortunately, Khan and Alghathbar [16], Chen et al. [17], and Yeh et al. [18] pointed out some weaknesses in Das et al.’s scheme, such as suffering from impersonation attack, insider attack, and the violation of user anonymity and key agreement. Then some improvements are made in these works.However, in 2013, Shi and Gong [19] found that Yeh et al.’s scheme [18] cannot achieve mutual authentication and user anonymity, then they proposed an efficient ECC-based authentication scheme for WSNs. At the same time, Khan and Alghathbar’s protocol [16] was also proven insecure against insider attack, smart card loss attack and forgery attack by Vaidya et al. [20] and Chen et al.’s scheme [17] was shown as vulnerable to impersonation attack, replay attack andGWN by passing attack in [21]. Later, Choi et al. [22] demonstrated that Shi and Gong’s scheme [19] is vulnerable to smart card loss attack and an enhanced scheme was given in [22]. Meanwhile, Xue et al. [23] presented a temporal credential-based two-factor (i.e., smart card and password) authentication scheme for WSNs. Although their scheme retains many admirable properties, there are some weaknesses being found by researchers [8, 11, 24], such as offline password guessing, insider, impersonation, and tracking attacks.Quite recently, Li et al. [25] analyzed the security of Jiang et al.’s scheme [11] (an improvement based on [23]) and showed that their scheme suffers from user friendliness issue, desynchronization problem, and is inapplicable for WSN environments. Then a new scheme was proposed in [25]; however, in this paper, we reveal that Li et al.’s scheme [25] still fails to eliminate the security pitfalls of smart card loss attack and the violation of forward secrecy. At the same time, we find that the newly proposed schemes by Amin et al. [8] and Wu et al. [9] are prone to the same security defects with Li et al.’s scheme [25].From the above analysis, it can be seen that many of the previous protocols are not much satisfactory. On the one hand, this is because the lack of necessary principles. Some principles that have been proven are still ignored in the design of the protocol, such as user anonymity principle [7] and perfect forward secrecy principle [26]. On the other hand, the protocol designers usually do not follow unified evaluation criteria, and they tend to emphasize the advantages of their new designed protocol, but ignore its inadequacies. Besides reporting the security flaws in [8, 9, 25], we also provide effective countermeasures and refinements to overcome these pitfalls, accordingly, examine the necessary of our suggestions.Contributions. In this work, we mainly review and analyze three state-of-the-art authentication protocols proposed by Li et al. [25], Amin et al. [8], and Wu et al. [9]. And reveal that all these three schemes suffer from smart card loss issue and cannot achieve forward secrecy. Then we suggest several possible countermeasures to overcome these pitfalls. We also provide a comparison of 10 representative schemes for wireless sensor networks which emphatically considered how and with what technology did they realize forward secrecy. This illustrates the necessity and effectiveness of our suggestions and provides a better understanding of the exiting schemes.Organization. The remainder of this paper is organized as follows. Section 2 reviews and demonstrates the pitfalls of Li et al.’s scheme. Section 3 cryptanalyzes Amin et al.’s protocol with proper countermeasures over discovered flaws. Section 4 describes the weaknesses of Wu et al.’s protocol and compares 10 representative schemes. The conclusion is made in Section 5.


## 2. Cryptanalysis of Li et al.’s Scheme

Earlier in 2018, Li et al. [25] presented a three-factor anonymous and efficient authentication scheme for wireless sensor networks. Although their scheme has many attractive properties, such as the provision of user anonymity and local password change, it still fails to attain many of the claimed goals. In this section, we will demonstrate that though Li et al. try to settle the user friendliness issue of Jiang et al.’s scheme [11], their solution leads to offline dictionary attack. And we also observe that Li et al.’s scheme cannot preserve forward secrecy, which is the most crucial goal for WSNs.


### 2.1. Review of Li et al.’s Scheme

In this subsection, we briefly revisit Li et al.’s scheme [25]. For ease of description, some intuitive notations and abbreviates are listed in Table 1 and will appear throughout this paper. Their scheme includes three main phases: registration, login and authentication, and password change. We will follow their presentations as close as possible.Table 1
Notations and abbreviations.
Symbol Description Ui i t h user Sj j t h remote sensor node GWN gateway node A malicious attacker I D i, SIDj identity ofUi and Sj PWi password ofUi x,K the secret key of gateway nodeGWN SC a smart card ⊕ the XOR operation ∥ the concatenation operation h(⋅) one-way hash function → the public channel ⇒ the secure channel


#### 2.1.1. Registration Phase

Before the registration phase of Li et al.’s [25] scheme, the gateway node defines a finite cyclic group G = <P> of order a large prime number n. This group could be an elliptic curve group, or it could be a prime order subgroup of Zp∗. ThenGWN chooses two random numbers x, K as its master secret key and computes X=xP as its public key. Ultimately,GWN publishes {E(Fp),G,P,X} and stores x, K securely.Sensor Registration Phase.GWN chooses an identity SIDj and computes the secret key KS=h(SIDj∥K) for each sensor node. Then,GWN embeds {SIDj,KS} in the memory of Sj and deploys it in the particular area.User Registration Phase. When a user Ui aims to acquire the sensitive information of remote sensor nodes, the following procedure is carried out by Ui firstly.(1)Ui chooses an identity IDi, a password PWi, and a nonce ai and calculates RPWi=h(PWi∥ai). Then Ui imprints his/her biometric bi on a specific device.(2)Ui⇒GWN: {IDi,RPWi,bi}.(3) Once obtainingUi’s registration request,GWN generates a random codeword ci∈C and computes F(ci,bi)=(α,δ), where α=h(ci) and δ=ci⊕bi.GWN further computes Ai=h(IDi∥RPWi∥ci) and Bi=h(IDi∥K)⊕h(RPWi∥ci) and keeps {α,δ,Ai,Bi,X, f(·)} into a new smart card SC. At the same time,GWN stores IDi in its database.(4)GWN⇒Ui:{α,δ,Ai,Bi,X,f(·)}.(5) When receiving the smart card,Ui stores ai into it.


#### 2.1.2. Login and Authentication Phase

In this phase, the following steps are performed byUi, Sj, andGWN as well as negotiating a session key.(1)Ui inserts SC into a card reader and inputs bi∗ on a specific device. Then SC computes ci∗=f(δ⊕bi∗)=f(ci⊕(bi⊕bi∗)) and checks whether h(ci∗)=?α=h(ci). If not, SC terminates the session. Otherwise, SC asks Ui to input IDi and PWi and computes Ai∗=h(IDi∥h(PWi∥ai)∥ci∗). Then SC checks whether Ai∗=?Ai. If it does not hold, SC rejects the session. Otherwise, SC chooses two random numbers ri and s and then calculates M1=Bi⊕h(h(PWi∥ai)∥ci∗), M2=sP, M3=sX=sxP, M4=IDi⊕M3, M5=M1⊕ri, M6=h(IDi∥ri)⊕SIDj, and M7=h(M1∥SIDj∥M3∥ri).(2)Ui→GWN: {M2,M4,M5,M6,M7}.(3) Upon receiving the login request,GWN computes M3=xM2=xsP and IDi=M4⊕M3 and verifies if IDi is in the database. If not, the request is aborted. Otherwise,GWN computes M1=h(IDi∥K), ri=M5⊕M1, SIDj=M6⊕h(IDi∥ri), and M7∗=h(M1∥SIDj∥M3∥ri) and checks whether M7∗=?M7. If it does not hold,GWN terminates the session. Otherwise,GWN selects a random number rg and computes KS=h(SIDj∥K), M8=IDi⊕KS, M9=rg⊕h(IDi∥KS), M10=rg⊕ri, and M11=h(IDi∥SIDj∥KS∥ri∥rg).(4)GWN→Sj:{M8,M9,M10,M11}.(5) When receiving the message,Sj computes IDi=M8⊕KS, rg=h(IDi∥KS)⊕M9, ri=rg⊕M10, and M11∗=h(IDi∥SIDj∥KS∥ri∥rg) and checks whether M11∗=?M11. If not, the session is rejected. Otherwise, Sj selects a random number rj and computes M12=rj⊕KS, SKj=h(IDi∥SIDj∥ri∥rg∥rj), and M13=h(KS∥SKj∥rj).(6)Sj→GWN: {M12,M13}.(7) After getting the response message,GWN computes rj=M12⊕KS, SK=h(IDi∥SIDj∥ri∥rg∥rj), and M13∗=h(KS∥SK∥rj) and checks whether M13∗=?M13. If not,GWN aborts the session. Otherwise,GWN calculates M14=M1⊕rg, M15=ri⊕rj, and M16=h(IDi∥SK∥rg∥rj).(8)GWN→Ui:{M14,M15,M16}.(9) WhenUi receiving the response message, SC computes rg=M14⊕M1, rj=M15⊕ri, SKi=h(IDi∥SIDj∥ri∥rg∥rj), and M16∗=h(IDi∥SKi∥rg∥rj) and checks whether M16∗=?M16. If it does not hold, Ui terminates the connection. Otherwise, Ui and Sj establish a connection with a session key.


### 2.2. Cryptanalysis of Li et al.’s Scheme

A concrete and concise adversarial model is essential for a good design of user authentication scheme in wireless sensor networks. Though lacking of specification in Li et al.’s scheme [25], the following assumptions about the adversary’s capabilities are implicitly made in [25]:(1) Two communication channels exist: one is a secure, or a private channel which is mainly used for registration; another is a public channel which acts on login and authentication phases. As in the conventional authentication protocols, the adversaryA is modeled to have full control of the public channel; i.e., A can eavesdrop, intercept, and modify and redirect any transmitted messages between the communication parties [3, 6].(2) The user-memorable identities and passwords are of low entropy and can be offline enumerated byA at the same time within polynomial time.(3) When considering truly multifactor authentication (i.e., the scheme is secure even if one or more factors are cracked [10]), it is rational to assume that A may (i) learn a victim’s password such as phishing or shoulder surfing attacks, (ii) extract the secret parameters in the lost smart card by side-channel attack, or (iii) obtain a victim’s biometric information via malicious device, but cannot achieve all. Otherwise, it is a trivial case.(4) To delineate the critical feature of forward secrecy,A is allowed to corrupt any valid entities to obtain its longterm secret key(s). In addition, previous session key(s) may be revealed by A as a possible reason of improper erasure [10, 27].It is worth noting that the above adversarial model, following the existing works in [3, 6, 7, 10, 28], is one of the few ones that apply to multifactor authentication in WSNs. For the sake of user friendliness, many protocols allow their users to select his/her identity ID and password PW. However, the user usually chooses easy-to-remember identity (e.g., email, phone number) and password, which are of low entropy (|Did|≤|Dpw|≤106 [29, 30]) and can be offline enumerated by A within polynomial time. Besides, assumption (3) specifies truly three-factor security and assumption (4) is used to capture the crucial notion of forward secrecy whenGWN or any sensor node Sj is corrupted. In the following sections, our analysis will take account of these four assumptions.


#### 2.2.1. Smart Card Loss Attack

In [25], Li et al. pointed out that Jiang et al.’s scheme [11] lacks timely detection mechanism, which means once a user inputs wrong identity or password unintentionally, the system will remain executing the following login and authentication phases. Undoubtedly, this interaction process will bring extra cost. In reality, it is a common accident as users usually involve in countless applications and manage various pairs of identity and password [7]. To solve this problem, Li et al.’s scheme [25] inserts a verification item Ai=h(IDi∥h(PWi∥ai)∥ci) in the smart card for the purpose of providing timely detection and performing password change without any interaction with theGWN. However, their modification goes back to the “security-usability” balance problem proposed by Huang et al. [12]; that is, it realizes local password change but brings offline dictionary attack. We illustrate this attack as below.Step 1.
A chooses a pair (IDi∗,PWi∗) from Did×Dpw, where Did represents the identity space and Dpw represents the password space.Step 2.
A computes Ai∗=h(IDi∗∥h(PWi∗∥ai)∥ci), where ai is extracted from the victim’s smart card and ci can be obtained by computing ci=f(δ⊕bi) with the help of malicious device.Step 3.
A verifies the correctness of (IDi∗,PWi∗) pair by checking whether the computed Ai∗ equals the extracted Ai.Step 4.
A repeats the above Steps 1~3 until the right values are found.Besides the previous reasonable assumption (3), it should be pointed out that, in the registration phase of Li et al.’s scheme [25], Ui imprints his/her biometric information bi on a specific device and simply submits the plain-text bi toGWN. Then,GWN employs the fuzzy commitment technology [31] and the generated α to compute δ. In such situation, if a privileged insider, e.g., the administrator, has learned the user’s biometric information, she is able to complete the above offline guessing attack. Of course, she is able to impersonate the victim to login other applications as biometric characteristics cannot be easily changed.For another, in order to realize user friendliness, most password-based authentication schemes (e.g., [8, 9, 11]) allow users to choose his/her own ID and PW, and Li et al.’s scheme is no exception. However, users usually tend to choose easy-to-remember and thus of low entropy identities and passwords, so that it is reasonable to make the assumption (2) that A can offline enumerate all the (ID,PW) pairs within polynomial time. The running time of the above attack procedure is O(2TH×|Did|×|Dpw|), where |Did| denotes the number of identities, |Dpw| denotes the number of passwords, and TH is the running time for Hash operation. Since |Did| and |Dpw| are very limited in practice (e.g., |Did|≤|Dpw|≤106 [29, 30]), our above attack is meaningful and poses a real challenge to user authentication protocols for wireless sensor networks.


