# Security and Privacy for Edge-Assisted Internet of Things Security Proof for the SKKE Protocol

Authors: Xiangyang Wang; Chunxiang Gu; Fushan Wei; Siqi Lu
Journal: Security and Communication Networks
 (2021)

---

## Abstract

As an Internet of things (IoT) technology, the ZigBee has a wide range of applications in home automation, smart energy, commercial building automation, personal, home and hospital care, telecom, and wireless sensor. The ZigBee standard has the advantage of high reliability, which is based on the security of authentication key agreement protocol, namely, the SKKE protocol. In the ZigBee standard, this protocol based on shared symmetric-key is applied on the security protocol level. It is a full symmetric-key key agreement with key confirmation scheme, while the key confirmation mechanism is provided by a message authentication coding mechanism. In this paper, we consider the security of the SKKE protocol. In the random Oracle model, we reduce the security of the SKKE protocol to the collision of the hash function and the HMAC function and the indistinguishability between the output of the random Oracle and a random number. We also give a theoretical proof with the game-based method. To our knowledge, there is no research on the provable security of the ZigBee protocol at this stage, so it is helpful to promote further research of the ZigBee protocol security.


---

## Body

## 1. Introduction

The emerging IoT technology usage in different aspects of life results in a very large number of devices connected to each other and to the Internet in a small space. As we have known, IoT devices rely on one or more communication technologies [1–3] (such as ZigBee, Z-Wave, BLE, and WiFi), some of which are well-suited for resource-constrained devices to operate in low-power and lossy networks (LLNs) such as ZigBee and Z-Wave. Among them, the ZigBee protocol, with its low-cost, low-power consumption, high-robustness, and flexibility, has been increasingly applied in the field of short distance communication, daily monitoring, and short distance data transmission. Nowadays, ZigBee-based IoT devices are predominant in the IoT landscape, and the security of the ZigBee plays a more and more important role in the ZigBee communication. In recent years, the researches of the ZigBee security can be divided into implementation level security and specification level security.At the implementation level, some researchers have studied ZigBee enabled devices in order to find vulnerabilities at the implementation level [4, 5]. These attacks found in the research include replay attack, eavesdropping attack, acquiring key attack, denial of service attack, same-nonce attack, ghost attack, and men-in-the-middle attack. However, these findings do not necessarily reflect the insecurity in the specification. In addition, their methods are usually special and aim to discover low-level vulnerabilities and cannot be effectively transported to the formal analysis of the protocol stack, while, at the specification level, formal verification of ZigBee has been considered in several papers [6–11]. Especially, in [12], the authors focused on the application of formal verification to protocols in the IoT domain and summarized the existing approaches to the formal analysis of the ZigBee protocol. In addition, Li et al. in [13] established the ZigBee symbol model according to the ZigBee standard (ZigBee 1.0 and ZigBee 3.0). This model mainly captures the important elements, such as key sharing, device joining, and key updating. Next, according to the ZigBee specification, the authors divided the ZigBee protocol into some subprotocols, then the authors used the security protocol verification tool (tamarin) to analyze and verify the security attributes of those subprotocols. Security analysis finds some known security vulnerabilities in ZigBee 1.0 and proves that there are no such vulnerabilities in ZigBee 3.0.Since the 1980s, two methods for analyzing security protocols have been developed [14]. One method relies on the symbolic model of protocol execution, that is, symbolic (or Dolev Yao or formal) method, in which cryptographic primitives are regarded as black boxes. Symbolic method adopts a highly abstract execution view, in which the messages exchanged by all parties are symbolic terms. This model supports automatic analysis, but the high degree of abstraction makes the security guarantee provided by this method unclear and may miss the possible attacks in the computing model. The other method relies on the computational model which considers the complexity and probability problems, namely, computational (or cryptographic) method. This method captures a powerful security concept and can resist all probabilistic polynomial-time attacks.All above researches of the ZigBee security at the specification level are in symbolic methods, so it is very necessary and meaningful to take research on the ZigBee security at the specification level under the computational model. In the ZigBee specification, the SKKE protocol is used for two end devices (not including trust center) to establish the application link key for their communication end-to-end (only used in APS layer). Although the process of establishing the end-to-end application link key has been researched in [13], the authors only considered the case that the trust center randomly generates the link key and then distributes it to the initiator and the responder, respectively. As for another case, the initiator and the responder share the master key (randomly generated by the trust center and transmitted to the initiator and the responder, respectively), and then they negotiate the application link key based on the shared master key through the SKKE protocol [15, 16]. The SKKE protocol is a full symmetric-key key agreement with key confirmation mechanism, while message authentication coding mechanism is used to provide key confirmation. Yuksel et al. [15, 16] described the SKKE protocol in detail, but the analysis of the SKKE protocol security is scarce at present. It is necessary to analyze and prove the security of the SKKE protocol. In this paper, the security model of the SKKE protocol is established under the random Oracle model, and its confidentiality is reduced to the collision of hash function and HMAC function and the indistinguishability between random Oracle output and random number. Meanwhile, its authentication is reduced to the collision between hash function and HMAC function, and the proof of the SKKE protocol confidentiality and authentication is given with the game-based method.The rest of this paper is organized as follows. Section2 gives the basic knowledge needed in the security proof of the SKKE protocol; Section 3 is the description of the SKKE protocol and its execution details; in Section 4, we model the SKKE protocol and give the definition of indistinguishable experiment, authentication experiment, and some security notions; in Section 5, we prove the security of the SKKE protocol with the game-based method; Section 6 is the summary of our work.


