# Robust and Efficient Authentication Scheme for Session Initiation Protocol

Authors: Yanrong Lu; Lixiang Li; Yixian Yang
Journal: Mathematical Problems in Engineering
 (2015)

---

## Abstract

The session initiation protocol (SIP) is a powerful application-layer protocol which is used as a signaling one for establishing, modifying, and terminating sessions among participants. Authentication is becoming an increasingly crucial issue when a user asks to access SIP services. Hitherto, many authentication schemes have been proposed to enhance the security of SIP. In 2014, Arshad and Nikooghadam proposed an enhanced authentication and key agreement scheme for SIP and claimed that their scheme could withstand various attacks. However, in this paper, we show that Arshad and Nikooghadam’s authentication scheme is still susceptible to key-compromise impersonation and trace attacks and does not provide proper mutual authentication. To conquer the flaws, we propose a secure and efficient ECC-based authentication scheme for SIP. Through the informal and formal security analyses, we demonstrate that our scheme is resilient to possible known attacks including the attacks found in Arshad et al.’s scheme. In addition, the performance analysis shows that our scheme has similar or better efficiency in comparison with other existing ECC-based authentication schemes for SIP.


---

## Body

## 1. Introduction

Multimedia service is one of the most important application classes of wired or wireless networks. The session initiation protocol (SIP) is one of the most important protocols supporting multimedia services since it could manage sessions including multimedia distribution, internet telephone calls, and internet multimedia conferences [1]. Authentication is an important security requirement when a user wants to access the SIP services. Therefore, the security of SIP [2] has received a lot of attention and the SIP authentication has become a crucial topic in modern multimedia services.Up to now, various researches have focused on proposing a secure and efficient authenticated key agreement scheme to provide various aspects of security for SIP. In 2005, Yang et al. [3] indicated that the procedure of hyper text transport protocol (HTTP) digest authentication for SIP could not resist the offline password guessing and server-spoofing attacks. To resolve these problems, Yang et al. proposed an improved scheme based on Diffie-Hellman key exchange protocol. Later on, Huang et al. [4] identified that Yang et al.’s protocol was insecure against the offline password guessing attack. To enhance the security of Yang et al.’s scheme, Huang et al. also presented an improved scheme. Later on, Jo et al. [5] demonstrated that Huang et al.’s scheme was still vulnerable to the offline password guessing attack. Based on Yang et al.’s study, Durlanik and Sogukpinar [6] proposed an Elliptic Curve Cryptography (ECC) [7] based authentication scheme for SIP. Compared with other cryptosystems, ECC can achieve the same security with a smaller key size [8]. Therefore, the scheme proposed by Durlanik and Sogukpinar is considered to be more efficient than Yang et al.’s scheme. Later, Wu et al. [9] also proposed an authentication scheme for SIP using ECC. However, Yoon et al. [10] showed that both of Durlanik et al.’s scheme and Wu et al.’s scheme were susceptible to the offline password guessing, Denning-Sacco, and stolen verifier attacks. To overcome these weaknesses, Yoon et al. proposed an enhanced authentication scheme for SIP with more security. Unfortunately, Pu [11] showed that the scheme of Yoon et al. was still prone to the offline password guessing and replay attacks.In order to reduce the high computational cost, Tsai [12] suggested an efficient authenticated key agreement scheme only adopting one-way hash functions and exclusive-or operations. Nevertheless, Tsai’s scheme was still vulnerable to the offline password guessing attack [13, 14]. Yoon et al. [14] proposed an enhanced scheme to overcome weaknesses in Tsai’s scheme. However, Xie [15] demonstrated that Yoon et al.’s scheme did not resist the stolen-verifier and offline password guessing attacks. Xie then proposed an improved scheme to overcome the weaknesses of Yoon et al.’s scheme. Nevertheless, Farash and Attari [16] discovered that Xie’s scheme was still insecure against the impersonation and offline password guessing attacks. To enhance security, Farash and Attari presented an improved scheme to solve problems in Xie’s scheme. Recently, Zhang et al. [17] proposed an efficient and flexible password authenticated key agreement protocol for SIP using smart card and claimed their protocol was secure against various attacks. However, Zhang et al.’s scheme suffers from the impersonation attack [18, 19]. To tackle the problem, Tu et al. [18] and Irshad et al. [19], respectively, proposed their own improved authentication scheme based on Zhang et al.’s scheme. Unfortunately, Arshad and Nikooghadam [20] demonstrated that Irshad et al.’s scheme could not withstand the user impersonation attack. Arshad and Nikooghadam then proposed an enhancement of Irshad et al.’s scheme suffering from user impersonation attack and claimed that their scheme was immune to many known attacks.In this study, we identify that the scheme by Arshad and Nikooghadam is insecure against key-compromise impersonation and trace attacks while it fails to provide proper mutual authentication. To conquer the mentioned weaknesses, we propose a robust and efficient authentication scheme using ECC. Through the informal and formal security analyses, we demonstrate that our scheme is resilient to possible known attacks including the attacks found in Arshad and Nikooghadam’s scheme. In addition, the performance analysis shows that our scheme has similar or better efficiency in comparison with other related ECC-based authentication schemes for SIP.The remainder of this paper is organized as follows. Section2 provides some basic preliminaries and notations used in this paper. The review and security analysis of Arshad and Nikooghadam’s scheme are shown in Sections 3 and 4, respectively. Section 5 shows our proposed scheme. Section 6 analyzes our scheme’s security. Section 7 shows the performance and functionality comparison among the proposed scheme and other related ones. Section 8 is a brief conclusion.


## 2. Preliminaries

In this section, some notations used in this paper are described in Section2.1. We also recall the definitions of the hash function [21] and Elliptic Curve Discrete Logarithm Problem (ECDLP) [7] which we use in the security proof of Arshad et al.’s scheme and our improved scheme.


### 2.1. Notations

We use the notations that are listed below throughout the rest of the paper.U
i
,
S: user and sever
I
D
i
,
P
W
i: identity and password of U
i
h
(
·
): hash function
k
U
i
,
k
S: secret key selected by U
i and S
⊕
,
∥
: exclusive-or operation and concatenation operation.


### 2.2. Hash Function

A secure one-way hash functionh
:
{
0,1
}
*
→
{
0,1
}
n takes an input as an arbitrary length binary string x
∈
{
0,1
}
* and outputs a binary string h
(
x
)
∈
{
0,1
}
n. The probability of A in finding collision is defined as A
d
v
H
A
S
H
A
(
t
1
)
=
P
r
[
A
(
(
x
,
x
′
)
,
x
≠
x
′
)
:
h
(
x
)
=
h
(
x
′
)
].


### 2.3. ECDLP

In an elliptic curve cryptosystem, the elliptic curve equation is defined as the form ofE
p
(
a
,
b
)
:
y
2
=
x
3
+
a
x
+
b
(
mod
⁡
p
) over a finite field F
p, where a
,
b
∈
F
p and 4
a
3
+
27
b
≠
0
(
mod
⁡
p
).Given pointsP
,
Q over E
p
(
a
,
b
), theECDLP is to decide m
∈
F
p
* such that Q
=
m
P. The probability of A can solve theECDLP which is defined as A
d
v
E
C
D
L
P
A
(
t
2
)
=
P
r
[
A
(
P
,
Q
)
=
m
:
m
∈
F
p
*
,
Q
=
m
P
].


## 2.1. Notations

We use the notations that are listed below throughout the rest of the paper.U
i
,
S: user and sever
I
D
i
,
P
W
i: identity and password of U
i
h
(
·
): hash function
k
U
i
,
k
S: secret key selected by U
i and S
⊕
,
∥
: exclusive-or operation and concatenation operation.


## 2.2. Hash Function

A secure one-way hash functionh
:
{
0,1
}
*
→
{
0,1
}
n takes an input as an arbitrary length binary string x
∈
{
0,1
}
* and outputs a binary string h
(
x
)
∈
{
0,1
}
n. The probability of A in finding collision is defined as A
d
v
H
A
S
H
A
(
t
1
)
=
P
r
[
A
(
(
x
,
x
′
)
,
x
≠
x
′
)
:
h
(
x
)
=
h
(
x
′
)
].


## 2.3. ECDLP

In an elliptic curve cryptosystem, the elliptic curve equation is defined as the form ofE
p
(
a
,
b
)
:
y
2
=
x
3
+
a
x
+
b
(
mod
⁡
p
) over a finite field F
p, where a
,
b
∈
F
p and 4
a
3
+
27
b
≠
0
(
mod
⁡
p
).Given pointsP
,
Q over E
p
(
a
,
b
), theECDLP is to decide m
∈
F
p
* such that Q
=
m
P. The probability of A can solve theECDLP which is defined as A
d
v
E
C
D
L
P
A
(
t
2
)
=
P
r
[
A
(
P
,
Q
)
=
m
:
m
∈
F
p
*
,
Q
=
m
P
].


## 3. Review of Arshad and Nikooghadam’s Scheme

In this section, we will review Arshad et al.’s authentication scheme for SIP. Their scheme is composed of three phases, which are registration, authentication, and password change.