#### 2.2.2. The Violation of Forward Secrecy

WSNs are generally deployed in security-critical applications, such as battlefield surveillance and health care monitoring [7, 27, 32, 33]. The sensor nodes at risk had been driven: on one hand, due to the unattended environments and low-cost considerations, it is easier for an adversary A to focus on sensors access to breakthrough success; on the other hand, sensors often perform extremely sensitive tasks and thus, they preserve sensitive information and exhibit greater attack surface. Consequently, sensor nodes are more vulnerable to serious attacks, so that an admired authentication scheme for WSNs ought to be guaranteed against node capture attack.Unfortunately, Li et al.’s scheme [25] cannot resist against this severe node capture attack. Let us consider the following scenarios. In case a sensor node Sk has been compromised by an adversary A and the stored secret key KS can be extracted. This assumption is sound as made in assumption (4) and it is also implicitly described in Li et al.’s scheme [25]. With the extracted KS, A can successfully obtain the previous session key between Sk and any user Ui, as follows.Step 1.
Eavesdrop and intercept the message{M8,M9,M10,M11} sending fromGWN to Sk.Step 2.
ComputeIDi=M8⊕KS, rg=h(IDi∥KS)⊕M9, and ri=rg⊕M10.Step 3.
Intercept the message{M12,M13} sending from Sk toGWN.Step 4.
Computerk=M12⊕KS.Step 5.
Intercept the login message{M2,M4,M5,M6,M7} sending from Ui toGWN.Step 6.
ComputeSIDk=M6⊕h(IDi∥ri).Step 7.
Compute the previous session key asSK=h(IDi∥SIDk∥ri∥rg∥rk).There are some points to be noted regarding the aforementioned attack. Firstly, the reason why we add Steps 5 and 6 is that these two steps are conducive to check the parameters thoughA has already known SIDk. Then, it is not hard to see that A only needs to eavesdrop over the public channel with simple computations to complete the aforementioned attack procedure. Consequently, the desirable security goal of perfect forward secrecy (PFS) cannot be attained by Li et al.’s scheme.Despite considerable attention has been paid to forward secrecy issue, many prior works still explicitly or implicitly use an incorrect computation for the session key(s) (e.g., [8, 9, 21, 34]). This is mainly due to the violation of the “PFS principle” suggested in [26]: (i) public-key techniques are indispensable; (ii) at least two exponentiation operations are conducted on server side. Though Ma et al. [26] emphasize this principle on client-server architecture, after careful analysis, we find this “PFS principle” is suitable for WSN environments (i.e., three-party environment). In this cases, we will takeGWN and sensors as server side, while keeping users as client.Accordingly, elliptic curves cryptosystem (ECC) is a reasonable choice for overcoming this pitfall, whereas in their original scheme [25] Li et al. employ this mechanism to greatly attain user anonymity. To make a precisely modification, we assume ri to be riP and rj to be rjP, where point P is a generator mentioned before and ri, rj are two random numbers chosen by Ui and Sj separately. Note thatGWN has no need to be involved in negotiating the session key. Then in this way, the session key can be recalculated as SK=h(IDi∥SIDj∥riP∥rjP∥rirjP). As it is generated by session-variant random numbers ri and rj and computationally infeasible to guess rirjP from transmitted message due to discrete logarithm problem, Li et al.’s scheme [25] will be secure against node capture attack and provide forward secrecy perfectly after slight modifications.


#### 2.2.3. Mistakes in the Proof

The emergence of BAN logic opens up a new chapter in the proof of user authentication protocol [35, 36]; it can not only be used to prove whether the protocol achieves some desired goals, but also be employed to find some defects in the protocol. However, there still are some problems in the application of BAN logic. On the one hand, BAN logic cannot prove whether the protocol achieves all security goals and desirable properties. For example, it cannot prove that the protocol resists against parallel session attack, denial-of-service attack, node capture attack, etc. On the other hand, the analysis of BAN logic depends on some basic assumptions and the initial hypotheses. If the initial hypotheses was not sound, the formal analysis will lead to erroneous conclusions.In the formal proof of Li et al.’s scheme [25] with BAN logic, there are several minor problems. Firstly, Li et al. add a new logic rule,session keys rule:(1)P≡#X,P≡Q≡XP≡P↔KQHowever, it is better to explain the calculation method ofK and the key role of X in K. Otherwise, we cannot derive that P believes P and Q share K from the upper part of the equation.Secondly, we suggest that the initiative premises p13 and p14, i.e.,GWN|≡Sj⇒rj⊕K and Sj|≡GWN⇒rg⊕h(IDi∥K), respectively, should be derived from the translation messages, but not in the premises. Finally, they may ignore some details in the formal proof, such as in the D5, it is better to addGWN|≡#ri, which we cannot find in the assumption or derive from the front. It also can be seen that the correctness of the protocol cannot be guaranteed only by using the formal proof.


## 2.1. Review of Li et al.’s Scheme

In this subsection, we briefly revisit Li et al.’s scheme [25]. For ease of description, some intuitive notations and abbreviates are listed in Table 1 and will appear throughout this paper. Their scheme includes three main phases: registration, login and authentication, and password change. We will follow their presentations as close as possible.Table 1
Notations and abbreviations.
Symbol Description Ui i t h user Sj j t h remote sensor node GWN gateway node A malicious attacker I D i, SIDj identity ofUi and Sj PWi password ofUi x,K the secret key of gateway nodeGWN SC a smart card ⊕ the XOR operation ∥ the concatenation operation h(⋅) one-way hash function → the public channel ⇒ the secure channel


### 2.1.1. Registration Phase

Before the registration phase of Li et al.’s [25] scheme, the gateway node defines a finite cyclic group G = <P> of order a large prime number n. This group could be an elliptic curve group, or it could be a prime order subgroup of Zp∗. ThenGWN chooses two random numbers x, K as its master secret key and computes X=xP as its public key. Ultimately,GWN publishes {E(Fp),G,P,X} and stores x, K securely.Sensor Registration Phase.GWN chooses an identity SIDj and computes the secret key KS=h(SIDj∥K) for each sensor node. Then,GWN embeds {SIDj,KS} in the memory of Sj and deploys it in the particular area.User Registration Phase. When a user Ui aims to acquire the sensitive information of remote sensor nodes, the following procedure is carried out by Ui firstly.(1)Ui chooses an identity IDi, a password PWi, and a nonce ai and calculates RPWi=h(PWi∥ai). Then Ui imprints his/her biometric bi on a specific device.(2)Ui⇒GWN: {IDi,RPWi,bi}.(3) Once obtainingUi’s registration request,GWN generates a random codeword ci∈C and computes F(ci,bi)=(α,δ), where α=h(ci) and δ=ci⊕bi.GWN further computes Ai=h(IDi∥RPWi∥ci) and Bi=h(IDi∥K)⊕h(RPWi∥ci) and keeps {α,δ,Ai,Bi,X, f(·)} into a new smart card SC. At the same time,GWN stores IDi in its database.(4)GWN⇒Ui:{α,δ,Ai,Bi,X,f(·)}.(5) When receiving the smart card,Ui stores ai into it.


### 2.1.2. Login and Authentication Phase

In this phase, the following steps are performed byUi, Sj, andGWN as well as negotiating a session key.(1)Ui inserts SC into a card reader and inputs bi∗ on a specific device. Then SC computes ci∗=f(δ⊕bi∗)=f(ci⊕(bi⊕bi∗)) and checks whether h(ci∗)=?α=h(ci). If not, SC terminates the session. Otherwise, SC asks Ui to input IDi and PWi and computes Ai∗=h(IDi∥h(PWi∥ai)∥ci∗). Then SC checks whether Ai∗=?Ai. If it does not hold, SC rejects the session. Otherwise, SC chooses two random numbers ri and s and then calculates M1=Bi⊕h(h(PWi∥ai)∥ci∗), M2=sP, M3=sX=sxP, M4=IDi⊕M3, M5=M1⊕ri, M6=h(IDi∥ri)⊕SIDj, and M7=h(M1∥SIDj∥M3∥ri).(2)Ui→GWN: {M2,M4,M5,M6,M7}.(3) Upon receiving the login request,GWN computes M3=xM2=xsP and IDi=M4⊕M3 and verifies if IDi is in the database. If not, the request is aborted. Otherwise,GWN computes M1=h(IDi∥K), ri=M5⊕M1, SIDj=M6⊕h(IDi∥ri), and M7∗=h(M1∥SIDj∥M3∥ri) and checks whether M7∗=?M7. If it does not hold,GWN terminates the session. Otherwise,GWN selects a random number rg and computes KS=h(SIDj∥K), M8=IDi⊕KS, M9=rg⊕h(IDi∥KS), M10=rg⊕ri, and M11=h(IDi∥SIDj∥KS∥ri∥rg).(4)GWN→Sj:{M8,M9,M10,M11}.(5) When receiving the message,Sj computes IDi=M8⊕KS, rg=h(IDi∥KS)⊕M9, ri=rg⊕M10, and M11∗=h(IDi∥SIDj∥KS∥ri∥rg) and checks whether M11∗=?M11. If not, the session is rejected. Otherwise, Sj selects a random number rj and computes M12=rj⊕KS, SKj=h(IDi∥SIDj∥ri∥rg∥rj), and M13=h(KS∥SKj∥rj).(6)Sj→GWN: {M12,M13}.(7) After getting the response message,GWN computes rj=M12⊕KS, SK=h(IDi∥SIDj∥ri∥rg∥rj), and M13∗=h(KS∥SK∥rj) and checks whether M13∗=?M13. If not,GWN aborts the session. Otherwise,GWN calculates M14=M1⊕rg, M15=ri⊕rj, and M16=h(IDi∥SK∥rg∥rj).(8)GWN→Ui:{M14,M15,M16}.(9) WhenUi receiving the response message, SC computes rg=M14⊕M1, rj=M15⊕ri, SKi=h(IDi∥SIDj∥ri∥rg∥rj), and M16∗=h(IDi∥SKi∥rg∥rj) and checks whether M16∗=?M16. If it does not hold, Ui terminates the connection. Otherwise, Ui and Sj establish a connection with a session key.


## 2.1.1. Registration Phase

Before the registration phase of Li et al.’s [25] scheme, the gateway node defines a finite cyclic group G = <P> of order a large prime number n. This group could be an elliptic curve group, or it could be a prime order subgroup of Zp∗. ThenGWN chooses two random numbers x, K as its master secret key and computes X=xP as its public key. Ultimately,GWN publishes {E(Fp),G,P,X} and stores x, K securely.Sensor Registration Phase.GWN chooses an identity SIDj and computes the secret key KS=h(SIDj∥K) for each sensor node. Then,GWN embeds {SIDj,KS} in the memory of Sj and deploys it in the particular area.User Registration Phase. When a user Ui aims to acquire the sensitive information of remote sensor nodes, the following procedure is carried out by Ui firstly.(1)Ui chooses an identity IDi, a password PWi, and a nonce ai and calculates RPWi=h(PWi∥ai). Then Ui imprints his/her biometric bi on a specific device.(2)Ui⇒GWN: {IDi,RPWi,bi}.(3) Once obtainingUi’s registration request,GWN generates a random codeword ci∈C and computes F(ci,bi)=(α,δ), where α=h(ci) and δ=ci⊕bi.GWN further computes Ai=h(IDi∥RPWi∥ci) and Bi=h(IDi∥K)⊕h(RPWi∥ci) and keeps {α,δ,Ai,Bi,X, f(·)} into a new smart card SC. At the same time,GWN stores IDi in its database.(4)GWN⇒Ui:{α,δ,Ai,Bi,X,f(·)}.(5) When receiving the smart card,Ui stores ai into it.


## 2.1.2. Login and Authentication Phase

In this phase, the following steps are performed byUi, Sj, andGWN as well as negotiating a session key.(1)Ui inserts SC into a card reader and inputs bi∗ on a specific device. Then SC computes ci∗=f(δ⊕bi∗)=f(ci⊕(bi⊕bi∗)) and checks whether h(ci∗)=?α=h(ci). If not, SC terminates the session. Otherwise, SC asks Ui to input IDi and PWi and computes Ai∗=h(IDi∥h(PWi∥ai)∥ci∗). Then SC checks whether Ai∗=?Ai. If it does not hold, SC rejects the session. Otherwise, SC chooses two random numbers ri and s and then calculates M1=Bi⊕h(h(PWi∥ai)∥ci∗), M2=sP, M3=sX=sxP, M4=IDi⊕M3, M5=M1⊕ri, M6=h(IDi∥ri)⊕SIDj, and M7=h(M1∥SIDj∥M3∥ri).(2)Ui→GWN: {M2,M4,M5,M6,M7}.(3) Upon receiving the login request,GWN computes M3=xM2=xsP and IDi=M4⊕M3 and verifies if IDi is in the database. If not, the request is aborted. Otherwise,GWN computes M1=h(IDi∥K), ri=M5⊕M1, SIDj=M6⊕h(IDi∥ri), and M7∗=h(M1∥SIDj∥M3∥ri) and checks whether M7∗=?M7. If it does not hold,GWN terminates the session. Otherwise,GWN selects a random number rg and computes KS=h(SIDj∥K), M8=IDi⊕KS, M9=rg⊕h(IDi∥KS), M10=rg⊕ri, and M11=h(IDi∥SIDj∥KS∥ri∥rg).(4)GWN→Sj:{M8,M9,M10,M11}.(5) When receiving the message,Sj computes IDi=M8⊕KS, rg=h(IDi∥KS)⊕M9, ri=rg⊕M10, and M11∗=h(IDi∥SIDj∥KS∥ri∥rg) and checks whether M11∗=?M11. If not, the session is rejected. Otherwise, Sj selects a random number rj and computes M12=rj⊕KS, SKj=h(IDi∥SIDj∥ri∥rg∥rj), and M13=h(KS∥SKj∥rj).(6)Sj→GWN: {M12,M13}.(7) After getting the response message,GWN computes rj=M12⊕KS, SK=h(IDi∥SIDj∥ri∥rg∥rj), and M13∗=h(KS∥SK∥rj) and checks whether M13∗=?M13. If not,GWN aborts the session. Otherwise,GWN calculates M14=M1⊕rg, M15=ri⊕rj, and M16=h(IDi∥SK∥rg∥rj).(8)GWN→Ui:{M14,M15,M16}.(9) WhenUi receiving the response message, SC computes rg=M14⊕M1, rj=M15⊕ri, SKi=h(IDi∥SIDj∥ri∥rg∥rj), and M16∗=h(IDi∥SKi∥rg∥rj) and checks whether M16∗=?M16. If it does not hold, Ui terminates the connection. Otherwise, Ui and Sj establish a connection with a session key.