## 2. Preliminaries

Denote byx⟵y the operation of assigning y to x. Denote by x⟵$X the operation sampling x uniformly at random from a set X. PPT is short for probabilistic polynomial time.Lemma 1 (see [17]).
LetA be a distinguisher, then we have(1)|PrAy=1|f∈Fx,y,y=fx−PrAy=1y⟵$R≤negln,where Fx,y:x⟼y is a function cluster; x=y=n; f∈Fx,y is a random Oracle; y⟵$R denotes sampling y uniformly at random from R; and negln is a negligible function.HMAC [18] is a key-related hash operation message authentication code. HMAC operation uses a hash algorithm to generate a message digest as output with a key and a message as input. A key hash function and a key are used in the definition of HMAC. “text” is used as the plaintext to calculate HMAC; the operation of HMAC function is as follows:(2)H′K⊕opadH′K⊕ipadtext,where H′ is a hash function; ipad and opad are two different fixed strings. The detailed operation steps of HMAC function can be referred to [18].


## 3. The Description of the SKKE Protocol

In this section, we describe the interaction and the execution details of the SKKE protocol.


### 3.1. The SKKE Protocol

Figure1 shows the message transmission of the key agreement mechanism, namely, the SKKE protocol [16]. As shown in the figure, U represents the initiator of the protocol and V represents the responder of the protocol. The essential difference between the role of the initiator and the role of the responder is that the initiator sends the first pass of the exchange. As shown in Figure 1, the MK is the master key shared between the initiator U and the responder V. AB means the transmission of message A that contains payload(s) B. QEX represents the challenge generated by a device X and MacTag represents the hash value. Based on the master key MK, U and V negotiate the session key LK by executing the SKKE protocol.Figure 1
Symmetric-key authenticated key agreement scheme.


### 3.2. Execution Details of the SKKE Protocol

In [15, 16], the authors showed a detailed description of the SKKE protocol. For convenience, let us briefly describe it here.In the SKKE protocol, an initiatorU establishes a LK with a responder V using a shared secret MK. We present the computational details of the SKKE protocol in Figure 2. In the first two messages, the initiator and the responder exchange their challenges. In the last two messages, they exchange the data they have computed using the challenges and their identities. After verifying that they have received the correct value, they use another value as the LK that both of them can compute.Figure 2
The SKKE protocol (H, hash function MAC, HMAC function; ||, concatenation; 0x, hexadecimal).


## 3.1. The SKKE Protocol

Figure1 shows the message transmission of the key agreement mechanism, namely, the SKKE protocol [16]. As shown in the figure, U represents the initiator of the protocol and V represents the responder of the protocol. The essential difference between the role of the initiator and the role of the responder is that the initiator sends the first pass of the exchange. As shown in Figure 1, the MK is the master key shared between the initiator U and the responder V. AB means the transmission of message A that contains payload(s) B. QEX represents the challenge generated by a device X and MacTag represents the hash value. Based on the master key MK, U and V negotiate the session key LK by executing the SKKE protocol.Figure 1
Symmetric-key authenticated key agreement scheme.


