# Security Analysis on “Anonymous Authentication Scheme for Smart Home Environment with Provable Security”

Authors: Meijia Xu; Qiying Dong; Mai Zhou; Chenyu Wang; Yangyang Liu
Journal: Wireless Communications and Mobile Computing
 (2020)

---

## Abstract

As an important application of the Internet of Things, smart home has greatly facilitated our life. Since the communication channels of smart home are insecure and the transmitted data are usually sensitive, a secure and anonymous user authentication scheme is required. Numerous attempts have been taken to design such authentication schemes. Recently, Shuai et al. (Computer & Security 86(2019):132146) designed an anonymous authentication scheme for smart home using elliptic curve cryptography. They claimed that the proposed scheme is secure against various attacks and provides ideal attributes. However, we show that their scheme cannot resist inside attack and offline dictionary attack and also fails to achieve forward secrecy. Furthermore, we give some suggestions to enhance the security of the scheme. These suggestions also apply to other user authentication schemes with similar flaws.


---

## Body

## 1. Introduction

Smart home is a new paradigm of the Internet of Things, which can greatly facilitate our life; thus, it attracts much attention. In smart home environments, the smart devices can communicate and cooperate with each other to provide comprehensive services for users. However, the conversations between the users and the smart devices are carried out in an insecure open channel. The adversary can eavesdrop the sensitive data transmitted over the insecure channel. Therefore, it is of importance to provide a security mechanism to secure the conversations. Multifactor user authentication [1, 2] is one of the important ways to identify the authenticity of a user. In a multifactor user authentication scheme for smart home environment, there are usually four participants: a set of users, the register center, the gateways, and the sensor nodes. The user owns her personal secrecy information, such as a password and a smart device. All participants are required to register in the register center. When a user wants to access real-time data stored on a sensor node, she can initiate an access request. Then, the gateway and the sensor node will verify the user. If the user is valid, a session key will be built to encrypt the subsequent conversations. In such schemes, the adversary is usually assumed to be able to [3] (1) control the open channel, that is, she can intercept, modify, and eavesdrop the messages in the open channel; (2) list all the items in the space of passwords and identities; (3) compromise n−1 factor(s) of a n-factor authentication scheme; (4) acquire the long-term secret key when accessing forward secrecy; (5) break some of sensor nodes; (6) obtain the previous session keys; and (7) register as a legitimate participant.Recently, numerous user authentication schemes are proposed [4–7]. Most recently, Shuai et al. [8] designed a new anonymous authentication scheme for a smart home environment. They employ the elliptic curve cryptography to authenticate the users with resistance to offline dictionary attack and generate pseudoidentity DIDi to provide user anonymity. However, some subtleties are overlooked, which results in vulnerability to various attacks. In this paper, we demonstrate that their scheme cannot resist offline dictionary attack and inside attack and fails to achieve forward secrecy. Besides, we also discuss the causes and countermeasures of these security flaws. The countermeasures we proposed can also be applied to other authentication schemes with similar problems.


## 2. Review of Shuai et al.’s Scheme

In this section, we briefly review Shuai et al.’s scheme. The notations and abbreviations are shown in Table1. Firstly, the registration authority RA chooses an elliptic curve E and an additive group G of E with order q and generator P. Next, RA generates a pair of private/public key x,X, where x∈Zq∗ and X=x⋅P, a long-term secret key K and a hash function h⋅:0,1∗→Zq∗. Note that x and K will be stored in GWN, and EFp,G,P,X,h⋅ will be published to all participants.Table 1
Notations and abbreviations.
SymbolDescriptionUiith userGWNThe gateway nodeSDkjth smart deviceIDiIdentity ofUiPWiPassword ofUiGIDjIdentity of GWNSIDkIdentity ofSDkRARegistration authorityKThe secret key of GWN⊕Bitwise XOR operation||Concatenation operationh⋅One-way hash function→A common channel⇒A secure channel


### 2.1. User Registration Phase

Step 1.
Ui⇒RA:IDi,HPWi, where HPWi=hPWia and a is a random nonce.Step 2.
RA⇒Ui:Ai,TEMP.RA first checks the availability ofIDi and computes KGU=hIDiK,A1=KGU⊕HPWi. Finally, RA generates TEMP where TEMP is initialized to 0.Step 3.
Ui computes A2=a⊕hIDiPWi, A3=hIDiHPWi and stores A1,A2,A3,TEMP into the mobile device.