## 2.2. Cryptanalysis of Li et al.’s Scheme

A concrete and concise adversarial model is essential for a good design of user authentication scheme in wireless sensor networks. Though lacking of specification in Li et al.’s scheme [25], the following assumptions about the adversary’s capabilities are implicitly made in [25]:(1) Two communication channels exist: one is a secure, or a private channel which is mainly used for registration; another is a public channel which acts on login and authentication phases. As in the conventional authentication protocols, the adversaryA is modeled to have full control of the public channel; i.e., A can eavesdrop, intercept, and modify and redirect any transmitted messages between the communication parties [3, 6].(2) The user-memorable identities and passwords are of low entropy and can be offline enumerated byA at the same time within polynomial time.(3) When considering truly multifactor authentication (i.e., the scheme is secure even if one or more factors are cracked [10]), it is rational to assume that A may (i) learn a victim’s password such as phishing or shoulder surfing attacks, (ii) extract the secret parameters in the lost smart card by side-channel attack, or (iii) obtain a victim’s biometric information via malicious device, but cannot achieve all. Otherwise, it is a trivial case.(4) To delineate the critical feature of forward secrecy,A is allowed to corrupt any valid entities to obtain its longterm secret key(s). In addition, previous session key(s) may be revealed by A as a possible reason of improper erasure [10, 27].It is worth noting that the above adversarial model, following the existing works in [3, 6, 7, 10, 28], is one of the few ones that apply to multifactor authentication in WSNs. For the sake of user friendliness, many protocols allow their users to select his/her identity ID and password PW. However, the user usually chooses easy-to-remember identity (e.g., email, phone number) and password, which are of low entropy (|Did|≤|Dpw|≤106 [29, 30]) and can be offline enumerated by A within polynomial time. Besides, assumption (3) specifies truly three-factor security and assumption (4) is used to capture the crucial notion of forward secrecy whenGWN or any sensor node Sj is corrupted. In the following sections, our analysis will take account of these four assumptions.


### 2.2.1. Smart Card Loss Attack

In [25], Li et al. pointed out that Jiang et al.’s scheme [11] lacks timely detection mechanism, which means once a user inputs wrong identity or password unintentionally, the system will remain executing the following login and authentication phases. Undoubtedly, this interaction process will bring extra cost. In reality, it is a common accident as users usually involve in countless applications and manage various pairs of identity and password [7]. To solve this problem, Li et al.’s scheme [25] inserts a verification item Ai=h(IDi∥h(PWi∥ai)∥ci) in the smart card for the purpose of providing timely detection and performing password change without any interaction with theGWN. However, their modification goes back to the “security-usability” balance problem proposed by Huang et al. [12]; that is, it realizes local password change but brings offline dictionary attack. We illustrate this attack as below.Step 1.
A chooses a pair (IDi∗,PWi∗) from Did×Dpw, where Did represents the identity space and Dpw represents the password space.Step 2.
A computes Ai∗=h(IDi∗∥h(PWi∗∥ai)∥ci), where ai is extracted from the victim’s smart card and ci can be obtained by computing ci=f(δ⊕bi) with the help of malicious device.Step 3.
A verifies the correctness of (IDi∗,PWi∗) pair by checking whether the computed Ai∗ equals the extracted Ai.Step 4.
A repeats the above Steps 1~3 until the right values are found.Besides the previous reasonable assumption (3), it should be pointed out that, in the registration phase of Li et al.’s scheme [25], Ui imprints his/her biometric information bi on a specific device and simply submits the plain-text bi toGWN. Then,GWN employs the fuzzy commitment technology [31] and the generated α to compute δ. In such situation, if a privileged insider, e.g., the administrator, has learned the user’s biometric information, she is able to complete the above offline guessing attack. Of course, she is able to impersonate the victim to login other applications as biometric characteristics cannot be easily changed.For another, in order to realize user friendliness, most password-based authentication schemes (e.g., [8, 9, 11]) allow users to choose his/her own ID and PW, and Li et al.’s scheme is no exception. However, users usually tend to choose easy-to-remember and thus of low entropy identities and passwords, so that it is reasonable to make the assumption (2) that A can offline enumerate all the (ID,PW) pairs within polynomial time. The running time of the above attack procedure is O(2TH×|Did|×|Dpw|), where |Did| denotes the number of identities, |Dpw| denotes the number of passwords, and TH is the running time for Hash operation. Since |Did| and |Dpw| are very limited in practice (e.g., |Did|≤|Dpw|≤106 [29, 30]), our above attack is meaningful and poses a real challenge to user authentication protocols for wireless sensor networks.


### 2.2.2. The Violation of Forward Secrecy

WSNs are generally deployed in security-critical applications, such as battlefield surveillance and health care monitoring [7, 27, 32, 33]. The sensor nodes at risk had been driven: on one hand, due to the unattended environments and low-cost considerations, it is easier for an adversary A to focus on sensors access to breakthrough success; on the other hand, sensors often perform extremely sensitive tasks and thus, they preserve sensitive information and exhibit greater attack surface. Consequently, sensor nodes are more vulnerable to serious attacks, so that an admired authentication scheme for WSNs ought to be guaranteed against node capture attack.Unfortunately, Li et al.’s scheme [25] cannot resist against this severe node capture attack. Let us consider the following scenarios. In case a sensor node Sk has been compromised by an adversary A and the stored secret key KS can be extracted. This assumption is sound as made in assumption (4) and it is also implicitly described in Li et al.’s scheme [25]. With the extracted KS, A can successfully obtain the previous session key between Sk and any user Ui, as follows.Step 1.
Eavesdrop and intercept the message{M8,M9,M10,M11} sending fromGWN to Sk.Step 2.
ComputeIDi=M8⊕KS, rg=h(IDi∥KS)⊕M9, and ri=rg⊕M10.Step 3.
Intercept the message{M12,M13} sending from Sk toGWN.Step 4.
Computerk=M12⊕KS.Step 5.
Intercept the login message{M2,M4,M5,M6,M7} sending from Ui toGWN.Step 6.
ComputeSIDk=M6⊕h(IDi∥ri).Step 7.
Compute the previous session key asSK=h(IDi∥SIDk∥ri∥rg∥rk).There are some points to be noted regarding the aforementioned attack. Firstly, the reason why we add Steps 5 and 6 is that these two steps are conducive to check the parameters thoughA has already known SIDk. Then, it is not hard to see that A only needs to eavesdrop over the public channel with simple computations to complete the aforementioned attack procedure. Consequently, the desirable security goal of perfect forward secrecy (PFS) cannot be attained by Li et al.’s scheme.Despite considerable attention has been paid to forward secrecy issue, many prior works still explicitly or implicitly use an incorrect computation for the session key(s) (e.g., [8, 9, 21, 34]). This is mainly due to the violation of the “PFS principle” suggested in [26]: (i) public-key techniques are indispensable; (ii) at least two exponentiation operations are conducted on server side. Though Ma et al. [26] emphasize this principle on client-server architecture, after careful analysis, we find this “PFS principle” is suitable for WSN environments (i.e., three-party environment). In this cases, we will takeGWN and sensors as server side, while keeping users as client.Accordingly, elliptic curves cryptosystem (ECC) is a reasonable choice for overcoming this pitfall, whereas in their original scheme [25] Li et al. employ this mechanism to greatly attain user anonymity. To make a precisely modification, we assume ri to be riP and rj to be rjP, where point P is a generator mentioned before and ri, rj are two random numbers chosen by Ui and Sj separately. Note thatGWN has no need to be involved in negotiating the session key. Then in this way, the session key can be recalculated as SK=h(IDi∥SIDj∥riP∥rjP∥rirjP). As it is generated by session-variant random numbers ri and rj and computationally infeasible to guess rirjP from transmitted message due to discrete logarithm problem, Li et al.’s scheme [25] will be secure against node capture attack and provide forward secrecy perfectly after slight modifications.


### 2.2.3. Mistakes in the Proof

The emergence of BAN logic opens up a new chapter in the proof of user authentication protocol [35, 36]; it can not only be used to prove whether the protocol achieves some desired goals, but also be employed to find some defects in the protocol. However, there still are some problems in the application of BAN logic. On the one hand, BAN logic cannot prove whether the protocol achieves all security goals and desirable properties. For example, it cannot prove that the protocol resists against parallel session attack, denial-of-service attack, node capture attack, etc. On the other hand, the analysis of BAN logic depends on some basic assumptions and the initial hypotheses. If the initial hypotheses was not sound, the formal analysis will lead to erroneous conclusions.In the formal proof of Li et al.’s scheme [25] with BAN logic, there are several minor problems. Firstly, Li et al. add a new logic rule,session keys rule:(1)P≡#X,P≡Q≡XP≡P↔KQHowever, it is better to explain the calculation method ofK and the key role of X in K. Otherwise, we cannot derive that P believes P and Q share K from the upper part of the equation.Secondly, we suggest that the initiative premises p13 and p14, i.e.,GWN|≡Sj⇒rj⊕K and Sj|≡GWN⇒rg⊕h(IDi∥K), respectively, should be derived from the translation messages, but not in the premises. Finally, they may ignore some details in the formal proof, such as in the D5, it is better to addGWN|≡#ri, which we cannot find in the assumption or derive from the front. It also can be seen that the correctness of the protocol cannot be guaranteed only by using the formal proof.


## 2.2.1. Smart Card Loss Attack

In [25], Li et al. pointed out that Jiang et al.’s scheme [11] lacks timely detection mechanism, which means once a user inputs wrong identity or password unintentionally, the system will remain executing the following login and authentication phases. Undoubtedly, this interaction process will bring extra cost. In reality, it is a common accident as users usually involve in countless applications and manage various pairs of identity and password [7]. To solve this problem, Li et al.’s scheme [25] inserts a verification item Ai=h(IDi∥h(PWi∥ai)∥ci) in the smart card for the purpose of providing timely detection and performing password change without any interaction with theGWN. However, their modification goes back to the “security-usability” balance problem proposed by Huang et al. [12]; that is, it realizes local password change but brings offline dictionary attack. We illustrate this attack as below.Step 1.
A chooses a pair (IDi∗,PWi∗) from Did×Dpw, where Did represents the identity space and Dpw represents the password space.Step 2.
A computes Ai∗=h(IDi∗∥h(PWi∗∥ai)∥ci), where ai is extracted from the victim’s smart card and ci can be obtained by computing ci=f(δ⊕bi) with the help of malicious device.Step 3.
A verifies the correctness of (IDi∗,PWi∗) pair by checking whether the computed Ai∗ equals the extracted Ai.Step 4.
A repeats the above Steps 1~3 until the right values are found.Besides the previous reasonable assumption (3), it should be pointed out that, in the registration phase of Li et al.’s scheme [25], Ui imprints his/her biometric information bi on a specific device and simply submits the plain-text bi toGWN. Then,GWN employs the fuzzy commitment technology [31] and the generated α to compute δ. In such situation, if a privileged insider, e.g., the administrator, has learned the user’s biometric information, she is able to complete the above offline guessing attack. Of course, she is able to impersonate the victim to login other applications as biometric characteristics cannot be easily changed.For another, in order to realize user friendliness, most password-based authentication schemes (e.g., [8, 9, 11]) allow users to choose his/her own ID and PW, and Li et al.’s scheme is no exception. However, users usually tend to choose easy-to-remember and thus of low entropy identities and passwords, so that it is reasonable to make the assumption (2) that A can offline enumerate all the (ID,PW) pairs within polynomial time. The running time of the above attack procedure is O(2TH×|Did|×|Dpw|), where |Did| denotes the number of identities, |Dpw| denotes the number of passwords, and TH is the running time for Hash operation. Since |Did| and |Dpw| are very limited in practice (e.g., |Did|≤|Dpw|≤106 [29, 30]), our above attack is meaningful and poses a real challenge to user authentication protocols for wireless sensor networks.


## 2.2.2. The Violation of Forward Secrecy

WSNs are generally deployed in security-critical applications, such as battlefield surveillance and health care monitoring [7, 27, 32, 33]. The sensor nodes at risk had been driven: on one hand, due to the unattended environments and low-cost considerations, it is easier for an adversary A to focus on sensors access to breakthrough success; on the other hand, sensors often perform extremely sensitive tasks and thus, they preserve sensitive information and exhibit greater attack surface. Consequently, sensor nodes are more vulnerable to serious attacks, so that an admired authentication scheme for WSNs ought to be guaranteed against node capture attack.Unfortunately, Li et al.’s scheme [25] cannot resist against this severe node capture attack. Let us consider the following scenarios. In case a sensor node Sk has been compromised by an adversary A and the stored secret key KS can be extracted. This assumption is sound as made in assumption (4) and it is also implicitly described in Li et al.’s scheme [25]. With the extracted KS, A can successfully obtain the previous session key between Sk and any user Ui, as follows.Step 1.
Eavesdrop and intercept the message{M8,M9,M10,M11} sending fromGWN to Sk.Step 2.
ComputeIDi=M8⊕KS, rg=h(IDi∥KS)⊕M9, and ri=rg⊕M10.Step 3.
Intercept the message{M12,M13} sending from Sk toGWN.Step 4.
Computerk=M12⊕KS.Step 5.
Intercept the login message{M2,M4,M5,M6,M7} sending from Ui toGWN.Step 6.
ComputeSIDk=M6⊕h(IDi∥ri).Step 7.
Compute the previous session key asSK=h(IDi∥SIDk∥ri∥rg∥rk).There are some points to be noted regarding the aforementioned attack. Firstly, the reason why we add Steps 5 and 6 is that these two steps are conducive to check the parameters thoughA has already known SIDk. Then, it is not hard to see that A only needs to eavesdrop over the public channel with simple computations to complete the aforementioned attack procedure. Consequently, the desirable security goal of perfect forward secrecy (PFS) cannot be attained by Li et al.’s scheme.Despite considerable attention has been paid to forward secrecy issue, many prior works still explicitly or implicitly use an incorrect computation for the session key(s) (e.g., [8, 9, 21, 34]). This is mainly due to the violation of the “PFS principle” suggested in [26]: (i) public-key techniques are indispensable; (ii) at least two exponentiation operations are conducted on server side. Though Ma et al. [26] emphasize this principle on client-server architecture, after careful analysis, we find this “PFS principle” is suitable for WSN environments (i.e., three-party environment). In this cases, we will takeGWN and sensors as server side, while keeping users as client.Accordingly, elliptic curves cryptosystem (ECC) is a reasonable choice for overcoming this pitfall, whereas in their original scheme [25] Li et al. employ this mechanism to greatly attain user anonymity. To make a precisely modification, we assume ri to be riP and rj to be rjP, where point P is a generator mentioned before and ri, rj are two random numbers chosen by Ui and Sj separately. Note thatGWN has no need to be involved in negotiating the session key. Then in this way, the session key can be recalculated as SK=h(IDi∥SIDj∥riP∥rjP∥rirjP). As it is generated by session-variant random numbers ri and rj and computationally infeasible to guess rirjP from transmitted message due to discrete logarithm problem, Li et al.’s scheme [25] will be secure against node capture attack and provide forward secrecy perfectly after slight modifications.