### 3.1. Registration

(1)
U
i generates a random number N
C, chooses his password P
W
i, computes v
i
=
h
(
I
D
i
∥
P
W
i
∥
N
C
), and sends {
I
D
i
,
v
i
} to S.
(2)
S computes V
i
=
h
(
I
D
i
∥
k
S
)
⊕
v
i and stores it into his database.


### 3.2. Authentication

(1)
U
i generates a random number d
C and computes R
C
=
d
C
K
S, where K
S
=
k
S
P is the public key of S. Then, U
i sends a message R
E
Q
U
E
S
T
(
I
D
i
,
R
C
) to S.
(2)
On receiving the request message,S chooses a random number d
S and computes Q
S
=
d
S
P, Q
S
C
=
d
S
k
S
-
1
R
C
=
d
S
d
C
P, and V
S
=
h
(
I
D
i
∥
Q
S
∥
Q
S
C
). Finally, S sends the message C
H
A
L
L
E
N
G
E
(
r
e
a
l
m
,
Q
S
,
V
S
) to U
i.
(3)
After receiving the challenge message,U
i computes Q
C
S
=
d
C
Q
S and validates whether V
S
′
=
h
(
I
D
i
∥
Q
S
∥
Q
C
S
) is equal to the received V
S. If it is true, U
i computes v
i
=
h
(
I
D
i
∥
P
W
i
∥
N
C
), V
C
=
h
(
I
D
i
∥
Q
S
∥
r
e
a
l
m
∥
Q
C
S
∥
v
i
), and the common session key S
K
=
h
(
I
D
i
∥
Q
S
∥
Q
C
S
∥
r
e
a
l
m
). Finally, U
i sends the message R
E
S
P
O
N
S
E
(
I
D
i
,
r
e
a
l
m
,
V
C
) to S.
(4)
After receiving the response message,S computes v
i
′
=
V
i
⊕
h
(
I
D
i
∥
k
S
)
=
h
(
I
D
i
∥
P
W
i
∥
N
C
), V
C
′
=
h
(
I
D
i
∥
Q
S
∥
r
e
a
l
m
∥
Q
C
S
∥
v
i
′
) and compares V
C with the received V
C. If it is correct, S agrees on the common session key S
K
=
h
(
I
D
i
∥
Q
S
∥
Q
C
S
∥
r
e
a
l
m
) with U
i.


### 3.3. Password Change

(1)
U
i selects a new random number N
C
′ and a new password P
W
i
′ and computes v
i
′
=
h
(
I
D
i
∥
P
W
i
′
∥
N
C
′
), z
=
h
(
I
D
i
∥
P
W
i
∥
N
C
)
⊕
v
i
′, Z
=
z
⊕
h
(
I
D
i
∥
S
K
), and V
z
=
h
(
I
D
i
∥
v
i
′
∥
S
K
∥
v
i
). Then, U
i sends the message C
H
A
N
G
E
P
W
D
(
I
D
i
,
Z
,
V
z
) to S.
(2)
After receiving the message,S computes v
i
=
V
i
⊕
h
(
I
D
i
∥
k
S
) and v
i
′
=
Z
⊕
v
i
⊕
h
(
I
D
i
∥
S
K
) and verifies whether V
z
′
=
h
(
I
D
i
∥
v
i
′
∥
S
K
∥
v
i
)
=
?
V
z. If it holds, S continues to compute V
i
′
=
V
i
⊕
z
=
h
(
I
D
i
∥
k
S
)
⊕
h
(
I
D
i
∥
P
W
i
′
∥
N
C
′
) and replaces V
i with V
i
′. Then, S sends the message A
C
C
E
P
T
(
h
(
I
D
i
∥
v
i
∥
a
c
c
e
p
t
∥
v
i
′
∥
S
K
)
) to U
i.
(3)
On receiving the message fromS, U
i computes h
(
I
D
i
∥
v
i
∥
a
c
c
e
p
t
∥
v
i
′
∥
S
K
) and checks whether it is equal to the received A
C
C
E
P
T message or not. If they are equal, U
i replaces N
C with N
C
′ in his database.


## 3.1. Registration

(1)
U
i generates a random number N
C, chooses his password P
W
i, computes v
i
=
h
(
I
D
i
∥
P
W
i
∥
N
C
), and sends {
I
D
i
,
v
i
} to S.
(2)
S computes V
i
=
h
(
I
D
i
∥
k
S
)
⊕
v
i and stores it into his database.


## 3.2. Authentication

(1)
U
i generates a random number d
C and computes R
C
=
d
C
K
S, where K
S
=
k
S
P is the public key of S. Then, U
i sends a message R
E
Q
U
E
S
T
(
I
D
i
,
R
C
) to S.
(2)
On receiving the request message,S chooses a random number d
S and computes Q
S
=
d
S
P, Q
S
C
=
d
S
k
S
-
1
R
C
=
d
S
d
C
P, and V
S
=
h
(
I
D
i
∥
Q
S
∥
Q
S
C
). Finally, S sends the message C
H
A
L
L
E
N
G
E
(
r
e
a
l
m
,
Q
S
,
V
S
) to U
i.
(3)
After receiving the challenge message,U
i computes Q
C
S
=
d
C
Q
S and validates whether V
S
′
=
h
(
I
D
i
∥
Q
S
∥
Q
C
S
) is equal to the received V
S. If it is true, U
i computes v
i
=
h
(
I
D
i
∥
P
W
i
∥
N
C
), V
C
=
h
(
I
D
i
∥
Q
S
∥
r
e
a
l
m
∥
Q
C
S
∥
v
i
), and the common session key S
K
=
h
(
I
D
i
∥
Q
S
∥
Q
C
S
∥
r
e
a
l
m
). Finally, U
i sends the message R
E
S
P
O
N
S
E
(
I
D
i
,
r
e
a
l
m
,
V
C
) to S.
(4)
After receiving the response message,S computes v
i
′
=
V
i
⊕
h
(
I
D
i
∥
k
S
)
=
h
(
I
D
i
∥
P
W
i
∥
N
C
), V
C
′
=
h
(
I
D
i
∥
Q
S
∥
r
e
a
l
m
∥
Q
C
S
∥
v
i
′
) and compares V
C with the received V
C. If it is correct, S agrees on the common session key S
K
=
h
(
I
D
i
∥
Q
S
∥
Q
C
S
∥
r
e
a
l
m
) with U
i.


## 3.3. Password Change

(1)
U
i selects a new random number N
C
′ and a new password P
W
i
′ and computes v
i
′
=
h
(
I
D
i
∥
P
W
i
′
∥
N
C
′
), z
=
h
(
I
D
i
∥
P
W
i
∥
N
C
)
⊕
v
i
′, Z
=
z
⊕
h
(
I
D
i
∥
S
K
), and V
z
=
h
(
I
D
i
∥
v
i
′
∥
S
K
∥
v
i
). Then, U
i sends the message C
H
A
N
G
E
P
W
D
(
I
D
i
,
Z
,
V
z
) to S.
(2)
After receiving the message,S computes v
i
=
V
i
⊕
h
(
I
D
i
∥
k
S
) and v
i
′
=
Z
⊕
v
i
⊕
h
(
I
D
i
∥
S
K
) and verifies whether V
z
′
=
h
(
I
D
i
∥
v
i
′
∥
S
K
∥
v
i
)
=
?
V
z. If it holds, S continues to compute V
i
′
=
V
i
⊕
z
=
h
(
I
D
i
∥
k
S
)
⊕
h
(
I
D
i
∥
P
W
i
′
∥
N
C
′
) and replaces V
i with V
i
′. Then, S sends the message A
C
C
E
P
T
(
h
(
I
D
i
∥
v
i
∥
a
c
c
e
p
t
∥
v
i
′
∥
S
K
)
) to U
i.
(3)
On receiving the message fromS, U
i computes h
(
I
D
i
∥
v
i
∥
a
c
c
e
p
t
∥
v
i
′
∥
S
K
) and checks whether it is equal to the received A
C
C
E
P
T message or not. If they are equal, U
i replaces N
C with N
C
′ in his database.


## 4. Cryptanalysis of Arshad and Nikooghadam’s Scheme

In this section, we present the Arshad and Nikooghadam’s scheme that is vulnerable to key-compromise impersonation and trace attacks and does not provide proper mutual authentication. The following attacks are based on the assumptions that a malicious attackerA has completely monitored over the communication channel connecting U
i and S in login and authentication phase. So A can eavesdrop, modify, insert, or delete any messages transmitted via public channel [22–24].