### 2.2. The Smart Device Registration Phase

Step 1.
SDk⇒RA:SIDk.Step 2.
RA⇒SDk:KGS. RA checks the validity of SIDk and computes KGS=hSIDkK.Step 3.
SDk stores KGS.


### 2.3. Login and Authentication Phase

Step 1.
Ui→GWN:DIDi,A4,M1,V1.Ui provides IDi and PWi, and then, the mobile device computes a∗=A2⊕hIDiPWi, HPW∗=hPWia∗. A3∗=hIDiHPWi∗. If A3∗≠A3, the mobile device rejects the request and sets TEMP to TEMP+1. Once TEMP≥3, the mobile device will be suspended till Ui reregisters. Otherwise, the mobile device computes KGU=A1⊕HPWi, A4=ω⋅P,A5=ω⋅X, DIDi=IDi⊕A5, M1=R1SIDk⊕KGU, and V1=hIDiR1KGUM1, where R1 and ω∈Zn∗ are two random numbers, and SIDk is the identity of the target SDk.Step 2.
GWN→SDk:M2,V2.GWNcomputes A5∗=x⋅A4,IDi∗=DIDi⊕A5∗, KGU=hIDi∗K, R1∗SIDk=M1⊕KGU,V1∗=hIDiR1KGUM1. If V1∗≠V1, GWN ends the session. Otherwise, GWN computes KGS=hSIDkK, M2=IDiGIDjR1R2⊕KGS, and V2=hIDiGIDjKGSR1R2, where R2 is a random number.Step 3.
SDk→GWN:M3,V3.SDk computes IDiGIDjR1R2=M2⊕KGS, V2∗=hIDiGIDjKGSR1R2. If V2∗≠V2, SDk ends the session. Otherwise, SDk computes SK=hIDiGIDjSIDkR1R2R3, M3=R3⊕KGS, and V3=hR3KGSSK, where R3 is a random number.Step 4.
GWN→Ui:M4,V4.GWN computes R3=M3⊕KGS, SK=hIDiGIDjSIDkR1R2R3, and V3∗=hR3KGSSK. If V3∗≠V3, GWN ends the session. Otherwise, GWN computes M4=GIDjR2R3⊕KGS and V4=hKGUSKR2R3.Step 5.
Ui computes GIDjR2R3=M4⊕KGU, SK=hIDiGIDjSIDkR1R2R3, and V4∗=hKGUSKR2R3. If V4∗==V4, the authentication is finished sucessfully.


## 2.1. User Registration Phase

Step 1.
Ui⇒RA:IDi,HPWi, where HPWi=hPWia and a is a random nonce.Step 2.
RA⇒Ui:Ai,TEMP.RA first checks the availability ofIDi and computes KGU=hIDiK,A1=KGU⊕HPWi. Finally, RA generates TEMP where TEMP is initialized to 0.Step 3.
Ui computes A2=a⊕hIDiPWi, A3=hIDiHPWi and stores A1,A2,A3,TEMP into the mobile device.


## 2.2. The Smart Device Registration Phase

Step 1.
SDk⇒RA:SIDk.Step 2.
RA⇒SDk:KGS. RA checks the validity of SIDk and computes KGS=hSIDkK.Step 3.
SDk stores KGS.