## 2.2.3. Mistakes in the Proof

The emergence of BAN logic opens up a new chapter in the proof of user authentication protocol [35, 36]; it can not only be used to prove whether the protocol achieves some desired goals, but also be employed to find some defects in the protocol. However, there still are some problems in the application of BAN logic. On the one hand, BAN logic cannot prove whether the protocol achieves all security goals and desirable properties. For example, it cannot prove that the protocol resists against parallel session attack, denial-of-service attack, node capture attack, etc. On the other hand, the analysis of BAN logic depends on some basic assumptions and the initial hypotheses. If the initial hypotheses was not sound, the formal analysis will lead to erroneous conclusions.In the formal proof of Li et al.’s scheme [25] with BAN logic, there are several minor problems. Firstly, Li et al. add a new logic rule,session keys rule:(1)P≡#X,P≡Q≡XP≡P↔KQHowever, it is better to explain the calculation method ofK and the key role of X in K. Otherwise, we cannot derive that P believes P and Q share K from the upper part of the equation.Secondly, we suggest that the initiative premises p13 and p14, i.e.,GWN|≡Sj⇒rj⊕K and Sj|≡GWN⇒rg⊕h(IDi∥K), respectively, should be derived from the translation messages, but not in the premises. Finally, they may ignore some details in the formal proof, such as in the D5, it is better to addGWN|≡#ri, which we cannot find in the assumption or derive from the front. It also can be seen that the correctness of the protocol cannot be guaranteed only by using the formal proof.


## 3. Cryptanalysis of Amin et al.’s Scheme

Recently, Amin et al. [8] proposed a lightweight protocol for IoT-enabled devices for cloud computing environments. The private information is usually stored in distributed cloud servers (e.g., sensors), so that distributed nodes are confronted with the same security threats of sensors in wireless sensor networks. After careful analysis, we find that though equipped with a formal proof and exhibiting great application prospects, Amin et al.’s scheme still cannot resist against smart card loss attack and also fail to provide user anonymity and forward secrecy.


### 3.1. Review of Amin et al.’s Scheme

Here we briefly review the scheme proposed by Amin et al. [8], an enhancement over Xue et al.’s scheme [37] and Chuang et al.’s scheme [38].


#### 3.1.1. Registration Phase

The registration phase of Amin et al.’s scheme can be divided into cloud server registration and user registration.Cloud Server Registration Phase. In this phase, any cloud server Sj sends a self-chosen identity and random number pair {SIDj,d} to control server (CS). ThenCS chooses a random number y, computes Pj=h(SIDj∥d), BSj=h(Pj∥y), and responds {BSj} to Sj securely. Finally, Sj stores {BSj,d} in the memory.User Registration Phase. Firstly, a user Ui chooses his/her identity IDi, password PWi, and two random numbers <b1,b2>. Then Ui computes Ai=h(PWi∥b1), PIDi=h(IDi∥b2), and bbi=b2⊕Ai and sends {Ai,PIDi} toCS via secure channel. Upon receiving the registration request, theCS computes Ci=h(Ai∥PIDi), Di=h(PIDi∥x), and Ei=Di⊕Ai with its secret key. Finally,CS replies Ui a smart card with {Ci,Ei,h(·)}. After getting the smart card SC, Ui computes DP=h(IDi∥PWi)⊕b1 and records DP, bbi into it.


#### 3.1.2. Login and Authentication Phase

In order to access remote server resources, a legal userUi inserts his/her smart card into a card reader and inputs IDi, PWi. Then the following steps are performed:(1)SC computes b1=DP⊕h(IDi∥PWi), Ai=h(PWi∥b1), b2=bbi⊕Ai, PIDi=h(IDi∥b2), and Ci∗=h(Ai∥PIDi) and verifies whether Ci∗=?Ci. If so,SC selects a random number Ni and computes Di=Ei⊕Ai, Gi=h(PIDi∥SIDj∥Ni∥Ti∥Di), Fi=Di⊕Ni, and Zi=SIDj⊕h(Di∥Ni), where SIDj is Sj’s identity chosen by Ui and Ti is the current timestamp. Otherwise,SC terminates the session.(2)Ui→Sj:{Gi,Fi,Zi,PIDi,Ti}.(3) Upon receiving the login request,Sj checks whether |Tj-Ti|<ΔT holds, where Tj is Sj’s current timestamp and ΔT is the expected valid time interval. If it does not hold, Sj rejects the connection. Otherwise, Sj produces a random number Nj and computes Ji=BSj⊕Nj, Ki=h(Nj∥BSj∥Gi∥Tj).(4)Sj→CS:{Ji,Ki,Pj,Gi,Fi,Zi,PIDi,Ti,Tj}.(5) Once receiving the message fromSj,CS first checks the validity of time interval |Tcs-Tj|<ΔT. If the verification holds,CS continues to compute Di=h(PIDi∥x), Ni=Fi⊕Di, SIDj=Zi⊕h(Di∥Ni), and Gi∗=h(PIDi∥SIDj∥Ni∥Ti∥Di) and checks whether Gi∗=?Gi. If either of the above verification fails,CS terminates the procedure. Otherwise,CS keeps on calculating BSj=h(Pj∥y), Nj=BSj⊕Ji, and Ki∗=h(Nj∥BSj∥Gi∥Tj) and verifies whether the computed Ki∗ equals the received one. If not,CS aborts the session. Otherwise,CS chooses a random number Ncs and computes Pcs=Nj⊕Ncs⊕h(Ni∥Di), Rcs=Ni⊕Ncs⊕h(BSj∥Nj), SKcs=h(Ni⊕Nj⊕Ncs), Qcs=h((Nj⊕Ncs)∥SKcs), and Vcs=h((Ni∥Ncs)∥SKcs).(6)CS→Sj:{Pcs,Rcs,Qcs,Vcs}.(7) While receiving the message fromCS, Sj computes Wj=h(BSj∥Nj), Ni⊕Ncs=Rcs⊕Wj, SKj=h(Ni⊕Nj⊕Ncs), and Vcs∗=h((Ni∥Ncs)∥SKj) and checks the condition Vcs∗=?Vcs holds or not. If it does not hold, Sj terminates the connection. Otherwise, Sj sends {Pcs,Qcs} to Ui via public channel.(8) After receiving the response message fromSj, Ui computes Li=h(Ni∥Di), Nj⊕Ncs=Pcs⊕Li, SKi=h(Ni⊕Nj⊕Ncs), and Qcs∗=h((Nj⊕Ncs)∥SKcs) and verifies whether Qcs∗=?Qcs. If so, Ui successfully authenticates Sj and CS and establish a session key SKi=SKj=SKcs.


### 3.2. Cryptanalysis of Amin et al.’s Scheme

The four assumptions made in Section2.2 are also explicitly employed in Amin et al.’s work [8] when they analyze the security of Xue et al.’s scheme [37] and Chuang et al.’s scheme [38] and proof the safety of their scheme. Consequently, our following discussions will base on these four assumptions.


#### 3.2.1. No Provision of User Anonymity

Nowadays, privacy concerns are attracting more and more attention among governments, organizations, and individuals, and anonymous privacy-preserving authentication protocols are of particular interest. This is because the violation of user anonymity, say the leakage of some user-specific (static) information, may facilitate a malicious adversary to track the victim’s current activities and login history [7, 39]. Generally, there are two kinds of user anonymity attributes, basic and advanced [7]: (i) user ID protection, which means A cannot obtain the real ID of the user; (ii) user untraceability, which means A is unable to tell who the user is and distinguish whether two communications are coming from the same user. In wireless sensor networks, the latter notion has been widely adopted (e.g., [40–42]), so does Amin et al.’s scheme.In 2014, Das et al. [43] firstly introduced a “dynamic ID technique” to achieve user anonymity: a user’s real ID is concealed in the session-variant pseudonym identities. Subsequently, many schemes (e.g., [25, 44, 45]) follow this technique, which are so-called “dynamic ID” schemes, and Amin et al.’s scheme [8] falls into this category. However, after careful analysis, we find that Amin et al.’s scheme cannot achieve user anonymity in practice. To be specific, in the login phase of their scheme, Amin et al. try to compute a pseudonym identity PIDi=h(IDi∥b2) as a dynamic identity. On one hand, PIDi is specific to the legitimate user Ui; on the other hand, PIDi is kept static and transmitted in plain of all the Ui’s login messages {Gi,Fi,Zi,PIDi,Ti}.Accordingly, this specific valuePIDi can be seen as Ui’s “identification”, and thus A can exploit it to identify and track Ui in the whole system. To conduct the aforementioned attack, an adversary A only needs to eavesdrop the transmission channel without other contact operations and computations. This well serves to show the violation of user anonymity on Amin et al.’s scheme [8], thereby contradicting their claim.


#### 3.2.2. Smart Card Loss Attack

Amin et al. [8] showed that, in Xue et al.’s protocol [37], users’ passwords can be offline guessed once A has somehow obtained (lost or stolen) the victim’s smart card and extracted the stored secret information. Then Amin et al. attempt to overcome this pitfall in their new proposed scheme. However, precisely the same deficiency still exits in Amin et al.’s enhanced version. Let us consider the following scenario, suppose that A has obtained the secret parameters {Ci,Ei,DP,bbi,h(·)} stored in Ui’s smart card (e.g., by side-channel attack [46–48] and reverse engineering technique [49]), which is reasonable under assumption (3). Then A can conduct the following procedure to guess Ui’s password.Step 1.
Choose a pair of (IDi∗,PWi∗) from the identity space Did and password space Dpw.Step 2.
Computeb1=DP⊕h(IDi∗∥PWi∗), Ai=h(PWi∗∥b1), b2=bbi⊕Ai, PIDi=h(IDi∗∥b2), and Ci∗=h(Ai∥PIDi).Step 3.
Verify whether the computedCi∗ equals the extracted Ci.Step 4.
Repeat Steps 1, 2, and 3 until finding the correct values.Let|Did| and |Dpw| denote the size of Did and Dpw, and the time complexity of the aforementioned attack is O(4TH×|Did|×|Dpw|), which is linearly associated with the running time of Hash operation and can be finished in a few days as the limited size of |Did|≤|Dpw|≤106 [29, 30].Further, according to assumption (1),A is capable of eavesdropping and intercepting the normal (previous successful) login message {Gi,Fi,Zi,PIDi,Ti} between Ui and Sj over the public channel. It is fair to assume that A has already obtained the correct value of PIDi, then Step 2 might be changed to compute b1, Ai, b2, and PIDi∗ and compared the computed PIDi∗ with the intercepted PIDi in Step 3. In this way, the time complexity of the above procedure reduces to O(3TH×|Did|×|Dpw|), where the exclusive and concatenation operations are too small to overlook.Note that both of the above two attacks are carried outoffline without any interaction with the control server. Hence, there is no way forCS to find abnormality and the adversary A can impersonate Ui at anytime untilCS revokes the victim’s smart card. All in all, our analysis demonstrates the feasibility of smart card loss attack on Amin et al.’s scheme [8].


#### 3.2.3. The Violation of Forward Secrecy

As mentioned in Section2.2.2, Amin et al.’s scheme [8] also subjects to node capture attack. In such cases, the captured nodes may enable an adversary to compromise communications between other noncaptured nodes or obtain previous session keys. We will show this pitfall in this subsection. Assume that a malicious adversary A has compromised a cloud server Sk and extracted the secret parameters {BSj,d} stored in its memory, A can recover the previous session key as follows.Step 1.
Intercept the message{Ji,Ki,Pk,Gi,Fi,Zi,PIDi,Ti,Tk} sending from Sk to CS.Step 2.
ComputeNk=BSk⊕Ji, where BSk is extracted from the compromised node Sk.Step 3.
Intercept the message{Pcs,Rcs,Qcs,Vcs} sending from CS to Sk.Step 4.
ComputeNi⊕Ncs=Rcs⊕h(BSk∥Nk).Step 5.
Compute the session keySK=h(Nk⊕Ni⊕Ncs).In light ofNk and Ni⊕Ncs which are all correct values, A manages to find the previous session key. Hence, the desirable property of forward secrecy can not be attained by Amin et al.’s scheme [8]. Similar to Li et al.’s scheme [25], this also due to the violation of “PFS principle”. Except the ECC technique mentioned before, we suggest this issue to be well addressed by introducing another high-efficiency technique, i.e., Chebyshev polynomials semigroup property (so-called chaotic maps).For this property, givenx, Tu(x), and Tv(x), it is intractable to find TuTv(x), where x is a variable and u,v denote the integer degree [45]. Assume the control server chooses and writes a variable value x in each user’s smart card in the registration phase. Then we slightly modify the random numbers Ni to be TNi(x) and Nk to be TNk(x), and thus the session key can be calculated as SK=h(TNi(x)∥TNk(x)∥TNiTNk(x)). For higher security, it is better to involve other secret parameters such as IDi, SIDj. In this way, the improvement of Amin et al.’s scheme [8] can achieve perfect forward secrecy based on computational Diffie-Hellman problem.