### 4.1. Key-Compromise Impersonation Attack

Key-compromise impersonation attack means thatA knows the long-term secret key of one participating entity and can impersonate the entity to other participating entities [25]. In Arshad et al.’s scheme, if S’s secret key k
S is compromised by A, he can launch a user impersonation attack as per the following steps.(1)
A compromises S and steals the information {
I
D
i
,
V
i
} kept in S’s database. He then generates a random number d
C
′ and computes R
C
′
=
d
C
′
k
S
P. Finally, he sends the forged message R
E
Q
U
E
S
T
(
I
D
i
,
R
C
′
) to S.
(2)
Once receiving the request message,S generates a random number d
S and computes Q
S
=
d
S
P, Q
S
C
=
d
S
k
S
-
1
P, and V
S
=
h
(
I
D
i
∥
Q
S
∥
Q
S
C
). Finally, he sends the forged message C
H
A
L
L
E
N
G
E
(
r
e
a
l
m
,
Q
S
,
V
S
) to A who impersonates as a legal user.
(3)
After receiving the challenge message,A first checks h
(
I
D
i
∥
Q
S
∥
d
C
′
Q
S
)
=
?
V
S
′. Obviously, the equation holds and A then computes V
C
=
h
(
I
D
i
∥
Q
S
∥
r
e
a
l
m
∥
d
C
′
Q
S
∥
V
i
⊕
h
(
I
D
i
∥
k
S
)
), S
K
=
h
(
I
D
i
∥
Q
S
∥
r
e
a
l
m
∥
d
C
′
Q
S
) and sends the message R
E
S
P
O
N
S
E
(
I
D
i
,
r
e
a
l
m
,
V
C
) to S.
(4)
After receiving the response message,S checks whether h
(
I
D
i
∥
Q
S
∥
r
e
a
l
m
∥
d
C
′
Q
S
∥
V
i
⊕
h
(
I
D
i
∥
k
S
)
) is equal to the received V
C. If it is correct, S negotiates the common session key as S
K
=
h
(
I
D
i
∥
Q
S
∥
r
e
a
l
m
∥
d
C
′
Q
S
) with A (Table 1).Table 1
Registration and authentication phase of Arshad and Nikooghadam’s scheme.
U
i
S
Registration
(1)Generate  N
C
(3)Compute
Compute
v
i = h
(
I
D
i
∥
P
W
i
∥
N
C
).
S
e
c
u
r
e
C
h
a
n
n
e
l
→
S
e
c
S
e
c
2
I
D
i
,
v
i
S
e
c
S
e
c
V
i = v
i
⊕
h
(
I
D
i
∥
k
S
).
Store
I
D
i
,
V
i.
Authentication
(1)Generate  d
C
(3)Generate  d
S
R
C = d
C
K
S.
Q
S = d
S
P,
→
2
R
E
Q
U
E
S
T
I
D
i
,
R
C
Q
S
C = d
S
k
S
-
1
R
C,
V
S = h
(
I
D
i
∥
Q
S
∥
Q
S
C
).
←
4
C
H
A
L
L
E
N
G
E
(
r
e
a
l
m
,
Q
S
,
V
S
)
(5)Q
C
S = d
C
Q
S,
(7)v
i = V
i
⊕
h
(
I
D
i
∥
k
S
),
h
(
I
D
i
∥
Q
S
∥
Q
C
S
)
=
?
V
S,
v
i = h
(
I
D
i
∥
P
W
i
∥
N
C
),
h
(
I
D
i
∥
Q
S
∥
r
e
a
l
m
∥
Q
C
S
∥
v
i
)
=
?
V
C,
V
C = h
(
I
D
i
∥
Q
S
∥
r
e
a
l
m
∥
Q
C
S
∥
v
i
),
S
K = h
(
I
D
i
∥
Q
S
∥
Q
C
S
∥
r
e
a
l
m
).
S
K = h
(
I
D
i
∥
Q
S
∥
Q
C
S
∥
r
e
a
l
m
).
→
6
R
E
S
P
O
N
S
E
(
r
e
a
l
m
,
I
D
i
,
V
C
)In this way,S believes that he has successfully established the session key with U
i whereas it is the adversary who is making fool of S by imitating the legal user.


### 4.2. Trace Attack

In the authentication phase of Arshad and Nikooghadam’s scheme, the userU
i sends the request messages containing the user’s identity I
D
i to S without any protection. Since the user’s identity I
D
i is sent over an open communication channel, A may intercept the message using the assumed capability. With the user’s identity I
D
i, A can trace it to know what kind of services the user accesses and how long the user logins into the system. Since S may have the system log recording what the user did, the user’s privacy may be leaked. Furthermore, A may trace the user’s location according to the user’s IP address. The trace attack seriously invades the user’s privacy and can be utilized to commit real crimes such as kidnappings.


### 4.3. Lack of Proper Mutual Authentication

(1)
A eavesdrops the message R
E
Q
U
E
S
T
(
I
D
i
,
R
C
), and then A generates a random number d
C
′ and computes R
C
′
=
d
C
′
K
S.
(2)
A sends the forged message (
I
D
i
,
R
C
′
) to S. Obviously, S will accept A’s request because S does not verify the validity of the request message from U. Then, S generates a random number d
S and computes Q
S
=
d
S
P,  Q
S
C
′
=
d
S
k
S
-
1
R
C
′
=
d
S
R
C
′, V
S
′
=
h
(
I
D
i
∥
Q
S
∥
Q
S
C
′
). Then, S delivers the message C
H
A
L
L
E
N
G
E
(
r
e
a
l
m
,
Q
S
,
V
S
′
) to A who masquerades as a legal user.
(3)
After receiving the message fromS, A computes Q
C
S
′
=
d
C
′
Q
S and checks whether V
S
=
h
(
I
D
i
∥
Q
S
∥
Q
C
S
) is equal to the received V
S
′. If it is true, A continues to compute V
C
′
=
h
(
I
D
i
∥
Q
S
∥
r
e
a
l
m
∥
Q
C
S
′
∥
v
i
′
), S
K
=
h
(
I
D
i
∥
Q
S
∥
Q
C
S
′
∥
r
e
a
l
m
), where v
i
=
h
(
I
D
i
∥
P
W
i
′
∥
N
C
′
); both P
W
i
′ and N
C
′ are the forged password and random number. Then, A delivers the message R
E
S
P
O
N
S
E
(
r
e
a
l
m
,
I
D
i
,
V
C
′
) to S.
(4)
Upon receiving the message fromA who masquerades as a legal user, S computes v
i
=
V
i
⊕
h
(
I
D
i
∥
k
S
), h
(
I
D
i
∥
Q
S
∥
r
e
a
l
m
∥
Q
S
C
∥
v
i
) and compares it with the received V
C. It is obvious that they are not equal, and then S immediately stops session.In this condition, any one can forge and send the request message toS, which leads to S thinking U
i is a cheater, whereas U
i is actually an honest user. This obviously results in making great consumption of computing resources and communication resources.


## 4.1. Key-Compromise Impersonation Attack

Key-compromise impersonation attack means thatA knows the long-term secret key of one participating entity and can impersonate the entity to other participating entities [25]. In Arshad et al.’s scheme, if S’s secret key k
S is compromised by A, he can launch a user impersonation attack as per the following steps.(1)
A compromises S and steals the information {
I
D
i
,
V
i
} kept in S’s database. He then generates a random number d
C
′ and computes R
C
′
=
d
C
′
k
S
P. Finally, he sends the forged message R
E
Q
U
E
S
T
(
I
D
i
,
R
C
′
) to S.
(2)
Once receiving the request message,S generates a random number d
S and computes Q
S
=
d
S
P, Q
S
C
=
d
S
k
S
-
1
P, and V
S
=
h
(
I
D
i
∥
Q
S
∥
Q
S
C
). Finally, he sends the forged message C
H
A
L
L
E
N
G
E
(
r
e
a
l
m
,
Q
S
,
V
S
) to A who impersonates as a legal user.
(3)
After receiving the challenge message,A first checks h
(
I
D
i
∥
Q
S
∥
d
C
′
Q
S
)
=
?
V
S
′. Obviously, the equation holds and A then computes V
C
=
h
(
I
D
i
∥
Q
S
∥
r
e
a
l
m
∥
d
C
′
Q
S
∥
V
i
⊕
h
(
I
D
i
∥
k
S
)
), S
K
=
h
(
I
D
i
∥
Q
S
∥
r
e
a
l
m
∥
d
C
′
Q
S
) and sends the message R
E
S
P
O
N
S
E
(
I
D
i
,
r
e
a
l
m
,
V
C
) to S.
(4)
After receiving the response message,S checks whether h
(
I
D
i
∥
Q
S
∥
r
e
a
l
m
∥
d
C
′
Q
S
∥
V
i
⊕
h
(
I
D
i
∥
k
S
)
) is equal to the received V
C. If it is correct, S negotiates the common session key as S
K
=
h
(
I
D
i
∥
Q
S
∥
r
e
a
l
m
∥
d
C
′
Q
S
) with A (Table 1).Table 1
Registration and authentication phase of Arshad and Nikooghadam’s scheme.
U
i
S
Registration
(1)Generate  N
C
(3)Compute
Compute
v
i = h
(
I
D
i
∥
P
W
i
∥
N
C
).
S
e
c
u
r
e
C
h
a
n
n
e
l
→
S
e
c
S
e
c
2
I
D
i
,
v
i
S
e
c
S
e
c
V
i = v
i
⊕
h
(
I
D
i
∥
k
S
).
Store
I
D
i
,
V
i.
Authentication
(1)Generate  d
C
(3)Generate  d
S
R
C = d
C
K
S.
Q
S = d
S
P,
→
2
R
E
Q
U
E
S
T
I
D
i
,
R
C
Q
S
C = d
S
k
S
-
1
R
C,
V
S = h
(
I
D
i
∥
Q
S
∥
Q
S
C
).
←
4
C
H
A
L
L
E
N
G
E
(
r
e
a
l
m
,
Q
S
,
V
S
)
(5)Q
C
S = d
C
Q
S,
(7)v
i = V
i
⊕
h
(
I
D
i
∥
k
S
),
h
(
I
D
i
∥
Q
S
∥
Q
C
S
)
=
?
V
S,
v
i = h
(
I
D
i
∥
P
W
i
∥
N
C
),
h
(
I
D
i
∥
Q
S
∥
r
e
a
l
m
∥
Q
C
S
∥
v
i
)
=
?
V
C,
V
C = h
(
I
D
i
∥
Q
S
∥
r
e
a
l
m
∥
Q
C
S
∥
v
i
),
S
K = h
(
I
D
i
∥
Q
S
∥
Q
C
S
∥
r
e
a
l
m
).
S
K = h
(
I
D
i
∥
Q
S
∥
Q
C
S
∥
r
e
a
l
m
).
→
6
R
E
S
P
O
N
S
E
(
r
e
a
l
m
,
I
D
i
,
V
C
)In this way,S believes that he has successfully established the session key with U
i whereas it is the adversary who is making fool of S by imitating the legal user.