## 3.2. Execution Details of the SKKE Protocol

In [15, 16], the authors showed a detailed description of the SKKE protocol. For convenience, let us briefly describe it here.In the SKKE protocol, an initiatorU establishes a LK with a responder V using a shared secret MK. We present the computational details of the SKKE protocol in Figure 2. In the first two messages, the initiator and the responder exchange their challenges. In the last two messages, they exchange the data they have computed using the challenges and their identities. After verifying that they have received the correct value, they use another value as the LK that both of them can compute.Figure 2
The SKKE protocol (H, hash function MAC, HMAC function; ||, concatenation; 0x, hexadecimal).


## 4. Security Model and Security Experiment

### 4.1. Security Model

We assume that the attacker can completely control the channel, that is, the attacker can eavesdrop, delay, and tamper with the messages transmitted by running the protocol. The following Oracle queries are defined to describe the adversary’s ability:(i)
ExecuteU,V: this query models passive attacks. The output of this query consists of messages that were exchanged during the honest execution of the protocol among U and V.(ii)
SendU,m: this query models active attack by sending message m to the participant U. The output of this query is the message that U would generate on receipt of message m.(iii)
RevealUi,Vi: this query models the misuse of session key, namely, link key established between U and V. The output of this query is the link key LKi established during the i-th communication between U and V. If the i-th communication is used as the test session, this query cannot be executed.(iv)
CorruptUi,Vi: this query models the ability of the adversary A to reveal the long-term secret key of the i-th communication between U and V. The output of this query is the master key MKi shared between U and V during the i-th communication. If the i-th communication is used as the test session, this query cannot be executed.The adversaryA is represented as two procedures A1 and A2 that share state. In the RO model, the hash functions H and H′ are modeled as two random oracles, HA and HA′, and each of them obtains a list to store queries. When the adversary A queries to HA, if the query is in the list, the corresponding value is returned, else it returns a random value. It is the same as above that the adversary A queries to HA′.


### 4.2. Security Experiment

Before defining the security notion of the SKKE protocol, we define indistinguishability experiment and authentication experiment from the perspectives of confidentiality and authentication of the SKKE protocol.


#### 4.2.1. Indistinguishability Experiment

In this section, we define an indistinguishability experiment (see Figure3), which is used in the security proof of confidentiality.Figure 3
Indistinguishability experiment of the SKKE protocol.TheUi,Vi represents i-th i=1,2,…,N session established by the initiator Ui and the responder Vi, which is the test session and not revealed. MKi and LKi represent the master key and the link key, respectively, which is a bijection. keylen represents the length of the master key and the link key.Definition 1.
For anyPPT adversary A, the advantage of the adversary A breaks the confidentiality of the SKKE protocol which is defined as follows:(3)AdvAindl,N,qH,qH′=PrExpAindl,N,qH,qH′=1−12.


#### 4.2.2. Authentication Experiment

We denote the authentication experiment asExpAauthl,N,qH,qH′. Next, we consider the authentication of the initiator Ui to the responder Vi, namely, ExpAauth-uvl,N,qH,qH′ (see Figure 4), as an example to consider the authentication of the SKKE protocol.Figure 4
Authentication experiment of the SKKE protocol.Remark 1.
The SKKE protocol is a symmetrical two-way authentication protocol. In Figure4, ExpAauth-uvl,N,qH,qH′ denotes the authentication of the initiator Ui to the responder Vi, as for the authentication of the responder Vi to the initiator Ui, similarly.Definition 2.
For anyPPT adversary A, the advantage of the adversary A breaks the authentication of the SKKE protocol which is defined as follows:(4)AdvAauthl,N,qH,qH′=PrExpAauthl,N,qH,qH′=1.Definition 3.
The SKKE protocol has security if for anyPPT adversary A, the following advantage is negligible:(5)AdvASKKEl,N,qH,qH′=maxPrExpAindl,N,qH,qH′=1−12,PrExpAauthl,N,qH,qH′=1.


## 4.1. Security Model

We assume that the attacker can completely control the channel, that is, the attacker can eavesdrop, delay, and tamper with the messages transmitted by running the protocol. The following Oracle queries are defined to describe the adversary’s ability:(i)
ExecuteU,V: this query models passive attacks. The output of this query consists of messages that were exchanged during the honest execution of the protocol among U and V.(ii)
SendU,m: this query models active attack by sending message m to the participant U. The output of this query is the message that U would generate on receipt of message m.(iii)
RevealUi,Vi: this query models the misuse of session key, namely, link key established between U and V. The output of this query is the link key LKi established during the i-th communication between U and V. If the i-th communication is used as the test session, this query cannot be executed.(iv)
CorruptUi,Vi: this query models the ability of the adversary A to reveal the long-term secret key of the i-th communication between U and V. The output of this query is the master key MKi shared between U and V during the i-th communication. If the i-th communication is used as the test session, this query cannot be executed.The adversaryA is represented as two procedures A1 and A2 that share state. In the RO model, the hash functions H and H′ are modeled as two random oracles, HA and HA′, and each of them obtains a list to store queries. When the adversary A queries to HA, if the query is in the list, the corresponding value is returned, else it returns a random value. It is the same as above that the adversary A queries to HA′.