#### 3.2.4. Mistakes in the Proof

Similarly, the security proof in Amin et al.’s scheme [8] does not capture realistic security threat. There are three main reasons: (1) The error of initial hypothesis. In the formal proof of Amin et al.’s scheme [8], they make an assumption A11: Sj|≡Ui↔SKSj, which is the same asGoal 3. This demonstrates that the proof ofGoal 3 is not necessary. (2) The wrong usage of logic rules. We take Step S2 as an example. This step is based on the message meaning rule and derives that Sj believes Ui said Ni from A11 and S1. However, according to the message meaning rule, we cannot obtain this conclusion from A11. Hence, A11 should be changed to Sj|≡Ui↔DiSj. (3) Using undefined new rules. Amin et al. [8] also employ a newsession keys rule, but they did not give a definition of the new rule.


## 3.1. Review of Amin et al.’s Scheme

Here we briefly review the scheme proposed by Amin et al. [8], an enhancement over Xue et al.’s scheme [37] and Chuang et al.’s scheme [38].


### 3.1.1. Registration Phase

The registration phase of Amin et al.’s scheme can be divided into cloud server registration and user registration.Cloud Server Registration Phase. In this phase, any cloud server Sj sends a self-chosen identity and random number pair {SIDj,d} to control server (CS). ThenCS chooses a random number y, computes Pj=h(SIDj∥d), BSj=h(Pj∥y), and responds {BSj} to Sj securely. Finally, Sj stores {BSj,d} in the memory.User Registration Phase. Firstly, a user Ui chooses his/her identity IDi, password PWi, and two random numbers <b1,b2>. Then Ui computes Ai=h(PWi∥b1), PIDi=h(IDi∥b2), and bbi=b2⊕Ai and sends {Ai,PIDi} toCS via secure channel. Upon receiving the registration request, theCS computes Ci=h(Ai∥PIDi), Di=h(PIDi∥x), and Ei=Di⊕Ai with its secret key. Finally,CS replies Ui a smart card with {Ci,Ei,h(·)}. After getting the smart card SC, Ui computes DP=h(IDi∥PWi)⊕b1 and records DP, bbi into it.


### 3.1.2. Login and Authentication Phase

In order to access remote server resources, a legal userUi inserts his/her smart card into a card reader and inputs IDi, PWi. Then the following steps are performed:(1)SC computes b1=DP⊕h(IDi∥PWi), Ai=h(PWi∥b1), b2=bbi⊕Ai, PIDi=h(IDi∥b2), and Ci∗=h(Ai∥PIDi) and verifies whether Ci∗=?Ci. If so,SC selects a random number Ni and computes Di=Ei⊕Ai, Gi=h(PIDi∥SIDj∥Ni∥Ti∥Di), Fi=Di⊕Ni, and Zi=SIDj⊕h(Di∥Ni), where SIDj is Sj’s identity chosen by Ui and Ti is the current timestamp. Otherwise,SC terminates the session.(2)Ui→Sj:{Gi,Fi,Zi,PIDi,Ti}.(3) Upon receiving the login request,Sj checks whether |Tj-Ti|<ΔT holds, where Tj is Sj’s current timestamp and ΔT is the expected valid time interval. If it does not hold, Sj rejects the connection. Otherwise, Sj produces a random number Nj and computes Ji=BSj⊕Nj, Ki=h(Nj∥BSj∥Gi∥Tj).(4)Sj→CS:{Ji,Ki,Pj,Gi,Fi,Zi,PIDi,Ti,Tj}.(5) Once receiving the message fromSj,CS first checks the validity of time interval |Tcs-Tj|<ΔT. If the verification holds,CS continues to compute Di=h(PIDi∥x), Ni=Fi⊕Di, SIDj=Zi⊕h(Di∥Ni), and Gi∗=h(PIDi∥SIDj∥Ni∥Ti∥Di) and checks whether Gi∗=?Gi. If either of the above verification fails,CS terminates the procedure. Otherwise,CS keeps on calculating BSj=h(Pj∥y), Nj=BSj⊕Ji, and Ki∗=h(Nj∥BSj∥Gi∥Tj) and verifies whether the computed Ki∗ equals the received one. If not,CS aborts the session. Otherwise,CS chooses a random number Ncs and computes Pcs=Nj⊕Ncs⊕h(Ni∥Di), Rcs=Ni⊕Ncs⊕h(BSj∥Nj), SKcs=h(Ni⊕Nj⊕Ncs), Qcs=h((Nj⊕Ncs)∥SKcs), and Vcs=h((Ni∥Ncs)∥SKcs).(6)CS→Sj:{Pcs,Rcs,Qcs,Vcs}.(7) While receiving the message fromCS, Sj computes Wj=h(BSj∥Nj), Ni⊕Ncs=Rcs⊕Wj, SKj=h(Ni⊕Nj⊕Ncs), and Vcs∗=h((Ni∥Ncs)∥SKj) and checks the condition Vcs∗=?Vcs holds or not. If it does not hold, Sj terminates the connection. Otherwise, Sj sends {Pcs,Qcs} to Ui via public channel.(8) After receiving the response message fromSj, Ui computes Li=h(Ni∥Di), Nj⊕Ncs=Pcs⊕Li, SKi=h(Ni⊕Nj⊕Ncs), and Qcs∗=h((Nj⊕Ncs)∥SKcs) and verifies whether Qcs∗=?Qcs. If so, Ui successfully authenticates Sj and CS and establish a session key SKi=SKj=SKcs.


## 3.1.1. Registration Phase

The registration phase of Amin et al.’s scheme can be divided into cloud server registration and user registration.Cloud Server Registration Phase. In this phase, any cloud server Sj sends a self-chosen identity and random number pair {SIDj,d} to control server (CS). ThenCS chooses a random number y, computes Pj=h(SIDj∥d), BSj=h(Pj∥y), and responds {BSj} to Sj securely. Finally, Sj stores {BSj,d} in the memory.User Registration Phase. Firstly, a user Ui chooses his/her identity IDi, password PWi, and two random numbers <b1,b2>. Then Ui computes Ai=h(PWi∥b1), PIDi=h(IDi∥b2), and bbi=b2⊕Ai and sends {Ai,PIDi} toCS via secure channel. Upon receiving the registration request, theCS computes Ci=h(Ai∥PIDi), Di=h(PIDi∥x), and Ei=Di⊕Ai with its secret key. Finally,CS replies Ui a smart card with {Ci,Ei,h(·)}. After getting the smart card SC, Ui computes DP=h(IDi∥PWi)⊕b1 and records DP, bbi into it.


## 3.1.2. Login and Authentication Phase

In order to access remote server resources, a legal userUi inserts his/her smart card into a card reader and inputs IDi, PWi. Then the following steps are performed:(1)SC computes b1=DP⊕h(IDi∥PWi), Ai=h(PWi∥b1), b2=bbi⊕Ai, PIDi=h(IDi∥b2), and Ci∗=h(Ai∥PIDi) and verifies whether Ci∗=?Ci. If so,SC selects a random number Ni and computes Di=Ei⊕Ai, Gi=h(PIDi∥SIDj∥Ni∥Ti∥Di), Fi=Di⊕Ni, and Zi=SIDj⊕h(Di∥Ni), where SIDj is Sj’s identity chosen by Ui and Ti is the current timestamp. Otherwise,SC terminates the session.(2)Ui→Sj:{Gi,Fi,Zi,PIDi,Ti}.(3) Upon receiving the login request,Sj checks whether |Tj-Ti|<ΔT holds, where Tj is Sj’s current timestamp and ΔT is the expected valid time interval. If it does not hold, Sj rejects the connection. Otherwise, Sj produces a random number Nj and computes Ji=BSj⊕Nj, Ki=h(Nj∥BSj∥Gi∥Tj).(4)Sj→CS:{Ji,Ki,Pj,Gi,Fi,Zi,PIDi,Ti,Tj}.(5) Once receiving the message fromSj,CS first checks the validity of time interval |Tcs-Tj|<ΔT. If the verification holds,CS continues to compute Di=h(PIDi∥x), Ni=Fi⊕Di, SIDj=Zi⊕h(Di∥Ni), and Gi∗=h(PIDi∥SIDj∥Ni∥Ti∥Di) and checks whether Gi∗=?Gi. If either of the above verification fails,CS terminates the procedure. Otherwise,CS keeps on calculating BSj=h(Pj∥y), Nj=BSj⊕Ji, and Ki∗=h(Nj∥BSj∥Gi∥Tj) and verifies whether the computed Ki∗ equals the received one. If not,CS aborts the session. Otherwise,CS chooses a random number Ncs and computes Pcs=Nj⊕Ncs⊕h(Ni∥Di), Rcs=Ni⊕Ncs⊕h(BSj∥Nj), SKcs=h(Ni⊕Nj⊕Ncs), Qcs=h((Nj⊕Ncs)∥SKcs), and Vcs=h((Ni∥Ncs)∥SKcs).(6)CS→Sj:{Pcs,Rcs,Qcs,Vcs}.(7) While receiving the message fromCS, Sj computes Wj=h(BSj∥Nj), Ni⊕Ncs=Rcs⊕Wj, SKj=h(Ni⊕Nj⊕Ncs), and Vcs∗=h((Ni∥Ncs)∥SKj) and checks the condition Vcs∗=?Vcs holds or not. If it does not hold, Sj terminates the connection. Otherwise, Sj sends {Pcs,Qcs} to Ui via public channel.(8) After receiving the response message fromSj, Ui computes Li=h(Ni∥Di), Nj⊕Ncs=Pcs⊕Li, SKi=h(Ni⊕Nj⊕Ncs), and Qcs∗=h((Nj⊕Ncs)∥SKcs) and verifies whether Qcs∗=?Qcs. If so, Ui successfully authenticates Sj and CS and establish a session key SKi=SKj=SKcs.


## 3.2. Cryptanalysis of Amin et al.’s Scheme

The four assumptions made in Section2.2 are also explicitly employed in Amin et al.’s work [8] when they analyze the security of Xue et al.’s scheme [37] and Chuang et al.’s scheme [38] and proof the safety of their scheme. Consequently, our following discussions will base on these four assumptions.


### 3.2.1. No Provision of User Anonymity

Nowadays, privacy concerns are attracting more and more attention among governments, organizations, and individuals, and anonymous privacy-preserving authentication protocols are of particular interest. This is because the violation of user anonymity, say the leakage of some user-specific (static) information, may facilitate a malicious adversary to track the victim’s current activities and login history [7, 39]. Generally, there are two kinds of user anonymity attributes, basic and advanced [7]: (i) user ID protection, which means A cannot obtain the real ID of the user; (ii) user untraceability, which means A is unable to tell who the user is and distinguish whether two communications are coming from the same user. In wireless sensor networks, the latter notion has been widely adopted (e.g., [40–42]), so does Amin et al.’s scheme.In 2014, Das et al. [43] firstly introduced a “dynamic ID technique” to achieve user anonymity: a user’s real ID is concealed in the session-variant pseudonym identities. Subsequently, many schemes (e.g., [25, 44, 45]) follow this technique, which are so-called “dynamic ID” schemes, and Amin et al.’s scheme [8] falls into this category. However, after careful analysis, we find that Amin et al.’s scheme cannot achieve user anonymity in practice. To be specific, in the login phase of their scheme, Amin et al. try to compute a pseudonym identity PIDi=h(IDi∥b2) as a dynamic identity. On one hand, PIDi is specific to the legitimate user Ui; on the other hand, PIDi is kept static and transmitted in plain of all the Ui’s login messages {Gi,Fi,Zi,PIDi,Ti}.Accordingly, this specific valuePIDi can be seen as Ui’s “identification”, and thus A can exploit it to identify and track Ui in the whole system. To conduct the aforementioned attack, an adversary A only needs to eavesdrop the transmission channel without other contact operations and computations. This well serves to show the violation of user anonymity on Amin et al.’s scheme [8], thereby contradicting their claim.


### 3.2.2. Smart Card Loss Attack

Amin et al. [8] showed that, in Xue et al.’s protocol [37], users’ passwords can be offline guessed once A has somehow obtained (lost or stolen) the victim’s smart card and extracted the stored secret information. Then Amin et al. attempt to overcome this pitfall in their new proposed scheme. However, precisely the same deficiency still exits in Amin et al.’s enhanced version. Let us consider the following scenario, suppose that A has obtained the secret parameters {Ci,Ei,DP,bbi,h(·)} stored in Ui’s smart card (e.g., by side-channel attack [46–48] and reverse engineering technique [49]), which is reasonable under assumption (3). Then A can conduct the following procedure to guess Ui’s password.Step 1.
Choose a pair of (IDi∗,PWi∗) from the identity space Did and password space Dpw.Step 2.
Computeb1=DP⊕h(IDi∗∥PWi∗), Ai=h(PWi∗∥b1), b2=bbi⊕Ai, PIDi=h(IDi∗∥b2), and Ci∗=h(Ai∥PIDi).Step 3.
Verify whether the computedCi∗ equals the extracted Ci.Step 4.
Repeat Steps 1, 2, and 3 until finding the correct values.Let|Did| and |Dpw| denote the size of Did and Dpw, and the time complexity of the aforementioned attack is O(4TH×|Did|×|Dpw|), which is linearly associated with the running time of Hash operation and can be finished in a few days as the limited size of |Did|≤|Dpw|≤106 [29, 30].Further, according to assumption (1),A is capable of eavesdropping and intercepting the normal (previous successful) login message {Gi,Fi,Zi,PIDi,Ti} between Ui and Sj over the public channel. It is fair to assume that A has already obtained the correct value of PIDi, then Step 2 might be changed to compute b1, Ai, b2, and PIDi∗ and compared the computed PIDi∗ with the intercepted PIDi in Step 3. In this way, the time complexity of the above procedure reduces to O(3TH×|Did|×|Dpw|), where the exclusive and concatenation operations are too small to overlook.Note that both of the above two attacks are carried outoffline without any interaction with the control server. Hence, there is no way forCS to find abnormality and the adversary A can impersonate Ui at anytime untilCS revokes the victim’s smart card. All in all, our analysis demonstrates the feasibility of smart card loss attack on Amin et al.’s scheme [8].