## 4.2. Trace Attack

In the authentication phase of Arshad and Nikooghadam’s scheme, the userU
i sends the request messages containing the user’s identity I
D
i to S without any protection. Since the user’s identity I
D
i is sent over an open communication channel, A may intercept the message using the assumed capability. With the user’s identity I
D
i, A can trace it to know what kind of services the user accesses and how long the user logins into the system. Since S may have the system log recording what the user did, the user’s privacy may be leaked. Furthermore, A may trace the user’s location according to the user’s IP address. The trace attack seriously invades the user’s privacy and can be utilized to commit real crimes such as kidnappings.


## 4.3. Lack of Proper Mutual Authentication

(1)
A eavesdrops the message R
E
Q
U
E
S
T
(
I
D
i
,
R
C
), and then A generates a random number d
C
′ and computes R
C
′
=
d
C
′
K
S.
(2)
A sends the forged message (
I
D
i
,
R
C
′
) to S. Obviously, S will accept A’s request because S does not verify the validity of the request message from U. Then, S generates a random number d
S and computes Q
S
=
d
S
P,  Q
S
C
′
=
d
S
k
S
-
1
R
C
′
=
d
S
R
C
′, V
S
′
=
h
(
I
D
i
∥
Q
S
∥
Q
S
C
′
). Then, S delivers the message C
H
A
L
L
E
N
G
E
(
r
e
a
l
m
,
Q
S
,
V
S
′
) to A who masquerades as a legal user.
(3)
After receiving the message fromS, A computes Q
C
S
′
=
d
C
′
Q
S and checks whether V
S
=
h
(
I
D
i
∥
Q
S
∥
Q
C
S
) is equal to the received V
S
′. If it is true, A continues to compute V
C
′
=
h
(
I
D
i
∥
Q
S
∥
r
e
a
l
m
∥
Q
C
S
′
∥
v
i
′
), S
K
=
h
(
I
D
i
∥
Q
S
∥
Q
C
S
′
∥
r
e
a
l
m
), where v
i
=
h
(
I
D
i
∥
P
W
i
′
∥
N
C
′
); both P
W
i
′ and N
C
′ are the forged password and random number. Then, A delivers the message R
E
S
P
O
N
S
E
(
r
e
a
l
m
,
I
D
i
,
V
C
′
) to S.
(4)
Upon receiving the message fromA who masquerades as a legal user, S computes v
i
=
V
i
⊕
h
(
I
D
i
∥
k
S
), h
(
I
D
i
∥
Q
S
∥
r
e
a
l
m
∥
Q
S
C
∥
v
i
) and compares it with the received V
C. It is obvious that they are not equal, and then S immediately stops session.In this condition, any one can forge and send the request message toS, which leads to S thinking U
i is a cheater, whereas U
i is actually an honest user. This obviously results in making great consumption of computing resources and communication resources.


## 5. Proposed Authentication Scheme for SIP

In this section, we propose a novel mutual authentication scheme based on ECC, which consists of three phases: registration, authentication, and password change.


### 5.1. Registration

(1)
U
i freely selects his password P
W
i and his own secret key k
U
i and generates a random number r
1. Then U
i computes P
W
D
=
h
(
P
W
i
∥
k
U
i
) and submits {
I
D
i
,
r
1
,
P
W
D
} to S through a secure channel.
(2)
S computes V
P
W
=
h
(
I
D
i
∥
P
W
D
∥
r
1
)
⊕
h
(
k
S
) and stores V
P
W in his database, where k
S is S’s secret key.


### 5.2. Authentication

(1)
U
i generates a random number r
2 and computes T
=
h
(
I
D
i
∥
P
W
D
∥
r
1
), R
=
r
2
P,  M
1
=
T
r
2
P,  A
I
D
=
I
D
i
⊕
T, and M
2
=
h
(
I
D
i
∥
R
). Then, U
i sends the message R
E
Q
U
E
S
T
(
M
1
,
A
I
D
,
M
2
) to S.
(2)
On receipt of the request message fromU
i, S derives T from V
P
W by computing V
P
W
⊕
h
(
k
S
) and then he computes I
D
i
′
=
A
I
D
⊕
T
′ and R
′
=
T
-
1
M
1 and checks whether M
2
′
=
h
(
I
D
i
′
∥
R
′
)
=
?
M
2 holds or not. If it does not hold, S rejects the request. Otherwise, S generates a random number r
3 and computes H
=
r
3
P, M
3
=
I
D
i
⊕
H, S
K
S
=
r
3
P, and A
u
t
h
S
=
h
(
S
K
S
∥
T
∥
R
). Finally, S sends the message C
H
A
L
L
E
N
G
E
(
r
e
a
l
m
,
M
3
,
A
u
t
h
S
) to U
i.
(3)
Upon receiving the challenge message fromS, U
i retrieves H by computing M
3
⊕
I
D
i and then he computes S
K
U
i
=
r
2
H and verifies whether A
u
t
h
S
′
=
h
(
S
K
U
i
∥
T
∥
R
) is equal to the received A
u
t
h
S. If it is not correct, U
i stops the session. Otherwise, U
i computes A
u
t
h
U
i
=
h
(
S
K
U
i
∥
T
∥
H
) and then sends the message R
E
S
P
O
N
S
E
(
r
e
a
l
m
,
A
u
t
h
U
i
) to S.
(4)
When receiving the response message fromU
i, S checks if A
u
t
h
U
i
′
=
h
(
S
K
S
∥
T
∥
H
)
=
?
A
u
t
h
U
i. If so, the session key shared between U
i and S is set as S
K
=
S
K
U
i
=
S
K
S (Table 2).Table 2
Registration and authentication phase of our scheme.
U
i
S
Registration
(1)Generate  r
1
(3)Compute
P
W
D = h
(
P
W
U
i
∥
k
U
i
).
T = h
(
I
D
i
∥
r
1
∥
P
W
D
),
S
e
c
u
r
e
C
h
a
n
n
e
l
→
S
e
c
S
e
c
2
I
D
i
,
r
1
,
P
W
D
S
e
c
S
e
c
V
P
W = T
⊕
h
(
k
S
).
S
t
o
r
e
V
P
W.
Authentication
(1)Generate
r
2
(2)Compute
T = h
(
I
D
i
∥
r
1
∥
P
W
D
),
T = V
P
W
⊕
h
(
k
S
),
R = r
2
P,
I
D
i = A
I
D
⊕
T,
M
1 = T
·
r
2
P,
R = T
-
1
M
1,
A
I
D = I
D
i
⊕
T,
→
R
E
Q
U
E
S
T
(
M
1
,
A
I
D
,
M
2
)
h
R
∥
I
D
i
=
?
M
2,
M
2 = h
(
R
∥
I
D
i
).
Generate  r
3
H = r
3
P,
(3)H = M
3
⊕
I
D
i,
M
3 = I
D
i
⊕
H,
S
K
U
i = r
2
H,
←
C
H
A
L
L
E
N
G
E
(
r
e
a
l
m
,
M
3
,
A
u
t
h
S
)
S
K
S = r
3
R,
h
(
S
K
U
i
∥
T
∥
R
=
?
A
u
t
h
S,
A
u
t
h
S = h
(
S
K
S
∥
T
∥
R
).
(4)h
(
S
K
S
∥
T
∥
H
) = A
u
t
h
U
i
A
u
t
h
U
i = h
(
S
K
U
i
∥
T
∥
H
).
→
R
E
S
P
O
N
S
E
(
r
e
a
l
m
,
A
u
t
h
U
i
)
S
K = S
K
U
i = S
K
S


### 5.3. Password Change

In this subsection,U
i can change his password any time when he wants. U
i chooses a new password P
W
i
n
e
w, a new secret key k
U
i
n
e
w, and a new random number r
1
n
e
w. Then the following process will be performed by U
i and S.(1)
U
i submits the message h
(
h
I
D
i
∥
r
1
∥
h
P
W
i
∥
r
1
∥
S
K
) and h
(
I
D
i
∥
r
1
n
e
w
∥
h
(
P
W
i
n
e
w
∥
r
1
n
e
w
)
) to S.
(2)
S computes h
(
h
(
V
P
W
⊕
h
(
k
S
)
)
∥
S
K
) and checks whether it is equal to the received h
(
h
(
I
D
i
∥
r
1
∥
h
(
P
W
i
∥
r
1
)
∥
S
K
)
). If it is correct, S computes V
P
W
n
e
w
=
S
K
⊕
h
(
I
D
i
∥
r
1
n
e
w
∥
h
P
W
i
n
e
w
∥
r
1
n
e
w
)
⊕
S
K
⊕
h
(
k
S
) and then replaces V
P
W with V
P
W
n
e
w.