## 2.3. Login and Authentication Phase

Step 1.
Ui→GWN:DIDi,A4,M1,V1.Ui provides IDi and PWi, and then, the mobile device computes a∗=A2⊕hIDiPWi, HPW∗=hPWia∗. A3∗=hIDiHPWi∗. If A3∗≠A3, the mobile device rejects the request and sets TEMP to TEMP+1. Once TEMP≥3, the mobile device will be suspended till Ui reregisters. Otherwise, the mobile device computes KGU=A1⊕HPWi, A4=ω⋅P,A5=ω⋅X, DIDi=IDi⊕A5, M1=R1SIDk⊕KGU, and V1=hIDiR1KGUM1, where R1 and ω∈Zn∗ are two random numbers, and SIDk is the identity of the target SDk.Step 2.
GWN→SDk:M2,V2.GWNcomputes A5∗=x⋅A4,IDi∗=DIDi⊕A5∗, KGU=hIDi∗K, R1∗SIDk=M1⊕KGU,V1∗=hIDiR1KGUM1. If V1∗≠V1, GWN ends the session. Otherwise, GWN computes KGS=hSIDkK, M2=IDiGIDjR1R2⊕KGS, and V2=hIDiGIDjKGSR1R2, where R2 is a random number.Step 3.
SDk→GWN:M3,V3.SDk computes IDiGIDjR1R2=M2⊕KGS, V2∗=hIDiGIDjKGSR1R2. If V2∗≠V2, SDk ends the session. Otherwise, SDk computes SK=hIDiGIDjSIDkR1R2R3, M3=R3⊕KGS, and V3=hR3KGSSK, where R3 is a random number.Step 4.
GWN→Ui:M4,V4.GWN computes R3=M3⊕KGS, SK=hIDiGIDjSIDkR1R2R3, and V3∗=hR3KGSSK. If V3∗≠V3, GWN ends the session. Otherwise, GWN computes M4=GIDjR2R3⊕KGS and V4=hKGUSKR2R3.Step 5.
Ui computes GIDjR2R3=M4⊕KGU, SK=hIDiGIDjSIDkR1R2R3, and V4∗=hKGUSKR2R3. If V4∗==V4, the authentication is finished sucessfully.


## 3. Cryptanalysis of Shuai et al.’s Scheme

In this section, we demonstrate that Shuai et al.’s scheme suffers from various attacks when assuming the adversary armed with real-world capabilities [9–11] as below:
(1)
Exhaust all the items in the Descartes space of passwords and identities(2)
GetIDi when assess the security of the scheme(3)
Intercept, eavesdrop, or resend the messages in the open channel(4)
Get the data stored in the smart device(5)
Get previous session keys(6)
Get the secret keyK when accessing forward secrecy(7)
The adversary can be the administrator of the registration authority


### 3.1. Offline Dictionary Attack

When the adversary gets the data ({A1,A2,A3}) stored in the victim Ui’s mobile device, she can guess Ui’s password and identity correctly as the following steps:The attack steps are as follows:Step 1.
GuessPWi to be PWi∗,IDi to be IDi∗.Step 2.
Computea∗=A2⊕hIDi∗PWi∗.Step 3.
ComputeHPWi∗=hPWi∗a∗.Step 4.
ComputeA3∗=hIDi∗HPWi∗.Step 5.
Verify the correctness ofPWi and IDi by checking if A3∗==A3.Step 6.
Repeat Steps1–5 until the equation holds.The time complexity isODPW∗Did∗3TH, where TH is the time of the hash function.Assuming the adversary gets the victim’s identityIDi, the adversary, with the data stored in the smart device and transmitted in the open channel, can guess Ui’s password successfully as below:The attack steps are as follows:Step 1.
GuessPWi to be PWi∗, IDi to be IDi∗.Step 2.
Computea∗=A2⊕hIDi∗PWi∗.Step 3.
ComputeHPWi∗=hPWi∗a∗.Step 4.
ComputeKGU∗=A1⊕HPWi∗.Step 5.
ComputeR1∗SIDk=M1⊕KGU∗.Step 6.
ComputeV1∗=hIDiR1∗KGU∗M1.Step 7.
Verify the correctness ofPWi and IDi by checking if V1∗==V1.Step 8.
Repeat Steps1–6 until the correct value of PWi is found.The time complexity isODpw∗Did∗3TH.Possible Countermeasures: In offline dictionary attack, the inherent causes are as follows: (1) the adversary can find a verifier to check the correctness of the guessed password and (2) to the adversary, the verifier only contains one unknown parameter (i.e., the victim’s password), that is, all the parameters which consist of the verifier can be derived from the victim’s password. According to Wang and Xu [12], the offline dictionary attack can be divided into two types in terms of where the verifier is from. In the former attack, the verifier A3 is extracted from the smart device. To deal with this attack, Wang and Wang [13] proposed a way of integrating the fuzzy-verifier technique and honeywords. That is, let A3=hIDiHPWimodn0, where n0 is an integer and 24≤n0≤28.As such, there are aboutDid∗Dpw/l0≈232 candidate pairs of identity and password which satisfy the equation of Step 5, when l0=28. To test the specific pair of identity and password, the adversary needs to initiate the access request online, and this (the failure attempt) can be detected and stopped by the parameter TEMP.To the second attack, a public key is necessary [14]. In Shuai et al.’s scheme, we need to set the verifier Vi=hIDiR1KGUM1A5 and DIDi=IDi⊕hA. As such, there are essentially two unknown parameters to the adversary, i.e., the password and A5, and the space of A5 is too large for the adversary to conduct the offline dictionary attack.