### 3.2.3. The Violation of Forward Secrecy

As mentioned in Section2.2.2, Amin et al.’s scheme [8] also subjects to node capture attack. In such cases, the captured nodes may enable an adversary to compromise communications between other noncaptured nodes or obtain previous session keys. We will show this pitfall in this subsection. Assume that a malicious adversary A has compromised a cloud server Sk and extracted the secret parameters {BSj,d} stored in its memory, A can recover the previous session key as follows.Step 1.
Intercept the message{Ji,Ki,Pk,Gi,Fi,Zi,PIDi,Ti,Tk} sending from Sk to CS.Step 2.
ComputeNk=BSk⊕Ji, where BSk is extracted from the compromised node Sk.Step 3.
Intercept the message{Pcs,Rcs,Qcs,Vcs} sending from CS to Sk.Step 4.
ComputeNi⊕Ncs=Rcs⊕h(BSk∥Nk).Step 5.
Compute the session keySK=h(Nk⊕Ni⊕Ncs).In light ofNk and Ni⊕Ncs which are all correct values, A manages to find the previous session key. Hence, the desirable property of forward secrecy can not be attained by Amin et al.’s scheme [8]. Similar to Li et al.’s scheme [25], this also due to the violation of “PFS principle”. Except the ECC technique mentioned before, we suggest this issue to be well addressed by introducing another high-efficiency technique, i.e., Chebyshev polynomials semigroup property (so-called chaotic maps).For this property, givenx, Tu(x), and Tv(x), it is intractable to find TuTv(x), where x is a variable and u,v denote the integer degree [45]. Assume the control server chooses and writes a variable value x in each user’s smart card in the registration phase. Then we slightly modify the random numbers Ni to be TNi(x) and Nk to be TNk(x), and thus the session key can be calculated as SK=h(TNi(x)∥TNk(x)∥TNiTNk(x)). For higher security, it is better to involve other secret parameters such as IDi, SIDj. In this way, the improvement of Amin et al.’s scheme [8] can achieve perfect forward secrecy based on computational Diffie-Hellman problem.


### 3.2.4. Mistakes in the Proof

Similarly, the security proof in Amin et al.’s scheme [8] does not capture realistic security threat. There are three main reasons: (1) The error of initial hypothesis. In the formal proof of Amin et al.’s scheme [8], they make an assumption A11: Sj|≡Ui↔SKSj, which is the same asGoal 3. This demonstrates that the proof ofGoal 3 is not necessary. (2) The wrong usage of logic rules. We take Step S2 as an example. This step is based on the message meaning rule and derives that Sj believes Ui said Ni from A11 and S1. However, according to the message meaning rule, we cannot obtain this conclusion from A11. Hence, A11 should be changed to Sj|≡Ui↔DiSj. (3) Using undefined new rules. Amin et al. [8] also employ a newsession keys rule, but they did not give a definition of the new rule.


## 3.2.1. No Provision of User Anonymity

Nowadays, privacy concerns are attracting more and more attention among governments, organizations, and individuals, and anonymous privacy-preserving authentication protocols are of particular interest. This is because the violation of user anonymity, say the leakage of some user-specific (static) information, may facilitate a malicious adversary to track the victim’s current activities and login history [7, 39]. Generally, there are two kinds of user anonymity attributes, basic and advanced [7]: (i) user ID protection, which means A cannot obtain the real ID of the user; (ii) user untraceability, which means A is unable to tell who the user is and distinguish whether two communications are coming from the same user. In wireless sensor networks, the latter notion has been widely adopted (e.g., [40–42]), so does Amin et al.’s scheme.In 2014, Das et al. [43] firstly introduced a “dynamic ID technique” to achieve user anonymity: a user’s real ID is concealed in the session-variant pseudonym identities. Subsequently, many schemes (e.g., [25, 44, 45]) follow this technique, which are so-called “dynamic ID” schemes, and Amin et al.’s scheme [8] falls into this category. However, after careful analysis, we find that Amin et al.’s scheme cannot achieve user anonymity in practice. To be specific, in the login phase of their scheme, Amin et al. try to compute a pseudonym identity PIDi=h(IDi∥b2) as a dynamic identity. On one hand, PIDi is specific to the legitimate user Ui; on the other hand, PIDi is kept static and transmitted in plain of all the Ui’s login messages {Gi,Fi,Zi,PIDi,Ti}.Accordingly, this specific valuePIDi can be seen as Ui’s “identification”, and thus A can exploit it to identify and track Ui in the whole system. To conduct the aforementioned attack, an adversary A only needs to eavesdrop the transmission channel without other contact operations and computations. This well serves to show the violation of user anonymity on Amin et al.’s scheme [8], thereby contradicting their claim.


## 3.2.2. Smart Card Loss Attack

Amin et al. [8] showed that, in Xue et al.’s protocol [37], users’ passwords can be offline guessed once A has somehow obtained (lost or stolen) the victim’s smart card and extracted the stored secret information. Then Amin et al. attempt to overcome this pitfall in their new proposed scheme. However, precisely the same deficiency still exits in Amin et al.’s enhanced version. Let us consider the following scenario, suppose that A has obtained the secret parameters {Ci,Ei,DP,bbi,h(·)} stored in Ui’s smart card (e.g., by side-channel attack [46–48] and reverse engineering technique [49]), which is reasonable under assumption (3). Then A can conduct the following procedure to guess Ui’s password.Step 1.
Choose a pair of (IDi∗,PWi∗) from the identity space Did and password space Dpw.Step 2.
Computeb1=DP⊕h(IDi∗∥PWi∗), Ai=h(PWi∗∥b1), b2=bbi⊕Ai, PIDi=h(IDi∗∥b2), and Ci∗=h(Ai∥PIDi).Step 3.
Verify whether the computedCi∗ equals the extracted Ci.Step 4.
Repeat Steps 1, 2, and 3 until finding the correct values.Let|Did| and |Dpw| denote the size of Did and Dpw, and the time complexity of the aforementioned attack is O(4TH×|Did|×|Dpw|), which is linearly associated with the running time of Hash operation and can be finished in a few days as the limited size of |Did|≤|Dpw|≤106 [29, 30].Further, according to assumption (1),A is capable of eavesdropping and intercepting the normal (previous successful) login message {Gi,Fi,Zi,PIDi,Ti} between Ui and Sj over the public channel. It is fair to assume that A has already obtained the correct value of PIDi, then Step 2 might be changed to compute b1, Ai, b2, and PIDi∗ and compared the computed PIDi∗ with the intercepted PIDi in Step 3. In this way, the time complexity of the above procedure reduces to O(3TH×|Did|×|Dpw|), where the exclusive and concatenation operations are too small to overlook.Note that both of the above two attacks are carried outoffline without any interaction with the control server. Hence, there is no way forCS to find abnormality and the adversary A can impersonate Ui at anytime untilCS revokes the victim’s smart card. All in all, our analysis demonstrates the feasibility of smart card loss attack on Amin et al.’s scheme [8].


## 3.2.3. The Violation of Forward Secrecy

As mentioned in Section2.2.2, Amin et al.’s scheme [8] also subjects to node capture attack. In such cases, the captured nodes may enable an adversary to compromise communications between other noncaptured nodes or obtain previous session keys. We will show this pitfall in this subsection. Assume that a malicious adversary A has compromised a cloud server Sk and extracted the secret parameters {BSj,d} stored in its memory, A can recover the previous session key as follows.Step 1.
Intercept the message{Ji,Ki,Pk,Gi,Fi,Zi,PIDi,Ti,Tk} sending from Sk to CS.Step 2.
ComputeNk=BSk⊕Ji, where BSk is extracted from the compromised node Sk.Step 3.
Intercept the message{Pcs,Rcs,Qcs,Vcs} sending from CS to Sk.Step 4.
ComputeNi⊕Ncs=Rcs⊕h(BSk∥Nk).Step 5.
Compute the session keySK=h(Nk⊕Ni⊕Ncs).In light ofNk and Ni⊕Ncs which are all correct values, A manages to find the previous session key. Hence, the desirable property of forward secrecy can not be attained by Amin et al.’s scheme [8]. Similar to Li et al.’s scheme [25], this also due to the violation of “PFS principle”. Except the ECC technique mentioned before, we suggest this issue to be well addressed by introducing another high-efficiency technique, i.e., Chebyshev polynomials semigroup property (so-called chaotic maps).For this property, givenx, Tu(x), and Tv(x), it is intractable to find TuTv(x), where x is a variable and u,v denote the integer degree [45]. Assume the control server chooses and writes a variable value x in each user’s smart card in the registration phase. Then we slightly modify the random numbers Ni to be TNi(x) and Nk to be TNk(x), and thus the session key can be calculated as SK=h(TNi(x)∥TNk(x)∥TNiTNk(x)). For higher security, it is better to involve other secret parameters such as IDi, SIDj. In this way, the improvement of Amin et al.’s scheme [8] can achieve perfect forward secrecy based on computational Diffie-Hellman problem.


## 3.2.4. Mistakes in the Proof

Similarly, the security proof in Amin et al.’s scheme [8] does not capture realistic security threat. There are three main reasons: (1) The error of initial hypothesis. In the formal proof of Amin et al.’s scheme [8], they make an assumption A11: Sj|≡Ui↔SKSj, which is the same asGoal 3. This demonstrates that the proof ofGoal 3 is not necessary. (2) The wrong usage of logic rules. We take Step S2 as an example. This step is based on the message meaning rule and derives that Sj believes Ui said Ni from A11 and S1. However, according to the message meaning rule, we cannot obtain this conclusion from A11. Hence, A11 should be changed to Sj|≡Ui↔DiSj. (3) Using undefined new rules. Amin et al. [8] also employ a newsession keys rule, but they did not give a definition of the new rule.


## 4. Cryptanalysis of Wu et al.’s Scheme

In this section, we will review and analyze Wu et al.’s scheme [9], which is a lightweight and relatively robust two-factor authentication scheme for wireless medical sensor networks. In [9], Wu et al. have found some security pitfalls in historical schemes and attempted to overcome all these flaws in the new proposed one. Besides, Wu et al. [9] use NS-3, a simulation tool to prove the security of their proposed protocol. Note that, the simulation process can only prove the validity of their protocol, including the viable communication between the sensor node and the user, the probable communication time, system size, etc. However, it can not prove whether their protocol resists against various known attacks. In the following section, we find Wu et al.’s improved scheme still fails to attain the most important goal of forward secrecy and is prone to user friendliness issue.


### 4.1. Review of Wu et al.’s Scheme

This subsection briefly reviews Wu et al.’s [9] scheme, which involves four critical phases: registration, login, authentication and password change, and a previous initialization. We simplify initialization phase in the registration phase.


#### 4.1.1. Registration Phase

Initially,GWN is equipped with an identity GID and its own secret key G. The registration phase is further divided into sensor node registration and user registration.Sensor Node Registration Phase. Each sensor node Sj chooses an identity SIDj and sends toGWN via a secure channel. ThenGWN decides to deploy it in a sensor set numbered Nl and computes the secret key SG=h(SIDj∥G∥Nl). Finally, {SIDj,SG,GID} is injected to the memory of Sj and (SIDj,Nl) is stored in the database ofGWN.User Registration Phase. In this phase, Ui first selects an identity IDi, a password PWi, and a nonce r0, and then(1)Ui computes HPWi=h(PWi∥r0);(2)Ui⇒GWN: {IDi,HPWi};(3)GWN checks if IDi has already existed in the database. If so, it denies the registration request. Otherwise,GWN chooses a pseudoidentity CIDi and computes A1=h(CIDi∥GID∥G)⊕HPWi and A2=h(IDi∥G)⊕h(IDi∥HPWi) and then stores IDi in database;(4)GWN⇒Ui: a smart card contains sensitive parameters {A1,A2,CIDi,GID};(5) after receiving the message,Ui computes A3=h(IDi∥PWi)⊕r0 and inserts it into SC.