## 5.1. Registration

(1)
U
i freely selects his password P
W
i and his own secret key k
U
i and generates a random number r
1. Then U
i computes P
W
D
=
h
(
P
W
i
∥
k
U
i
) and submits {
I
D
i
,
r
1
,
P
W
D
} to S through a secure channel.
(2)
S computes V
P
W
=
h
(
I
D
i
∥
P
W
D
∥
r
1
)
⊕
h
(
k
S
) and stores V
P
W in his database, where k
S is S’s secret key.


## 5.2. Authentication

(1)
U
i generates a random number r
2 and computes T
=
h
(
I
D
i
∥
P
W
D
∥
r
1
), R
=
r
2
P,  M
1
=
T
r
2
P,  A
I
D
=
I
D
i
⊕
T, and M
2
=
h
(
I
D
i
∥
R
). Then, U
i sends the message R
E
Q
U
E
S
T
(
M
1
,
A
I
D
,
M
2
) to S.
(2)
On receipt of the request message fromU
i, S derives T from V
P
W by computing V
P
W
⊕
h
(
k
S
) and then he computes I
D
i
′
=
A
I
D
⊕
T
′ and R
′
=
T
-
1
M
1 and checks whether M
2
′
=
h
(
I
D
i
′
∥
R
′
)
=
?
M
2 holds or not. If it does not hold, S rejects the request. Otherwise, S generates a random number r
3 and computes H
=
r
3
P, M
3
=
I
D
i
⊕
H, S
K
S
=
r
3
P, and A
u
t
h
S
=
h
(
S
K
S
∥
T
∥
R
). Finally, S sends the message C
H
A
L
L
E
N
G
E
(
r
e
a
l
m
,
M
3
,
A
u
t
h
S
) to U
i.
(3)
Upon receiving the challenge message fromS, U
i retrieves H by computing M
3
⊕
I
D
i and then he computes S
K
U
i
=
r
2
H and verifies whether A
u
t
h
S
′
=
h
(
S
K
U
i
∥
T
∥
R
) is equal to the received A
u
t
h
S. If it is not correct, U
i stops the session. Otherwise, U
i computes A
u
t
h
U
i
=
h
(
S
K
U
i
∥
T
∥
H
) and then sends the message R
E
S
P
O
N
S
E
(
r
e
a
l
m
,
A
u
t
h
U
i
) to S.
(4)
When receiving the response message fromU
i, S checks if A
u
t
h
U
i
′
=
h
(
S
K
S
∥
T
∥
H
)
=
?
A
u
t
h
U
i. If so, the session key shared between U
i and S is set as S
K
=
S
K
U
i
=
S
K
S (Table 2).Table 2
Registration and authentication phase of our scheme.
U
i
S
Registration
(1)Generate  r
1
(3)Compute
P
W
D = h
(
P
W
U
i
∥
k
U
i
).
T = h
(
I
D
i
∥
r
1
∥
P
W
D
),
S
e
c
u
r
e
C
h
a
n
n
e
l
→
S
e
c
S
e
c
2
I
D
i
,
r
1
,
P
W
D
S
e
c
S
e
c
V
P
W = T
⊕
h
(
k
S
).
S
t
o
r
e
V
P
W.
Authentication
(1)Generate
r
2
(2)Compute
T = h
(
I
D
i
∥
r
1
∥
P
W
D
),
T = V
P
W
⊕
h
(
k
S
),
R = r
2
P,
I
D
i = A
I
D
⊕
T,
M
1 = T
·
r
2
P,
R = T
-
1
M
1,
A
I
D = I
D
i
⊕
T,
→
R
E
Q
U
E
S
T
(
M
1
,
A
I
D
,
M
2
)
h
R
∥
I
D
i
=
?
M
2,
M
2 = h
(
R
∥
I
D
i
).
Generate  r
3
H = r
3
P,
(3)H = M
3
⊕
I
D
i,
M
3 = I
D
i
⊕
H,
S
K
U
i = r
2
H,
←
C
H
A
L
L
E
N
G
E
(
r
e
a
l
m
,
M
3
,
A
u
t
h
S
)
S
K
S = r
3
R,
h
(
S
K
U
i
∥
T
∥
R
=
?
A
u
t
h
S,
A
u
t
h
S = h
(
S
K
S
∥
T
∥
R
).
(4)h
(
S
K
S
∥
T
∥
H
) = A
u
t
h
U
i
A
u
t
h
U
i = h
(
S
K
U
i
∥
T
∥
H
).
→
R
E
S
P
O
N
S
E
(
r
e
a
l
m
,
A
u
t
h
U
i
)
S
K = S
K
U
i = S
K
S


## 5.3. Password Change

In this subsection,U
i can change his password any time when he wants. U
i chooses a new password P
W
i
n
e
w, a new secret key k
U
i
n
e
w, and a new random number r
1
n
e
w. Then the following process will be performed by U
i and S.(1)
U
i submits the message h
(
h
I
D
i
∥
r
1
∥
h
P
W
i
∥
r
1
∥
S
K
) and h
(
I
D
i
∥
r
1
n
e
w
∥
h
(
P
W
i
n
e
w
∥
r
1
n
e
w
)
) to S.
(2)
S computes h
(
h
(
V
P
W
⊕
h
(
k
S
)
)
∥
S
K
) and checks whether it is equal to the received h
(
h
(
I
D
i
∥
r
1
∥
h
(
P
W
i
∥
r
1
)
∥
S
K
)
). If it is correct, S computes V
P
W
n
e
w
=
S
K
⊕
h
(
I
D
i
∥
r
1
n
e
w
∥
h
P
W
i
n
e
w
∥
r
1
n
e
w
)
⊕
S
K
⊕
h
(
k
S
) and then replaces V
P
W with V
P
W
n
e
w.


## 6. Analysis Security

In this section, we first adopt Burrows-Abadi-Needham (BAN) logic [26] to demonstrate that the proposed scheme is working correctly by achieving the authentication goals. Then, we conduct a security analysis of the enhanced scheme through both the informal and formal analyses.BAN Logic Notations
A
|
≡
X: A believes a statement X
U
i
↔
K
S: share a key K between U
i and S
#
X: X is fresh
A
⊲
X: A sees X
A
|
~
X: A said X
{
X
,
Y
}
K: X and Y are encrypted with the key K
(
X
,
Y
)
K: X and Y are hashed with the key K
X
K: X is xor-ed with the key K.