### 3.2. Forward Secrecy

Forward secrecy requires that the exposure of the secrecy keyK will not affect the security of previous conversations. However, we find this scheme cannot provide forward secrecy. If the adversary gets K and eavesdrops the parameters {M2,M3}, she can get the session key SK as the following steps:The attack steps are as follows:Step 1.
ComputeKGS∗=hSIDkK.Step 2.
ComputeIDi∗GIDj∗R1∗R2∗=M2⊕KGS∗.Step 3.
ComputeR3∗=M3⊕KGS∗.Step 4.
ComputeSK=hIDi∗GIDi∗R1∗R2∗R3∗.The time complexity isODpw∗Did∗2TH.Possible Countermeasures: According to Ma et al. [14], the public key technique and two modular exponentiation or point multiplication operations on the smart device are required. Following this principle, we can let SK=hIDiGIDjA4A6A7, where A6=R3⋅P, A7=ω⋅A6=R3⋅A4⋅A6 is computed by SDk and should be transmitted to Ui in the open channel. A4 also needs to be sent to SDk. R3 cannot be transmitted to any participants. As such, the adversary has no way to compute A7 (it is a computational difficult problem which cannot be solved within polynomial time), and the forward secrecy is achieved.


### 3.3. Inside Attack

Suppose the adversary is also the administrator of RA, then she can exploit the register message and the data stored in mobile devices to guess the victim’s password as follows:The attack steps are as follows:Step 1.
GuessPWi to be PWi∗, IDi to be IDi∗.Step 2.
Computea∗=A2⊕hIDi∗PWi∗.Step 3.
ComputeHPWi∗=hPWia.Step 4.
Verify the correctness ofPWi and IDi by checking if HPWi∗==HPWi.Step 5.
Repeat Steps1–4 until the correct value of PWi and IDi is found.The time complexity isODpw∗Did∗2TH.Possible Countermeasures: Inside attack is practical although it has high requirements on the adversary’s capability. In this scheme, the verifierHPWi contains PWi and a, and a can be computed using the parameters in the mobile device. Therefore, a way to deal with this attack is to update a after the registration. After receiving the response from RA, the user side should select a new random nonce a′, update HPWi as hPWia′, and then set A2=a′⊕hIDiPWi and A3=hIDiHPWi.


## 3.1. Offline Dictionary Attack

When the adversary gets the data ({A1,A2,A3}) stored in the victim Ui’s mobile device, she can guess Ui’s password and identity correctly as the following steps:The attack steps are as follows:Step 1.
GuessPWi to be PWi∗,IDi to be IDi∗.Step 2.
Computea∗=A2⊕hIDi∗PWi∗.Step 3.
ComputeHPWi∗=hPWi∗a∗.Step 4.
ComputeA3∗=hIDi∗HPWi∗.Step 5.
Verify the correctness ofPWi and IDi by checking if A3∗==A3.Step 6.
Repeat Steps1–5 until the equation holds.The time complexity isODPW∗Did∗3TH, where TH is the time of the hash function.Assuming the adversary gets the victim’s identityIDi, the adversary, with the data stored in the smart device and transmitted in the open channel, can guess Ui’s password successfully as below:The attack steps are as follows:Step 1.
GuessPWi to be PWi∗, IDi to be IDi∗.Step 2.
Computea∗=A2⊕hIDi∗PWi∗.Step 3.
ComputeHPWi∗=hPWi∗a∗.Step 4.
ComputeKGU∗=A1⊕HPWi∗.Step 5.
ComputeR1∗SIDk=M1⊕KGU∗.Step 6.
ComputeV1∗=hIDiR1∗KGU∗M1.Step 7.
Verify the correctness ofPWi and IDi by checking if V1∗==V1.Step 8.
Repeat Steps1–6 until the correct value of PWi is found.The time complexity isODpw∗Did∗3TH.Possible Countermeasures: In offline dictionary attack, the inherent causes are as follows: (1) the adversary can find a verifier to check the correctness of the guessed password and (2) to the adversary, the verifier only contains one unknown parameter (i.e., the victim’s password), that is, all the parameters which consist of the verifier can be derived from the victim’s password. According to Wang and Xu [12], the offline dictionary attack can be divided into two types in terms of where the verifier is from. In the former attack, the verifier A3 is extracted from the smart device. To deal with this attack, Wang and Wang [13] proposed a way of integrating the fuzzy-verifier technique and honeywords. That is, let A3=hIDiHPWimodn0, where n0 is an integer and 24≤n0≤28.As such, there are aboutDid∗Dpw/l0≈232 candidate pairs of identity and password which satisfy the equation of Step 5, when l0=28. To test the specific pair of identity and password, the adversary needs to initiate the access request online, and this (the failure attempt) can be detected and stopped by the parameter TEMP.To the second attack, a public key is necessary [14]. In Shuai et al.’s scheme, we need to set the verifier Vi=hIDiR1KGUM1A5 and DIDi=IDi⊕hA. As such, there are essentially two unknown parameters to the adversary, i.e., the password and A5, and the space of A5 is too large for the adversary to conduct the offline dictionary attack.