## 4.2. Security Experiment

Before defining the security notion of the SKKE protocol, we define indistinguishability experiment and authentication experiment from the perspectives of confidentiality and authentication of the SKKE protocol.


### 4.2.1. Indistinguishability Experiment

In this section, we define an indistinguishability experiment (see Figure3), which is used in the security proof of confidentiality.Figure 3
Indistinguishability experiment of the SKKE protocol.TheUi,Vi represents i-th i=1,2,…,N session established by the initiator Ui and the responder Vi, which is the test session and not revealed. MKi and LKi represent the master key and the link key, respectively, which is a bijection. keylen represents the length of the master key and the link key.Definition 1.
For anyPPT adversary A, the advantage of the adversary A breaks the confidentiality of the SKKE protocol which is defined as follows:(3)AdvAindl,N,qH,qH′=PrExpAindl,N,qH,qH′=1−12.


### 4.2.2. Authentication Experiment

We denote the authentication experiment asExpAauthl,N,qH,qH′. Next, we consider the authentication of the initiator Ui to the responder Vi, namely, ExpAauth-uvl,N,qH,qH′ (see Figure 4), as an example to consider the authentication of the SKKE protocol.Figure 4
Authentication experiment of the SKKE protocol.Remark 1.
The SKKE protocol is a symmetrical two-way authentication protocol. In Figure4, ExpAauth-uvl,N,qH,qH′ denotes the authentication of the initiator Ui to the responder Vi, as for the authentication of the responder Vi to the initiator Ui, similarly.Definition 2.
For anyPPT adversary A, the advantage of the adversary A breaks the authentication of the SKKE protocol which is defined as follows:(4)AdvAauthl,N,qH,qH′=PrExpAauthl,N,qH,qH′=1.Definition 3.
The SKKE protocol has security if for anyPPT adversary A, the following advantage is negligible:(5)AdvASKKEl,N,qH,qH′=maxPrExpAindl,N,qH,qH′=1−12,PrExpAauthl,N,qH,qH′=1.


## 4.2.1. Indistinguishability Experiment

In this section, we define an indistinguishability experiment (see Figure3), which is used in the security proof of confidentiality.Figure 3
Indistinguishability experiment of the SKKE protocol.TheUi,Vi represents i-th i=1,2,…,N session established by the initiator Ui and the responder Vi, which is the test session and not revealed. MKi and LKi represent the master key and the link key, respectively, which is a bijection. keylen represents the length of the master key and the link key.Definition 1.
For anyPPT adversary A, the advantage of the adversary A breaks the confidentiality of the SKKE protocol which is defined as follows:(3)AdvAindl,N,qH,qH′=PrExpAindl,N,qH,qH′=1−12.


## 4.2.2. Authentication Experiment

We denote the authentication experiment asExpAauthl,N,qH,qH′. Next, we consider the authentication of the initiator Ui to the responder Vi, namely, ExpAauth-uvl,N,qH,qH′ (see Figure 4), as an example to consider the authentication of the SKKE protocol.Figure 4
Authentication experiment of the SKKE protocol.Remark 1.
The SKKE protocol is a symmetrical two-way authentication protocol. In Figure4, ExpAauth-uvl,N,qH,qH′ denotes the authentication of the initiator Ui to the responder Vi, as for the authentication of the responder Vi to the initiator Ui, similarly.Definition 2.
For anyPPT adversary A, the advantage of the adversary A breaks the authentication of the SKKE protocol which is defined as follows:(4)AdvAauthl,N,qH,qH′=PrExpAauthl,N,qH,qH′=1.Definition 3.
The SKKE protocol has security if for anyPPT adversary A, the following advantage is negligible:(5)AdvASKKEl,N,qH,qH′=maxPrExpAindl,N,qH,qH′=1−12,PrExpAauthl,N,qH,qH′=1.