### 6.1. Verifying Authentication Scheme with BAN Logic

BAN logic [26] is a set of rules for defining and analyzing information exchange schemes. It helps its users determine whether exchanged information is trustworthy, secured against eavesdropping, or both. It has been highly successful in analyzing the security of authentication schemes [27, 28]. In this subsection, we prove that a session key between communicating parties can be correctly generated within authentication process using BAN logic. First, we introduce some notations and logical postulates of BAN logic that we will use in our scheme.(1)
BAN logical postulates the following.
(a)
Message-meaning ruleA
|
≡
A
↔
K
B
,
A
⊲
{
X
}
K
/
A
|
≡
|
B
~
X: if A believes that the key K is shared by A and B and sees X encrypted with K, then A believes that B once said X.
(b)
Nonce-verification ruleA
|
≡
#
X
,
A
|
≡
B
|
~
X
/
A
|
≡
B
|
≡
X: if A believes that X could have been uttered only recently and that B once said X, then A believes that B believes X.
(c)
The belief ruleA
|
≡
X
,
A
|
≡
Y
/
A
|
≡
(
X
,
Y
): if A believes X and Y, then A believes (
X
,
Y
).
(d)
Fresh conjuncatenation ruleA
|
≡
#
X
/
A
|
≡
#
(
X
,
Y
): if A believes freshness of X, B believes freshness of (
X
,
Y
).
(e)
Jurisdiction ruleA
|
≡
B
⇒
X
,
A
|
≡
B
|
≡
X
/
A
|
≡
X: if A believes that B has jurisdiction over X and A believes B on the truth of X, then A believes X.
(2)
Idealized scheme:
U
i: R
U
i
↔
T
S, I
D
i
U
i
↔
T
S
,
(
I
D
i
)
R,  (
U
i
↔
S
K
S
,
H
)
U
i
↔
T
S,
S: (
U
i
↔
S
K
S
,
R
)
U
i
↔
T
S, I
D
i
H.
(3)
Establishment of security goals:
(g
1)
S
|
≡
U
i
|
≡
U
i
↔
S
K
S,
(g
2)
S
|
≡
U
i
↔
S
K
S,
(g
3)
U
i
|
≡
S
|
≡
U
i
↔
S
K
S,
(g
4)
U
i
|
≡
U
i
↔
S
K
S.
(4)
Initiative premises:
(p
1)
U
i
|
≡
#
r
1,
(p
2)
U
i
|
≡
#
r
2,
(p
3)
S
|
≡
#
r
3,
(p
4)
U
i
|
≡
U
i
↔
T
S,
(p
5)
S
|
≡
U
i
↔
T
S,
(p
6)
U
i
|
≡
S
⇒
(
U
i
↔
S
K
S
),
(p
7)
S
|
≡
U
i
⇒
(
U
i
↔
S
K
S
).
(5)
Scheme analysis: consider the following.
(a
1)
Sincep
4 and U
i
⊲
(
U
i
↔
S
K
S
,
R
)
U
i
↔
T
S, we apply the message-meaning rule to obtain U
i
|
≡
S
|
~
(
U
i
↔
S
K
S
,
R
).
(a
2)
Sincep
2 and a
1, we apply the fresh conjuncatenation rule and nonce-verification rule to obtain U
i
|
≡
S
|
≡
(
U
i
↔
S
K
S
,
R
).
(g
1)
Sincea
2, we apply the belief rule to obtain U
i
|
≡
S
|
≡
U
i
↔
S
K
S.
(g
2)
Sincep
6 and g
1, we apply the jurisdiction rule to obtain U
i
|
≡
U
i
↔
S
K
S.
(a
3)
Sincep
5 and S
⊲
(
U
i
↔
S
K
S
,
H
)
U
i
↔
T
S, we apply the message-meaning rule to obtain S
|
≡
U
i
|
~
(
U
i
↔
S
K
S
,
H
).
(a
4)
Sincep
3 and a
3,  we apply the fresh conjuncatenation rule and nonce-verification rule to obtain S
|
≡
U
i
|
≡
(
U
i
↔
S
K
S
,
H
).
(g
3)
Sincea
4, we apply the belief rule to obtain S
|
≡
U
i
|
≡
U
i
↔
S
K
S.
(g
4)
Sinceg
3 and p
7, we apply the jurisdiction rule to obtain S
|
≡
U
i
↔
S
K
S.By analyzing the security of our scheme with BAN logic, the results demonstrate that the proposed scheme can effectively achieve the security goal of the mutual authentication ofU
i and S.


### 6.2. Informal Security Analysis

In this subsection, we will examine whether the enhanced scheme is safe and consider its ability to resist various known attacks. The following attacks are also based on the assumptions that a malicious adversaryA has total control over the communication channel connecting U
i and S in authentication phase. So A can intercept, insert, delete, or modify any messages transmitted via public channel [22–24].


### 6.3. User is Anonymous and Untraceable

SupposeA eavesdrops the request messages R
E
Q
U
E
S
T
(
M
1
,
A
I
D
,
M
2
), the challenge message C
H
A
L
L
E
N
G
E
(
r
e
a
l
m
,
M
3
,
A
u
t
h
S
), and the response message R
E
S
P
O
N
S
E
(
r
e
a
l
m
,
A
u
t
h
U
i
) from the public channel. To obtain I
D
i from these values by means of guessing and verifying, A must have the knowledge of {
{
P
W
i
,
r
1
,
k
U
i
}
,
{
r
3
}
,
{
r
2
}
}. Due to U
i and S compute different M
1 and M
3 with a new random number (
r
1
,
r
2
) and r
3 for each session, and A is not able to trace who communicates with S by monitoring the channel. This shows the proposed scheme provides the attribute of anonymous.


### 6.4. Insider Attack

In our scheme, it is computationally impossible to derive the passwordP
W
i from the P
W
D
=
h
(
P
W
i
∥
k
U
i
) because of the difficulties of hash function with the secret key k
U
i of U
i. Therefore, the proposed scheme can withstand the insider attack.


### 6.5. Perfect Forward Secrecy

IfU
i’s password P
W
i, the secret key k
U
i, and S’s secret key k
S are all compromised, this does not allow A to determine the session key S
K for the past session. A cannot compute r
1
r
2
P from M
1 and M
3 because of secure one-way hash function andECDLP.


### 6.6. Mutual Authentication

In our scheme,S and U
i can authenticate each other by checking M
2, A
u
t
h
U
i, and A
u
t
h
S, separately. Therefore, our scheme can provide mutual authentication.


### 6.7. Key-Compromise Impersonation Attack

Assume thatA intercepts the request, the challenge, and the response messages. Supposing the secret key k
U
i of U
i is compromised by A, he cannot go through the verification process of U as the random number r
1 is not known. On the other hand, supposing the secret key k
S of S is compromised by A, he cannot impersonate U to cheat S. Since A cannot know the values of the identity I
D
i and r
1 of U
i, he cannot compute the correct value T and hence cannot be authenticated by S. Therefore, the proposed scheme can withstand the key-compromise impersonation attack.


### 6.8. Replay Attack

Assuming thatA eavesdrops R
E
Q
U
E
S
T
(
M
1
,
A
I
D
,
M
2
) and replays it to impersonate U
i, S then verifies the condition M
2
=
?
h
(
r
2
P
∥
I
D
i
). The message verification does not hold, so try to guess r
2 from R is theECDLP and r
2 is different in each authentication message. On the other hand, suppose A eavesdrops C
H
A
L
L
E
N
G
E
(
r
e
a
l
m
,
M
3
,
A
u
t
h
S
) and replays it to impersonate S. The replied message cannot pass the verification process A
u
t
h
S
=
h
(
S
K
S
∥
h
(
I
D
i
∥
P
W
D
∥
r
1
)
∥
r
2
P
), since both r
1 and r
2 are new random numbers chosen by U
i in each session, and A has no control of it. Therefore, A has no opportunity to successfully replay used messages.


### 6.9. Offline Password Guessing Attack

Even ifA intercepts all the exchanged messages (
M
1
,
M
2
,
A
I
D
,
M
3
,
A
u
t
h
U
i
,
A
u
t
h
S
) by passive attack, he cannot guess the correct password of U
i. Since A cannot know the values of the user’s identity I
D
i, the secret key k
U
i, and the random number r
1, he cannot compute the value T
=
h
(
I
D
i
∥
r
1
∥
h
(
P
W
i
∥
k
U
i
)
) to verify the guessed password P
W
i through the recorded messages. Therefore, our scheme can resist the offline password guessing attack.


### 6.10. Known Session Key Security

Because of the randomness and independence of the generations ofr
1 and r
3 in all the sessions, the session key S
K
=
r
1
r
3
P of each session is independent of that of any other sessions. Therefore, the proposed scheme can ensure known session key security.