## 3.2. Forward Secrecy

Forward secrecy requires that the exposure of the secrecy keyK will not affect the security of previous conversations. However, we find this scheme cannot provide forward secrecy. If the adversary gets K and eavesdrops the parameters {M2,M3}, she can get the session key SK as the following steps:The attack steps are as follows:Step 1.
ComputeKGS∗=hSIDkK.Step 2.
ComputeIDi∗GIDj∗R1∗R2∗=M2⊕KGS∗.Step 3.
ComputeR3∗=M3⊕KGS∗.Step 4.
ComputeSK=hIDi∗GIDi∗R1∗R2∗R3∗.The time complexity isODpw∗Did∗2TH.Possible Countermeasures: According to Ma et al. [14], the public key technique and two modular exponentiation or point multiplication operations on the smart device are required. Following this principle, we can let SK=hIDiGIDjA4A6A7, where A6=R3⋅P, A7=ω⋅A6=R3⋅A4⋅A6 is computed by SDk and should be transmitted to Ui in the open channel. A4 also needs to be sent to SDk. R3 cannot be transmitted to any participants. As such, the adversary has no way to compute A7 (it is a computational difficult problem which cannot be solved within polynomial time), and the forward secrecy is achieved.


## 3.3. Inside Attack

Suppose the adversary is also the administrator of RA, then she can exploit the register message and the data stored in mobile devices to guess the victim’s password as follows:The attack steps are as follows:Step 1.
GuessPWi to be PWi∗, IDi to be IDi∗.Step 2.
Computea∗=A2⊕hIDi∗PWi∗.Step 3.
ComputeHPWi∗=hPWia.Step 4.
Verify the correctness ofPWi and IDi by checking if HPWi∗==HPWi.Step 5.
Repeat Steps1–4 until the correct value of PWi and IDi is found.The time complexity isODpw∗Did∗2TH.Possible Countermeasures: Inside attack is practical although it has high requirements on the adversary’s capability. In this scheme, the verifierHPWi contains PWi and a, and a can be computed using the parameters in the mobile device. Therefore, a way to deal with this attack is to update a after the registration. After receiving the response from RA, the user side should select a new random nonce a′, update HPWi as hPWia′, and then set A2=a′⊕hIDiPWi and A3=hIDiHPWi.


## 4. Conclusion

In this paper, we have analyzed an anonymous authentication scheme for a smart home environment proposed by Shuai et al. [8]. We demonstrated that their scheme suffers from various attacks although it is proved to be secure under the random oracle model. We showed that this scheme cannot resist offline dictionary attack and inside attack and also fails to provide forward secrecy. After pointing out these security flaws, we proposed possible countermeasures to deal with them. These suggestions can also be applied to most similar schemes. Thus, our work is helpful to the design of a secure and efficient user authentication scheme for the smart home environment.



---

*Source: 8838363-2020-11-16.xml*