## 5. Security Proof

In this section, firstly, we prove the confidentiality (namely, indistinguishable security) and authentication of the SKKE protocol, namely, Theorem1 and Theorem 2. In the random Oracle model, we reduce the confidentiality to the collision of hash function and HMAC function and the indistinguishability between the output of random Oracle and random number, while the authentication is reduced to the collision of the hash function and the HMAC function. Then, we show the SKKE protocol is secure by Theorem 3.Theorem 1.
For anyPPT adversary A against the indistinguishability experiment, the advantage of the adversary A wins the experiment which satisfies the following inequality:(6)AdvAindl,N,qH,qH′≤12keylen+qH2hashklen+qH′2macklen+neglhashklen+neglmacklen,where keylen is the length of master key, hashklen and macklen are the output lengths of the hash function and the HMAC function, qH and qH′ are the times of the adversary queries to the hash functions H and H′, neglhashklen and neglmacklen are two negligible functions.Proof.
For each gameGi, we denote ExpAindl,N,qH,qH′=1 as Si. The initial game G0 is defined as Figure 3.
GameG1: the transition from G0 to G1 is realized by in-lining the calculation process of LKi and the HMAC function, as shown in Figure 5. So, the two games are equivalent. Then, we have(7)PrS1=PrS0.
GameG2: if the adversary obtains the MK shared by the initiator and the responder, the adversary can calculate the LK, and then the adversary can win the game. Thus, as shown in Figure 6, in game G2, we raise a flag bad1 when the adversary obtains the MK by guessing. The difference in the probability of b=b′ in this game and in game G1 is bounded by the probability of bad1 in the latter game, while the probability of bad1 does not exceed 1/2keylen. Then, we have(8)PrS2−PrS1≤PrG2:bad1≤12keylen.
GameG3: as shown in Figure 7, in this game, we raise a flag bad2 to represent that the adversary finds a collision of the outer hash function H′ of the HMAC function H′ri⊕opad‖H′ri⊕ipad‖Datai, then the adversary A obtains Zi. In the RO model, the hash function is idealized as a random Oracle, and an Oracle HA′ is randomly selected from the function cluster Fx,y:x↦y to replace the hash function H′. Then, according to the lemma, that is, the output of the random Oracle which is indistinguishable from the random number, we randomly and evenly select λi and replace Zi with λi. Therefore, the upper bound of probability difference of G2 to G3 transformation is characterized by the probability of bad2 event occurrence and the indistinguishability between the output of the random Oracle and a random number. Then, we can get(9)PrS3−PrS2≤PrG3:bad2+neglmacklen≤qH′2macklen+neglmacklen.
GameG4: as shown in Figure 8, in this game G4, we raise a flag bad3 to represent that the adversary finds a collision of the hash function H, then the adversary A obtains LKi. In the RO model, the hash function is idealized as a random Oracle, and an Oracle HA is randomly selected from the function cluster Fx,y:x⟼y to replace the hash function H. Then, according to the lemma, that is, the output of the random Oracle which is indistinguishable from the random number, we randomly select γi and replace HAλi‖0x00000002 with λi. Therefore, the upper bound of the probability difference of G3 to G4 transformation is characterized by the probability of bad3 event occurrence and the indistinguishability between the output of the random Oracle and a random number. Then, we have(10)PrS4−PrS3≤PrG4:bad3+neglhashklen≤qH2hashklen+neglhashklen,where hashklen is the output length of the hash function and neglhashklen is a negligible function. While in G4, the protocol copies returned are random numbers that have nothing to do with coin tossing, then we have(11)PrS4=12.
In summary, from (1) to (5), we can get the adversary’s advantage in winning as follows:(12)AdvAindl,N,qH,qH′≤12keylen+qH2hashklen+qH′2macklen+neglhashklen+neglmacklen.Figure 5
GameG1 of indistinguishability security of the SKKE protocol.Figure 6
GameG2 of indistinguishability security of the SKKE protocol.Figure 7
GameG3 of indistinguishability security of the SKKE protocol.Figure 8
GameG4 of indistinguishability security of the SKKE protocol.Theorem 2.
For anyPPT adversary A against the authentication experiment, the advantage of the adversary winning satisfies the following inequality:(13)AdvAauthl,N,qH,qH′≤12keylen−1+qH2hashklen−1+qH′2macklen−1,where keylen is the length of master key; hashklen and macklen are the output lengths of the HMAC function and the hash function; qH is the times of the adversary queries to the hash function H; and qH′=s1+s2 is the total times of the adversary queries to the hash function H′.Proof.