### 6.11. Formal Security Analysis of the Proposed Scheme

In this subsection, we provide the formal security analysis of our scheme and show that our scheme is secure. We first define the following oracles.Reveal 1.
This random oracle will unconditionally output the inputx from the given hash value y
=
h
(
x
).Reveal 2.
This random oracle will unconditionally outputm from given points P and Q
=
m
P in an elliptic curve E
p
(
a
,
b
).Theorem 1.
Under theECDLP assumption, our scheme is secure against an adversary A for deriving the identity I
D
i and password P
W
i of a legal user U
i and the session key S
K between U
i and S if the hash function h
(
·
) closely behaves like a random oracle.Proof.
The formal security proof of our scheme is similar to that as in [29–31]. A runs the experimental algorithm showed in Algorithm 1,  E
X
P
H
A
S
H
,
E
C
D
L
P
R
E
A
S
S
I
P
,
A for our robust, and efficient authentication scheme for session initiation protocol; sayREASSIP.
Define the success probability forE
X
P
H
A
S
H
,
E
C
D
L
P
R
E
A
S
S
I
P
,
A as S
u
c
c
H
A
S
H
,
E
C
D
L
P
R
E
A
S
S
I
P
,
A
=
|
2
P
r
[
E
X
P
H
A
S
H
,
E
C
D
L
P
R
E
A
S
S
I
P
,
A
=
1
]
-
1
| and the advantage function for this experiment then becomes A
d
v
H
A
S
H
,
E
C
D
L
P
R
E
A
S
S
I
P
,
A
(
t
,
q
R
1
,
q
R
2
)
=
ma
x
A
S
u
c
c
H
A
S
H
,
E
C
D
L
P
R
E
A
S
S
I
P, where the maximum is taken over all A with execution time t, and the number of queries q
R
1
,
q
R
2 made to the Reveal 1 and Reveal 2 oracles, respectively. If A has the ability to solve the hash function and theECDLP, then he can directly derive U
i’s identity I
D
i, password P
W
i, and the session key S
K between U
i and S. In this case, A will discover the complete connections between U
i and S. However, it is a computationally infeasible problem to invert the input from a given hash value and output m from given points P
,
Q; that is, A
d
v
H
A
S
H
A
(
t
1
)
≤
ϵ, A
d
v
E
C
D
L
P
A
(
t
2
)
≤
ϵ, ∀
ϵ
>
0. Hence, we have A
d
v
H
A
S
H
,
E
C
D
L
P
R
E
A
S
S
I
P
,
A
(
t
,
q
R
1
,
q
R
2
)
≤
ϵ, as it is dependent on A
d
v
H
A
S
H
A
(
t
1
) and A
d
v
E
C
D
L
P
A
(
t
2
). Therefore, our scheme is probably secure against A for deriving I
D
i, P
W
i, and S
K.Algorithm 1:Algorithm E
X
P
H
A
S
H
,
E
C
D
L
P
R
E
A
S
S
I
P
,
A.
(1)    Eavesdrop request messageR
E
Q
U
E
S
T
(
M
1
,
A
I
D
,
M
2
)
(2)   Call the reveal oracle 2. Let(
T
′
,
r
2
′
)
←
R
e
v
e
a
l
2
(
M
1
)
(3)   Call the reveal oracle 1. Let(
I
D
i
′
,
P
W
i
′
,
r
1
′
)
←
R
e
v
e
a
l
1
(
T
′
)
(4)   Eavesdrop challenge messageC
H
A
L
L
E
N
G
E
(
r
e
a
l
m
,
M
3
,
Auth
S
)
(5)   Call the reveal oracle 1. Let (S
K
′
,
T
′
′
,
R
′
)
←
R
e
v
e
a
l
1
(
A
u
t
h
S
)
(6)   Call the reveal oracle 2. Let(
r
2
′
′
)
←
R
e
v
e
a
l
2
(
R
′
)
(7)if  (r
2
′ = r
2
′
′)  then
(8)    Accept the derivedI
D
i
′, P
W
i
′, and S
K
′ as the correct I
D
i and P
W
i of the user U
i
(9)    and the session keyS
K between U
i and S, respectively
(10)
return 1 (success)
(11)else
(12)
return 0 (failure)
(13)end if


## 6.1. Verifying Authentication Scheme with BAN Logic

BAN logic [26] is a set of rules for defining and analyzing information exchange schemes. It helps its users determine whether exchanged information is trustworthy, secured against eavesdropping, or both. It has been highly successful in analyzing the security of authentication schemes [27, 28]. In this subsection, we prove that a session key between communicating parties can be correctly generated within authentication process using BAN logic. First, we introduce some notations and logical postulates of BAN logic that we will use in our scheme.(1)
BAN logical postulates the following.
(a)
Message-meaning ruleA
|
≡
A
↔
K
B
,
A
⊲
{
X
}
K
/
A
|
≡
|
B
~
X: if A believes that the key K is shared by A and B and sees X encrypted with K, then A believes that B once said X.
(b)
Nonce-verification ruleA
|
≡
#
X
,
A
|
≡
B
|
~
X
/
A
|
≡
B
|
≡
X: if A believes that X could have been uttered only recently and that B once said X, then A believes that B believes X.
(c)
The belief ruleA
|
≡
X
,
A
|
≡
Y
/
A
|
≡
(
X
,
Y
): if A believes X and Y, then A believes (
X
,
Y
).
(d)
Fresh conjuncatenation ruleA
|
≡
#
X
/
A
|
≡
#
(
X
,
Y
): if A believes freshness of X, B believes freshness of (
X
,
Y
).
(e)
Jurisdiction ruleA
|
≡
B
⇒
X
,
A
|
≡
B
|
≡
X
/
A
|
≡
X: if A believes that B has jurisdiction over X and A believes B on the truth of X, then A believes X.
(2)
Idealized scheme:
U
i: R
U
i
↔
T
S, I
D
i
U
i
↔
T
S
,
(
I
D
i
)
R,  (
U
i
↔
S
K
S
,
H
)
U
i
↔
T
S,
S: (
U
i
↔
S
K
S
,
R
)
U
i
↔
T
S, I
D
i
H.
(3)
Establishment of security goals:
(g
1)
S
|
≡
U
i
|
≡
U
i
↔
S
K
S,
(g
2)
S
|
≡
U
i
↔
S
K
S,
(g
3)
U
i
|
≡
S
|
≡
U
i
↔
S
K
S,
(g
4)
U
i
|
≡
U
i
↔
S
K
S.
(4)
Initiative premises:
(p
1)
U
i
|
≡
#
r
1,
(p
2)
U
i
|
≡
#
r
2,
(p
3)
S
|
≡
#
r
3,
(p
4)
U
i
|
≡
U
i
↔
T
S,
(p
5)
S
|
≡
U
i
↔
T
S,
(p
6)
U
i
|
≡
S
⇒
(
U
i
↔
S
K
S
),
(p
7)
S
|
≡
U
i
⇒
(
U
i
↔
S
K
S
).
(5)
Scheme analysis: consider the following.
(a
1)
Sincep
4 and U
i
⊲
(
U
i
↔
S
K
S
,
R
)
U
i
↔
T
S, we apply the message-meaning rule to obtain U
i
|
≡
S
|
~
(
U
i
↔
S
K
S
,
R
).
(a
2)
Sincep
2 and a
1, we apply the fresh conjuncatenation rule and nonce-verification rule to obtain U
i
|
≡
S
|
≡
(
U
i
↔
S
K
S
,
R
).
(g
1)
Sincea
2, we apply the belief rule to obtain U
i
|
≡
S
|
≡
U
i
↔
S
K
S.
(g
2)
Sincep
6 and g
1, we apply the jurisdiction rule to obtain U
i
|
≡
U
i
↔
S
K
S.
(a
3)
Sincep
5 and S
⊲
(
U
i
↔
S
K
S
,
H
)
U
i
↔
T
S, we apply the message-meaning rule to obtain S
|
≡
U
i
|
~
(
U
i
↔
S
K
S
,
H
).
(a
4)
Sincep
3 and a
3,  we apply the fresh conjuncatenation rule and nonce-verification rule to obtain S
|
≡
U
i
|
≡
(
U
i
↔
S
K
S
,
H
).
(g
3)
Sincea
4, we apply the belief rule to obtain S
|
≡
U
i
|
≡
U
i
↔
S
K
S.
(g
4)
Sinceg
3 and p
7, we apply the jurisdiction rule to obtain S
|
≡
U
i
↔
S
K
S.By analyzing the security of our scheme with BAN logic, the results demonstrate that the proposed scheme can effectively achieve the security goal of the mutual authentication ofU
i and S.


## 6.2. Informal Security Analysis

In this subsection, we will examine whether the enhanced scheme is safe and consider its ability to resist various known attacks. The following attacks are also based on the assumptions that a malicious adversaryA has total control over the communication channel connecting U
i and S in authentication phase. So A can intercept, insert, delete, or modify any messages transmitted via public channel [22–24].


## 6.3. User is Anonymous and Untraceable

SupposeA eavesdrops the request messages R
E
Q
U
E
S
T
(
M
1
,
A
I
D
,
M
2
), the challenge message C
H
A
L
L
E
N
G
E
(
r
e
a
l
m
,
M
3
,
A
u
t
h
S
), and the response message R
E
S
P
O
N
S
E
(
r
e
a
l
m
,
A
u
t
h
U
i
) from the public channel. To obtain I
D
i from these values by means of guessing and verifying, A must have the knowledge of {
{
P
W
i
,
r
1
,
k
U
i
}
,
{
r
3
}
,
{
r
2
}
}. Due to U
i and S compute different M
1 and M
3 with a new random number (
r
1
,
r
2
) and r
3 for each session, and A is not able to trace who communicates with S by monitoring the channel. This shows the proposed scheme provides the attribute of anonymous.


## 6.4. Insider Attack

In our scheme, it is computationally impossible to derive the passwordP
W
i from the P
W
D
=
h
(
P
W
i
∥
k
U
i
) because of the difficulties of hash function with the secret key k
U
i of U
i. Therefore, the proposed scheme can withstand the insider attack.


## 6.5. Perfect Forward Secrecy

IfU
i’s password P
W
i, the secret key k
U
i, and S’s secret key k
S are all compromised, this does not allow A to determine the session key S
K for the past session. A cannot compute r
1
r
2
P from M
1 and M
3 because of secure one-way hash function andECDLP.


## 6.6. Mutual Authentication

In our scheme,S and U
i can authenticate each other by checking M
2, A
u
t
h
U
i, and A
u
t
h
S, separately. Therefore, our scheme can provide mutual authentication.


## 6.7. Key-Compromise Impersonation Attack

Assume thatA intercepts the request, the challenge, and the response messages. Supposing the secret key k
U
i of U
i is compromised by A, he cannot go through the verification process of U as the random number r
1 is not known. On the other hand, supposing the secret key k
S of S is compromised by A, he cannot impersonate U to cheat S. Since A cannot know the values of the identity I
D
i and r
1 of U
i, he cannot compute the correct value T and hence cannot be authenticated by S. Therefore, the proposed scheme can withstand the key-compromise impersonation attack.