#### 4.1.2. Login and Authentication Phase

U i conducts the following procedures to access sensitive information of the target sensor Sj:(1)Ui inputs IDi and PWi to the smart card. Then SC computes r0=A3⊕h(IDi∥PWi) and HPWi=h(PWi∥r0). SC chooses a random number ru and the required sensor node SIDj and further computes B1=A1⊕HPWi=h(CIDi∥GID∥G), B2=B1⊕ru, B3=IDi⊕h(ru∥B1), and B4=h(CIDi∥GID∥SIDj∥B1∥IDi∥ru).(2)Ui→GWN: {CIDi,GID,SIDj,B2,B3,B4}.(3) When receiving the message fromUi,GWN first checks if GID is correct. If so,GWN computes B1=h(CIDi∥GID∥G), ru=B1⊕B2, and IDi=B3⊕h(ru∥B1) and verifies whether IDi is in the database and B4=?h(CIDi∥GID∥SIDj∥B1∥IDi∥ru). If either of the two verifications does not hold,GWN will terminate the session. Otherwise,GWN searches (SIDj,Nl) from the database, generates a random number rg, and computes SG=h(SIDj∥G∥Nl), B5=h(SG∥GID)⊕ru, B6=h(ru)⊕rg, and B7=h(SG∥ru∥rg).(4)GWN→Sj:{SIDj,B5,B6,B7}.(5) Once receiving the message, the corresponding nodeSj checks if SIDj is correct and computes ru=B5⊕h(SG∥GID) and rg=B6⊕h(ru). Then Sj verifies whether B7=?h(SG∥ru∥rg). If either is incorrect, Sj rejects the session. Otherwise, Sj generates rs and computes sks=h(ru∥rg∥rs), B8=h(SG∥rg)⊕rs, and B9=h(sks∥SIDj∥GID∥rs).(6)Sj→GWN: {B8,B9}.(7) Once received the response message,GWN computes rs=B8⊕h(SG∥rg), skg=h(ru∥rg∥rs) and checks whether B9=?h(skg∥SIDj∥GID∥rs). If so,GWN chooses a new pseudoidentity CIDinew and calculates B10=h(CIDinew∥GID∥G)⊕h(ru∥CIDi), B11=h(ru∥IDi)⊕rg, B12=h(ru∥rg)⊕rs, B13=h(h(IDi∥G)∥rs)⊕CIDinew, and B14=h(skg∥IDi∥B10∥CIDinew).(8)GWN→Ui:{B10,B11,B12,B13,B14}.(9) When receiving the response message,SC computes rg=B11⊕h(ru∥IDi), rs=B12⊕h(ru∥rg), sku=h(ru∥rg∥rs), and CIDinew=B13⊕h((A2⊕h(IDi∥HPWi))∥rs) and verifies whether B14=?h(sku∥IDi∥B10∥CIDinew). If it is equal, SC computes A1new=B10⊕h(ru∥CIDi)⊕HPWi and replaces (A1,CIDi) with (A1new,CIDinew).


### 4.2. Cryptanalysis of Wu et al.’s Scheme

Due to its simplicity and admirable provision of user anonymity, Wu et al.’s scheme [9] exhibits great application prospects, and yet there are still some security pitfalls being overlooked by Wu et al. In the following, we will demonstrate that Wu et al.’s scheme [9] has some user friendliness issue and fails to achieve the critical property of forward security.


#### 4.2.1. No Provision of User Friendliness

According to the collected data from Dashlane [56], “we are online hoarders” that the average user maintains over 107 accounts registered to one email address and this figure will rise to 207 by 2020. This statistical shows that users are creating and virtually stashing more online account information than ever, which leads to an insanely high number of accounts to manage. In that case, freely password change is a recommended practice, for users have to reset a forgotten password (an average of 37 accounts [56]) and the fixed password is definitely vulnerable. Moreover, users may make a slip in writing passwords or identities; the rapid response and decisive action are quite necessary for a user friendly authentication protocol.Early in 1968, Robert Miller [57] published a classic paper about response time in man-computer conversational transactions, which pointed out that “response times exceed 10 seconds will completely lose the user’s attention”. In this way, locally secure password change, i.e., providing an explicit and secure process to verify the correctness of user-keyed password in smart card, is essential. That is, the smart card has no need to interact with remote server in user input and password changing phases. However, as stated above, both Li et al.’s scheme [25] and Amin et al.’s scheme [8] provide local password change, but their strategies introduce new vulnerabilities-offline dictionary attack.Back to Wu et al.’s scheme [9], there is no verifier in the smart card, which means their scheme even cannot provide timely detection mechanism and reasonable password change. Fortunately, Wang et al. [10] introduced a “fuzzy verifier” technique to effectively solve this security-usability issue. In the following, we will take Wu et al.’s scheme [9] as an example to show this strategy. Firstly, Ui submits {IDi,HPWi} toGWN in the registration phase. ThenGWN computes Ai=h((h(IDi)⊕HPWi))mod n) and stores it in Ui’s smart card, where n denotes the size of (ID,PW) pool and 26≤n≤28. Assume |Did|≈|Dpw|≈106 and n=28 [29, 30], we can be assured that there have the possibilities of |Did|×|Did|/n≈232 identity and password pairs to thwart the adversary from guessing out the correct password.The same considerations can also be applied to Li et al.’s scheme [25] and Amin et al.’s scheme [8]. The large-scale candidates will effectively frustrate A from random guessing the password by a brute force method as well as providing a timely detection of the mistyped identity or password.


#### 4.2.2. The Violation of Forward Secrecy

Forward secrecy is an important property, for the unattended environment and security-critical applications in wireless sensor networks [7, 11]. In [9], Wu et al. explicitly stated that “the sensor nodes may be captured by the intruder”, which accords with assumption (4) made in Section 2.2. Under this statement, we find that Wu et al.’s scheme cannot achieve the forward secrecy. Once a sensor node Sk has been compromised, the stored information SG might be obtained by A and the following attacks can be launched.Step 1.
Intercept the message{CIDi,GID,SIDk,B2,B3,B4} sending from Ui toGWN and the message {SIDk,B5,B6,B7} sending fromGWN to Sk.Step 2.
Computeru=B5⊕h(SG∥GID), rg=B6⊕h(ru), where SG is extracted from the compromised node Sk.Step 3.
Intercept the message{B8,B9} sending fromGWN to Sk.Step 4.
Computers=B8⊕h(SG∥rg).Step 5.
Compute the session key=h(ru∥rg∥rs).The above attack demonstrates that once a sensor nodeSk has been captured, the previous sessions might be decoded. This is the same failure with Li et al.’s scheme [25] and Amin et al.’s scheme [8]. Besides the above two techniques (ECC cryptosystem and chaotic maps), we also suggest employing some other public-key cryptography techniques, such as Pairing [58] and RSA cryptosystem. Note that when using RSA cryptosystem to achieve forward secrecy, a new temporary RSA key must be generated by user side for each session [59].To demonstrate the necessity and effectiveness of our suggestions, we provide a comparison of 10 recently proposed schemes by assessing whether they achieve forward secrecy and what main technology do they use. The result are shown in Table2. One can see that only Das et al.’s scheme [52] successfully provides forward secrecy. This failure is mainly due to the fact that half of them (i.e., [8, 9, 51, 54]) only use Hash operation that are virtually impossible to provide forward secrecy (“PFS principle” [26]), yet the other 4 schemes (i.e., [25, 45, 50, 55]) that make use of public-key techniques (e.g., ECC, Chaotic maps, RSA) violate the principle that the random numbers must be generated by Ui and Sj separately and cannot be transmitted over the public channel.Table 2
Performance and security comparison.
Related schemes Computation cost on log-auth phases PFS Key technology Hash ECC C M ∗ RSA Li et al. (2018) [25] 21 T H + 3 T E × ✓ ✓ × × Amin et al. (2018) [8] 22 T H × ✓ × × × Wu et al. (2017) [9] 34 T H × ✓ × × × Roy et al. (2017) [45] 15 T H + 3 T C × ✓ × ✓ × Moon et al. (2017) [50] 11 T H + 2 T C × ✓ × ✓ × Srinivas et al. (2017) [51] 29 T H × ✓ × × × Das et al. (2016) [52] 31 T H + 4 T E ✓ ✓ ✓ × × Chang et al. (2016) [53] 20 T H × ✓ × × × Vaidya et al. (2016) [54] 29 T H × ✓ × × × Odelu et al. (2015) [55] 15 T H + 6 T M × ✓ × × ✓ N o t e 1. TH: one-time hash operation time; TE: elliptic curve point multiplication computation time; TC: running time of chaotic maps; TM: time for modular multiplication/division. N o t e 2. × means the corresponding scheme fails to achieve this property; CM denotes chaotic maps; PFS denotes perfect forward secrecy.


## 4.1. Review of Wu et al.’s Scheme

This subsection briefly reviews Wu et al.’s [9] scheme, which involves four critical phases: registration, login, authentication and password change, and a previous initialization. We simplify initialization phase in the registration phase.


### 4.1.1. Registration Phase

Initially,GWN is equipped with an identity GID and its own secret key G. The registration phase is further divided into sensor node registration and user registration.Sensor Node Registration Phase. Each sensor node Sj chooses an identity SIDj and sends toGWN via a secure channel. ThenGWN decides to deploy it in a sensor set numbered Nl and computes the secret key SG=h(SIDj∥G∥Nl). Finally, {SIDj,SG,GID} is injected to the memory of Sj and (SIDj,Nl) is stored in the database ofGWN.User Registration Phase. In this phase, Ui first selects an identity IDi, a password PWi, and a nonce r0, and then(1)Ui computes HPWi=h(PWi∥r0);(2)Ui⇒GWN: {IDi,HPWi};(3)GWN checks if IDi has already existed in the database. If so, it denies the registration request. Otherwise,GWN chooses a pseudoidentity CIDi and computes A1=h(CIDi∥GID∥G)⊕HPWi and A2=h(IDi∥G)⊕h(IDi∥HPWi) and then stores IDi in database;(4)GWN⇒Ui: a smart card contains sensitive parameters {A1,A2,CIDi,GID};(5) after receiving the message,Ui computes A3=h(IDi∥PWi)⊕r0 and inserts it into SC.


### 4.1.2. Login and Authentication Phase

U i conducts the following procedures to access sensitive information of the target sensor Sj:(1)Ui inputs IDi and PWi to the smart card. Then SC computes r0=A3⊕h(IDi∥PWi) and HPWi=h(PWi∥r0). SC chooses a random number ru and the required sensor node SIDj and further computes B1=A1⊕HPWi=h(CIDi∥GID∥G), B2=B1⊕ru, B3=IDi⊕h(ru∥B1), and B4=h(CIDi∥GID∥SIDj∥B1∥IDi∥ru).(2)Ui→GWN: {CIDi,GID,SIDj,B2,B3,B4}.(3) When receiving the message fromUi,GWN first checks if GID is correct. If so,GWN computes B1=h(CIDi∥GID∥G), ru=B1⊕B2, and IDi=B3⊕h(ru∥B1) and verifies whether IDi is in the database and B4=?h(CIDi∥GID∥SIDj∥B1∥IDi∥ru). If either of the two verifications does not hold,GWN will terminate the session. Otherwise,GWN searches (SIDj,Nl) from the database, generates a random number rg, and computes SG=h(SIDj∥G∥Nl), B5=h(SG∥GID)⊕ru, B6=h(ru)⊕rg, and B7=h(SG∥ru∥rg).(4)GWN→Sj:{SIDj,B5,B6,B7}.(5) Once receiving the message, the corresponding nodeSj checks if SIDj is correct and computes ru=B5⊕h(SG∥GID) and rg=B6⊕h(ru). Then Sj verifies whether B7=?h(SG∥ru∥rg). If either is incorrect, Sj rejects the session. Otherwise, Sj generates rs and computes sks=h(ru∥rg∥rs), B8=h(SG∥rg)⊕rs, and B9=h(sks∥SIDj∥GID∥rs).(6)Sj→GWN: {B8,B9}.(7) Once received the response message,GWN computes rs=B8⊕h(SG∥rg), skg=h(ru∥rg∥rs) and checks whether B9=?h(skg∥SIDj∥GID∥rs). If so,GWN chooses a new pseudoidentity CIDinew and calculates B10=h(CIDinew∥GID∥G)⊕h(ru∥CIDi), B11=h(ru∥IDi)⊕rg, B12=h(ru∥rg)⊕rs, B13=h(h(IDi∥G)∥rs)⊕CIDinew, and B14=h(skg∥IDi∥B10∥CIDinew).(8)GWN→Ui:{B10,B11,B12,B13,B14}.(9) When receiving the response message,SC computes rg=B11⊕h(ru∥IDi), rs=B12⊕h(ru∥rg), sku=h(ru∥rg∥rs), and CIDinew=B13⊕h((A2⊕h(IDi∥HPWi))∥rs) and verifies whether B14=?h(sku∥IDi∥B10∥CIDinew). If it is equal, SC computes A1new=B10⊕h(ru∥CIDi)⊕HPWi and replaces (A1,CIDi) with (A1new,CIDinew).


## 4.1.1. Registration Phase

Initially,GWN is equipped with an identity GID and its own secret key G. The registration phase is further divided into sensor node registration and user registration.Sensor Node Registration Phase. Each sensor node Sj chooses an identity SIDj and sends toGWN via a secure channel. ThenGWN decides to deploy it in a sensor set numbered Nl and computes the secret key SG=h(SIDj∥G∥Nl). Finally, {SIDj,SG,GID} is injected to the memory of Sj and (SIDj,Nl) is stored in the database ofGWN.User Registration Phase. In this phase, Ui first selects an identity IDi, a password PWi, and a nonce r0, and then(1)Ui computes HPWi=h(PWi∥r0);(2)Ui⇒GWN: {IDi,HPWi};(3)GWN checks if IDi has already existed in the database. If so, it denies the registration request. Otherwise,GWN chooses a pseudoidentity CIDi and computes A1=h(CIDi∥GID∥G)⊕HPWi and A2=h(IDi∥G)⊕h(IDi∥HPWi) and then stores IDi in database;(4)GWN⇒Ui: a smart card contains sensitive parameters {A1,A2,CIDi,GID};(5) after receiving the message,Ui computes A3=h(IDi∥PWi)⊕r0 and inserts it into SC.