For each gameGi, we denote ExpAindl,N,qH,qH′=1 as Si. The initial game G0 is defined as Figure 4.
GameG1: as shown in Figure 9, the transition from G0 to G1 is realized by in-lining the calculation process of HMAC function. Thus, the two games are equivalent. Then, we can have(14)PrS1=PrS0.
GameG2: as shown in Figure 10, we raise a flag bad1 to represent that the adversary finds a collision of the hash function of H′, then the adversary A obtains a MacKeyi′, which satisfies the following conditions:(15)MacTag1i=MacTag1i′,(16)MacKeyi⊕opadH′MacKeyi⊕ipadMacData1i≠MacKeyi′⊕opadH′MacKeyi′⊕ipadMacData1i.
Since the probability of thebad1 event happening is not more than S1/2macklen, then we can have(17)PrS2−PrS1≤PrG2:bad1≤s12macklen,where s1 is the number of times the adversary queries to H′ in this game.
GameG3: as shown in Figure 11, we raise a flag bad2 to represent that the adversary finds a collision of the hash function H, then the adversary A obtains a Zi′, which satisfies the following conditions: MacKeyi=MacKeyi′ and Zi≠Zi′. Since the probability of the bad2 event happening is not more than qH/2hashklen, then we can have(18)PrS3−PrS2≤PrG3:bad2≤qH2hashklen.
GameG4: as shown in Figure 12, we raise a flag bad3 to represent that the adversary finds a collision of the hash function of H′, then the adversary A obtains a MKi′, which satisfies Zi=Zi′ and MKi≠MKi′. Since the probability of the bad3 event happening is not more than s2/2macklen, then we can have(19)PrS4−PrS3≤PrG4:bad3≤s22macklen,where s2 is the number of times the adversary queries to H′ in this game. Due to the inclusion relationship between events H′MacKeyi⊕opad‖H′MacKeyi⊕ipad‖MacData1i=H′MacKeyi′⊕opad‖H′MacKeyi′⊕ipad‖MacData1i, MacKeyi=MacKeyi′, Zi=Zi′, and MKi=MKi′, PrS4=PrG4:MKi=MKi′ can be obtained from the conditional probability formula. The probability of the adversary obtains the master key MKi by guessing which is not more than 1/2keylen (keylen is the length of the master key), so we can have(20)PrS4=PrG4:MKi′=MKi≤12keylen.
To sum up, from (6) to (10), we can get the advantage of the adversary against the authentication experiment of U to V, and it satisfies the following inequality:(21)AdvAauth−uvl,N,qH,qH′≤12keylen+qH2hashklen+qH′2macklen.
In a word, the advantage of the adversary against the authentication of the SKKE protocol satisfies(22)AdvAauthl,N,qH,qH′≤12keylen−1+qH2hashklen−1+qH′2macklen−1.Figure 9
GameG1 of the authentication of the SKKE protocol.Figure 10
GameG2 of the authentication of the SKKE protocol.Figure 11
GameG3 of the authentication of the SKKE protocol.Figure 12
GameG4 of the authentication of the SKKE protocol.Theorem 3.
For anyPPT adversary A against the security of the SKKE protocol, the advantage of the adversary winning satisfies the following inequality:(23)AdvASKKEl,N,qH,qH′≤12keylen−1+qH2hashklen−1+qH′2macklen−1+neglhashklen+neglmacklen.Remark 2.
The proof of Theorem3 is obvious. It should be noted that qH is the largest times of the adversary queries to the hash function H in these two security experiments, and qH′ is the largest total times of the adversary queries to the hash function H′, similarly.


## 6. Conclusions

As an Internet of things communication technology, ZigBee has a wide range of applications in home automation, smart energy, commercial building automation, personal, home and hospital care, telecom, and wireless sensor. At the same time, its security has also received more and more attention. According to the standard of ZigBee 3.0, this paper considers the security of the SKKE protocol, which is used by the initiator and the responder to establish the application link key. In the random Oracle model, we reduce the confidentiality of the SKKE protocol to the collision of the hash function and the HMAC function and the indistinguishability between the output of random Oracle and random number. Then, we reduce the authentication to the collision between the hash function and the HMAC function. Finally, we give the theoretical proof of the confidentiality and authentication of the SKKE protocol with the game-based method. As we known, there is a lack of research on the provable security of the ZigBee protocol at this stage, so it is a meaningful work to study the provable security of the SKKE protocol, and it is helpful to promote further research of the ZigBee protocol security.



---

*Source: 9029664-2021-12-03.xml*