## 6.8. Replay Attack

Assuming thatA eavesdrops R
E
Q
U
E
S
T
(
M
1
,
A
I
D
,
M
2
) and replays it to impersonate U
i, S then verifies the condition M
2
=
?
h
(
r
2
P
∥
I
D
i
). The message verification does not hold, so try to guess r
2 from R is theECDLP and r
2 is different in each authentication message. On the other hand, suppose A eavesdrops C
H
A
L
L
E
N
G
E
(
r
e
a
l
m
,
M
3
,
A
u
t
h
S
) and replays it to impersonate S. The replied message cannot pass the verification process A
u
t
h
S
=
h
(
S
K
S
∥
h
(
I
D
i
∥
P
W
D
∥
r
1
)
∥
r
2
P
), since both r
1 and r
2 are new random numbers chosen by U
i in each session, and A has no control of it. Therefore, A has no opportunity to successfully replay used messages.


## 6.9. Offline Password Guessing Attack

Even ifA intercepts all the exchanged messages (
M
1
,
M
2
,
A
I
D
,
M
3
,
A
u
t
h
U
i
,
A
u
t
h
S
) by passive attack, he cannot guess the correct password of U
i. Since A cannot know the values of the user’s identity I
D
i, the secret key k
U
i, and the random number r
1, he cannot compute the value T
=
h
(
I
D
i
∥
r
1
∥
h
(
P
W
i
∥
k
U
i
)
) to verify the guessed password P
W
i through the recorded messages. Therefore, our scheme can resist the offline password guessing attack.


## 6.10. Known Session Key Security

Because of the randomness and independence of the generations ofr
1 and r
3 in all the sessions, the session key S
K
=
r
1
r
3
P of each session is independent of that of any other sessions. Therefore, the proposed scheme can ensure known session key security.


## 6.11. Formal Security Analysis of the Proposed Scheme

In this subsection, we provide the formal security analysis of our scheme and show that our scheme is secure. We first define the following oracles.Reveal 1.
This random oracle will unconditionally output the inputx from the given hash value y
=
h
(
x
).Reveal 2.
This random oracle will unconditionally outputm from given points P and Q
=
m
P in an elliptic curve E
p
(
a
,
b
).Theorem 1.
Under theECDLP assumption, our scheme is secure against an adversary A for deriving the identity I
D
i and password P
W
i of a legal user U
i and the session key S
K between U
i and S if the hash function h
(
·
) closely behaves like a random oracle.Proof.
The formal security proof of our scheme is similar to that as in [29–31]. A runs the experimental algorithm showed in Algorithm 1,  E
X
P
H
A
S
H
,
E
C
D
L
P
R
E
A
S
S
I
P
,
A for our robust, and efficient authentication scheme for session initiation protocol; sayREASSIP.
Define the success probability forE
X
P
H
A
S
H
,
E
C
D
L
P
R
E
A
S
S
I
P
,
A as S
u
c
c
H
A
S
H
,
E
C
D
L
P
R
E
A
S
S
I
P
,
A
=
|
2
P
r
[
E
X
P
H
A
S
H
,
E
C
D
L
P
R
E
A
S
S
I
P
,
A
=
1
]
-
1
| and the advantage function for this experiment then becomes A
d
v
H
A
S
H
,
E
C
D
L
P
R
E
A
S
S
I
P
,
A
(
t
,
q
R
1
,
q
R
2
)
=
ma
x
A
S
u
c
c
H
A
S
H
,
E
C
D
L
P
R
E
A
S
S
I
P, where the maximum is taken over all A with execution time t, and the number of queries q
R
1
,
q
R
2 made to the Reveal 1 and Reveal 2 oracles, respectively. If A has the ability to solve the hash function and theECDLP, then he can directly derive U
i’s identity I
D
i, password P
W
i, and the session key S
K between U
i and S. In this case, A will discover the complete connections between U
i and S. However, it is a computationally infeasible problem to invert the input from a given hash value and output m from given points P
,
Q; that is, A
d
v
H
A
S
H
A
(
t
1
)
≤
ϵ, A
d
v
E
C
D
L
P
A
(
t
2
)
≤
ϵ, ∀
ϵ
>
0. Hence, we have A
d
v
H
A
S
H
,
E
C
D
L
P
R
E
A
S
S
I
P
,
A
(
t
,
q
R
1
,
q
R
2
)
≤
ϵ, as it is dependent on A
d
v
H
A
S
H
A
(
t
1
) and A
d
v
E
C
D
L
P
A
(
t
2
). Therefore, our scheme is probably secure against A for deriving I
D
i, P
W
i, and S
K.Algorithm 1:Algorithm E
X
P
H
A
S
H
,
E
C
D
L
P
R
E
A
S
S
I
P
,
A.
(1)    Eavesdrop request messageR
E
Q
U
E
S
T
(
M
1
,
A
I
D
,
M
2
)
(2)   Call the reveal oracle 2. Let(
T
′
,
r
2
′
)
←
R
e
v
e
a
l
2
(
M
1
)
(3)   Call the reveal oracle 1. Let(
I
D
i
′
,
P
W
i
′
,
r
1
′
)
←
R
e
v
e
a
l
1
(
T
′
)
(4)   Eavesdrop challenge messageC
H
A
L
L
E
N
G
E
(
r
e
a
l
m
,
M
3
,
Auth
S
)
(5)   Call the reveal oracle 1. Let (S
K
′
,
T
′
′
,
R
′
)
←
R
e
v
e
a
l
1
(
A
u
t
h
S
)
(6)   Call the reveal oracle 2. Let(
r
2
′
′
)
←
R
e
v
e
a
l
2
(
R
′
)
(7)if  (r
2
′ = r
2
′
′)  then
(8)    Accept the derivedI
D
i
′, P
W
i
′, and S
K
′ as the correct I
D
i and P
W
i of the user U
i
(9)    and the session keyS
K between U
i and S, respectively
(10)
return 1 (success)
(11)else
(12)
return 0 (failure)
(13)end if


## 7. Security Properties and Performance Comparison

In this section, we show that our proposed scheme satisfies many security attributes and has lower computation cost. Security properties and performance cost comparisons between our scheme and the other related schemes in [13–20] are given in Table 3 and Figure 1, respectively.Table 3
Comparison of security attributes.
Ours
Arshad and Ikram [13]
Yoon et al.[14]
Xie [15]
Farash and Attari [16]
Zhang et al.[17]
Tu et al.[18]
Irshad et al.[19]
Arshad and Nikooghadam [20]
T
1
Yes
No
No
No
No
—
No
No
No
T
2
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
No
T
3
Yes
Yes
Yes
Yes
Yes
Yes
—
Yes
Yes
T
4
Yes
Yes
Yes
Yes
—
—
—
Yes
Yes
T
5
Yes
No
No
No
No
No
Yes
Yes
Yes
T
6
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
T
7
Yes
—
—
—
—
—
—
—
—
T
8
Yes
No
No
No
Yes
Yes
Yes
Yes
Yes
T
1: providing anonymity and untraceable; T
2: providing mutual authentication; T
3: providing perfect forward secrecy; T
4: known session key security; T
5: resist insider attack; T
6: resist replay attack; T
7: resist key-compromise impersonation attack; T
8: resist offline password guessing attack.Figure 1
Comparison of computational cost.Table3 shows that our scheme is more secure than Arshad et al.’s scheme and other related schemes and achieves more functionality features. In performance comparison, we mainly focus on computations of the authentication phase, since it is the main body of an authentication scheme, and the registration phase only performs one time before authentication. Let PA, PM, INV, SE, M, and H be the time for performing an elliptic curve point addition, an elliptic curve point multiplication, a modular inversion, a symmetric key encryption or decryption, a modular multiplication, and a hash function. Since xor operations require very little computations, we omitted it. From Figure 1 we can see that our scheme has similar or better efficiency in comparison with other related ECC-based authentication schemes.


## 8. Conclusion

We have analyzed the security of a recently proposed Arshad et al.’s SIP authentication scheme. We have pointed out that an adversary can successfully launch the trace and key-compromise impersonation attacks on Arshad et al.’s scheme. We also have shown that Arshad et al.’s scheme does not achieve proper mutual authentication. The cryptanalysis of Arshad and Nikooghadam’s scheme thus shows that the security of their scheme is compromised. In order to eliminate the security pitfalls found in Arshad et al.’s scheme, we have then presented a robust and efficient ECC based authentication scheme for SIP. Our scheme is immune to the trace, key-compromise impersonation, and insider attacks which Arshad and Nikooghadam’s scheme fails to satisfy. Meanwhile, our scheme can withstand the replay, offline password guessing, and insider attacks. In addition, our scheme achieves the known session key security and perfect forward secrecy. We present a cryptanalysis of our scheme through both informal and formal security analyses. Besides, our scheme is computationally efficient as compared to other related ECC based SIP authentication schemes. Considering the security and efficiency provided by our scheme, we conclude that our scheme is more appropriate for practical applications in comparison with other related schemes.



---

*Source: 894549-2015-04-07.xml*