## 4.1.2. Login and Authentication Phase

U i conducts the following procedures to access sensitive information of the target sensor Sj:(1)Ui inputs IDi and PWi to the smart card. Then SC computes r0=A3⊕h(IDi∥PWi) and HPWi=h(PWi∥r0). SC chooses a random number ru and the required sensor node SIDj and further computes B1=A1⊕HPWi=h(CIDi∥GID∥G), B2=B1⊕ru, B3=IDi⊕h(ru∥B1), and B4=h(CIDi∥GID∥SIDj∥B1∥IDi∥ru).(2)Ui→GWN: {CIDi,GID,SIDj,B2,B3,B4}.(3) When receiving the message fromUi,GWN first checks if GID is correct. If so,GWN computes B1=h(CIDi∥GID∥G), ru=B1⊕B2, and IDi=B3⊕h(ru∥B1) and verifies whether IDi is in the database and B4=?h(CIDi∥GID∥SIDj∥B1∥IDi∥ru). If either of the two verifications does not hold,GWN will terminate the session. Otherwise,GWN searches (SIDj,Nl) from the database, generates a random number rg, and computes SG=h(SIDj∥G∥Nl), B5=h(SG∥GID)⊕ru, B6=h(ru)⊕rg, and B7=h(SG∥ru∥rg).(4)GWN→Sj:{SIDj,B5,B6,B7}.(5) Once receiving the message, the corresponding nodeSj checks if SIDj is correct and computes ru=B5⊕h(SG∥GID) and rg=B6⊕h(ru). Then Sj verifies whether B7=?h(SG∥ru∥rg). If either is incorrect, Sj rejects the session. Otherwise, Sj generates rs and computes sks=h(ru∥rg∥rs), B8=h(SG∥rg)⊕rs, and B9=h(sks∥SIDj∥GID∥rs).(6)Sj→GWN: {B8,B9}.(7) Once received the response message,GWN computes rs=B8⊕h(SG∥rg), skg=h(ru∥rg∥rs) and checks whether B9=?h(skg∥SIDj∥GID∥rs). If so,GWN chooses a new pseudoidentity CIDinew and calculates B10=h(CIDinew∥GID∥G)⊕h(ru∥CIDi), B11=h(ru∥IDi)⊕rg, B12=h(ru∥rg)⊕rs, B13=h(h(IDi∥G)∥rs)⊕CIDinew, and B14=h(skg∥IDi∥B10∥CIDinew).(8)GWN→Ui:{B10,B11,B12,B13,B14}.(9) When receiving the response message,SC computes rg=B11⊕h(ru∥IDi), rs=B12⊕h(ru∥rg), sku=h(ru∥rg∥rs), and CIDinew=B13⊕h((A2⊕h(IDi∥HPWi))∥rs) and verifies whether B14=?h(sku∥IDi∥B10∥CIDinew). If it is equal, SC computes A1new=B10⊕h(ru∥CIDi)⊕HPWi and replaces (A1,CIDi) with (A1new,CIDinew).


## 4.2. Cryptanalysis of Wu et al.’s Scheme

Due to its simplicity and admirable provision of user anonymity, Wu et al.’s scheme [9] exhibits great application prospects, and yet there are still some security pitfalls being overlooked by Wu et al. In the following, we will demonstrate that Wu et al.’s scheme [9] has some user friendliness issue and fails to achieve the critical property of forward security.


### 4.2.1. No Provision of User Friendliness

According to the collected data from Dashlane [56], “we are online hoarders” that the average user maintains over 107 accounts registered to one email address and this figure will rise to 207 by 2020. This statistical shows that users are creating and virtually stashing more online account information than ever, which leads to an insanely high number of accounts to manage. In that case, freely password change is a recommended practice, for users have to reset a forgotten password (an average of 37 accounts [56]) and the fixed password is definitely vulnerable. Moreover, users may make a slip in writing passwords or identities; the rapid response and decisive action are quite necessary for a user friendly authentication protocol.Early in 1968, Robert Miller [57] published a classic paper about response time in man-computer conversational transactions, which pointed out that “response times exceed 10 seconds will completely lose the user’s attention”. In this way, locally secure password change, i.e., providing an explicit and secure process to verify the correctness of user-keyed password in smart card, is essential. That is, the smart card has no need to interact with remote server in user input and password changing phases. However, as stated above, both Li et al.’s scheme [25] and Amin et al.’s scheme [8] provide local password change, but their strategies introduce new vulnerabilities-offline dictionary attack.Back to Wu et al.’s scheme [9], there is no verifier in the smart card, which means their scheme even cannot provide timely detection mechanism and reasonable password change. Fortunately, Wang et al. [10] introduced a “fuzzy verifier” technique to effectively solve this security-usability issue. In the following, we will take Wu et al.’s scheme [9] as an example to show this strategy. Firstly, Ui submits {IDi,HPWi} toGWN in the registration phase. ThenGWN computes Ai=h((h(IDi)⊕HPWi))mod n) and stores it in Ui’s smart card, where n denotes the size of (ID,PW) pool and 26≤n≤28. Assume |Did|≈|Dpw|≈106 and n=28 [29, 30], we can be assured that there have the possibilities of |Did|×|Did|/n≈232 identity and password pairs to thwart the adversary from guessing out the correct password.The same considerations can also be applied to Li et al.’s scheme [25] and Amin et al.’s scheme [8]. The large-scale candidates will effectively frustrate A from random guessing the password by a brute force method as well as providing a timely detection of the mistyped identity or password.


### 4.2.2. The Violation of Forward Secrecy

Forward secrecy is an important property, for the unattended environment and security-critical applications in wireless sensor networks [7, 11]. In [9], Wu et al. explicitly stated that “the sensor nodes may be captured by the intruder”, which accords with assumption (4) made in Section 2.2. Under this statement, we find that Wu et al.’s scheme cannot achieve the forward secrecy. Once a sensor node Sk has been compromised, the stored information SG might be obtained by A and the following attacks can be launched.Step 1.
Intercept the message{CIDi,GID,SIDk,B2,B3,B4} sending from Ui toGWN and the message {SIDk,B5,B6,B7} sending fromGWN to Sk.Step 2.
Computeru=B5⊕h(SG∥GID), rg=B6⊕h(ru), where SG is extracted from the compromised node Sk.Step 3.
Intercept the message{B8,B9} sending fromGWN to Sk.Step 4.
Computers=B8⊕h(SG∥rg).Step 5.
Compute the session key=h(ru∥rg∥rs).The above attack demonstrates that once a sensor nodeSk has been captured, the previous sessions might be decoded. This is the same failure with Li et al.’s scheme [25] and Amin et al.’s scheme [8]. Besides the above two techniques (ECC cryptosystem and chaotic maps), we also suggest employing some other public-key cryptography techniques, such as Pairing [58] and RSA cryptosystem. Note that when using RSA cryptosystem to achieve forward secrecy, a new temporary RSA key must be generated by user side for each session [59].To demonstrate the necessity and effectiveness of our suggestions, we provide a comparison of 10 recently proposed schemes by assessing whether they achieve forward secrecy and what main technology do they use. The result are shown in Table2. One can see that only Das et al.’s scheme [52] successfully provides forward secrecy. This failure is mainly due to the fact that half of them (i.e., [8, 9, 51, 54]) only use Hash operation that are virtually impossible to provide forward secrecy (“PFS principle” [26]), yet the other 4 schemes (i.e., [25, 45, 50, 55]) that make use of public-key techniques (e.g., ECC, Chaotic maps, RSA) violate the principle that the random numbers must be generated by Ui and Sj separately and cannot be transmitted over the public channel.Table 2
Performance and security comparison.
Related schemes Computation cost on log-auth phases PFS Key technology Hash ECC C M ∗ RSA Li et al. (2018) [25] 21 T H + 3 T E × ✓ ✓ × × Amin et al. (2018) [8] 22 T H × ✓ × × × Wu et al. (2017) [9] 34 T H × ✓ × × × Roy et al. (2017) [45] 15 T H + 3 T C × ✓ × ✓ × Moon et al. (2017) [50] 11 T H + 2 T C × ✓ × ✓ × Srinivas et al. (2017) [51] 29 T H × ✓ × × × Das et al. (2016) [52] 31 T H + 4 T E ✓ ✓ ✓ × × Chang et al. (2016) [53] 20 T H × ✓ × × × Vaidya et al. (2016) [54] 29 T H × ✓ × × × Odelu et al. (2015) [55] 15 T H + 6 T M × ✓ × × ✓ N o t e 1. TH: one-time hash operation time; TE: elliptic curve point multiplication computation time; TC: running time of chaotic maps; TM: time for modular multiplication/division. N o t e 2. × means the corresponding scheme fails to achieve this property; CM denotes chaotic maps; PFS denotes perfect forward secrecy.


## 4.2.1. No Provision of User Friendliness

According to the collected data from Dashlane [56], “we are online hoarders” that the average user maintains over 107 accounts registered to one email address and this figure will rise to 207 by 2020. This statistical shows that users are creating and virtually stashing more online account information than ever, which leads to an insanely high number of accounts to manage. In that case, freely password change is a recommended practice, for users have to reset a forgotten password (an average of 37 accounts [56]) and the fixed password is definitely vulnerable. Moreover, users may make a slip in writing passwords or identities; the rapid response and decisive action are quite necessary for a user friendly authentication protocol.Early in 1968, Robert Miller [57] published a classic paper about response time in man-computer conversational transactions, which pointed out that “response times exceed 10 seconds will completely lose the user’s attention”. In this way, locally secure password change, i.e., providing an explicit and secure process to verify the correctness of user-keyed password in smart card, is essential. That is, the smart card has no need to interact with remote server in user input and password changing phases. However, as stated above, both Li et al.’s scheme [25] and Amin et al.’s scheme [8] provide local password change, but their strategies introduce new vulnerabilities-offline dictionary attack.Back to Wu et al.’s scheme [9], there is no verifier in the smart card, which means their scheme even cannot provide timely detection mechanism and reasonable password change. Fortunately, Wang et al. [10] introduced a “fuzzy verifier” technique to effectively solve this security-usability issue. In the following, we will take Wu et al.’s scheme [9] as an example to show this strategy. Firstly, Ui submits {IDi,HPWi} toGWN in the registration phase. ThenGWN computes Ai=h((h(IDi)⊕HPWi))mod n) and stores it in Ui’s smart card, where n denotes the size of (ID,PW) pool and 26≤n≤28. Assume |Did|≈|Dpw|≈106 and n=28 [29, 30], we can be assured that there have the possibilities of |Did|×|Did|/n≈232 identity and password pairs to thwart the adversary from guessing out the correct password.The same considerations can also be applied to Li et al.’s scheme [25] and Amin et al.’s scheme [8]. The large-scale candidates will effectively frustrate A from random guessing the password by a brute force method as well as providing a timely detection of the mistyped identity or password.


## 4.2.2. The Violation of Forward Secrecy

Forward secrecy is an important property, for the unattended environment and security-critical applications in wireless sensor networks [7, 11]. In [9], Wu et al. explicitly stated that “the sensor nodes may be captured by the intruder”, which accords with assumption (4) made in Section 2.2. Under this statement, we find that Wu et al.’s scheme cannot achieve the forward secrecy. Once a sensor node Sk has been compromised, the stored information SG might be obtained by A and the following attacks can be launched.Step 1.
Intercept the message{CIDi,GID,SIDk,B2,B3,B4} sending from Ui toGWN and the message {SIDk,B5,B6,B7} sending fromGWN to Sk.Step 2.
Computeru=B5⊕h(SG∥GID), rg=B6⊕h(ru), where SG is extracted from the compromised node Sk.Step 3.
Intercept the message{B8,B9} sending fromGWN to Sk.Step 4.
Computers=B8⊕h(SG∥rg).Step 5.
Compute the session key=h(ru∥rg∥rs).The above attack demonstrates that once a sensor nodeSk has been captured, the previous sessions might be decoded. This is the same failure with Li et al.’s scheme [25] and Amin et al.’s scheme [8]. Besides the above two techniques (ECC cryptosystem and chaotic maps), we also suggest employing some other public-key cryptography techniques, such as Pairing [58] and RSA cryptosystem. Note that when using RSA cryptosystem to achieve forward secrecy, a new temporary RSA key must be generated by user side for each session [59].To demonstrate the necessity and effectiveness of our suggestions, we provide a comparison of 10 recently proposed schemes by assessing whether they achieve forward secrecy and what main technology do they use. The result are shown in Table2. One can see that only Das et al.’s scheme [52] successfully provides forward secrecy. This failure is mainly due to the fact that half of them (i.e., [8, 9, 51, 54]) only use Hash operation that are virtually impossible to provide forward secrecy (“PFS principle” [26]), yet the other 4 schemes (i.e., [25, 45, 50, 55]) that make use of public-key techniques (e.g., ECC, Chaotic maps, RSA) violate the principle that the random numbers must be generated by Ui and Sj separately and cannot be transmitted over the public channel.Table 2
Performance and security comparison.
Related schemes Computation cost on log-auth phases PFS Key technology Hash ECC C M ∗ RSA Li et al. (2018) [25] 21 T H + 3 T E × ✓ ✓ × × Amin et al. (2018) [8] 22 T H × ✓ × × × Wu et al. (2017) [9] 34 T H × ✓ × × × Roy et al. (2017) [45] 15 T H + 3 T C × ✓ × ✓ × Moon et al. (2017) [50] 11 T H + 2 T C × ✓ × ✓ × Srinivas et al. (2017) [51] 29 T H × ✓ × × × Das et al. (2016) [52] 31 T H + 4 T E ✓ ✓ ✓ × × Chang et al. (2016) [53] 20 T H × ✓ × × × Vaidya et al. (2016) [54] 29 T H × ✓ × × × Odelu et al. (2015) [55] 15 T H + 6 T M × ✓ × × ✓ N o t e 1. TH: one-time hash operation time; TE: elliptic curve point multiplication computation time; TC: running time of chaotic maps; TM: time for modular multiplication/division. N o t e 2. × means the corresponding scheme fails to achieve this property; CM denotes chaotic maps; PFS denotes perfect forward secrecy.


## 5. Conclusion

In this paper, we first analyze three state-of-the-art authentication schemes presented by Li et al., Amin et al., and Wu et al., which are mainly applied to realize real-time data access for security-critical wireless sensor networks. We demonstrate that although their schemes are equipped with formal proof, they still suffer from smart card loss attack and fail to achieve some important properties of forward secrecy, user anonymity, and user friendliness. Our cryptanalysis results discourage the practical application of these three schemes and reveal some challenges in designing a robust scheme for WSNs. We then suggest several possible countermeasures on account of their weaknesses and provide a comparison of 10 representative schemes in terms of forward secrecy and key technology to demonstrate the necessity of our suggestions. For the future work, a natural direction is to employ our recommended technologies and countermeasures to design robust and efficient schemes for WSNs.



---

*Source: 8539674-2018-07-05.xml*