Security Analysis and Improvements of Two-Factor Mutual Authentication with Key Agreement in Wireless Sensor Networks

. 2014 Apr 9;14(4):6443–6462. doi: 10.3390/s140406443


A-1	GW checks if (T_G−T_i) ≤ ΔT, where T_G is the current timestamp of GW system, and ΔT is the maximum permitted transmission delay time. If (T_G−T_i) ≤ ΔT, then the next step proceeds; otherwise, this phase is aborted.
A-2	GW computes the following.
	R_Ni=v_i⊕x_s
	X=DID_i⊕h(x_s∥R_Ni∥T_i*)
	M_Ui₋_G=h((X⊕h(K))∥x_s∥R_Ni∥T_i)
	GW compares M_Ui₋_G* with M_Ui₋_G. If M_Ui₋_G =M_Ui₋_G, then the next step proceeds; otherwise, this phase is aborted.
A-3	GW computes M_G₋_Sj=h(DID_i∥SID_j∥x_s∥T_G). T_G is the current timestamp of GW system. S_j is the nearest sensor node that can respond to U_i's request.
	GW sends the authentication request {DID_i, M_G₋_Sj, T_G} to S_j.
A-4	GW checks if (T_j − T_G) ≤ ΔT, where T_j is the current timestamp of S_j system.
A-4	If (T_j −T_G) ≤ ΔT, then the next step proceeds; otherwise, this phase is aborted.
A-5	S_j computes M_G₋_Sj=h(DID_i∥SID_j∥x_s∥T_G*).
	S_j compares M_G₋_Sj* with M_G₋_Sj. If M_G₋_Sj* = M_G₋_Sj, then the next step proceeds; otherwise, this phase is aborted.
A-6	S_j generates a random nonce RN_j and computes the following.
	y_i = RN_j⊕x_s
	z_i = M_G₋_Sj⊕RN_j*
	M_Sj₋_G = h(z_i∥x_s∥T_j)
	S_j sends the authentication request {y_i, M_Sj₋_G, T_j} to GW.
A-7	GW checks if (T_G′ − T_j) ≤ ΔT, where T_G′ is the current timestamp of GW system.
	If (T_G′−T_j) ≤ ΔT, then the next step proceeds; otherwise, this phase is aborted.
A-8	GW computes the following.
	RN_j=y_i ⊕ x_s
	$z_{i}^{*} = M_{G - S_{j}} \oplus R N_{j}$
	$M_{S_{j} - G} * = h (z_{i}^{*} ‖ x_{s} ‖ T_{j})$
	GW compares M_Sj₋_G* with M_Sj₋_G. If M_Sj₋_G* = M_Sj₋_G, then the next step proceeds; otherwise, this phase is aborted.
A-9	GW computes the following.
	M_G₋_Ui = h(DID_i∥M_G₋_Sj∥M_Ui₋_G∥x_s∥T_G′)
	$w_{i} = z_{i}^{*} x_{s}$
	GW sends the authentication request {y_i, w_i, M_G₋_Ui, T_G′} to U_i.
A-10	U_i checks if (T_i′ − T_G′) ≤ ΔT, where T_i′ is the current timestamp of U_i system. If (T_i′ − T_G′) ≤ ΔT, then the next step proceeds; otherwise, this phase is aborted.
A-11	The smart card computes the following.
	RN_j = y_i ⊕ x_s
	$z_{i}^{*} = w_{i} \oplus x_{s}$
	$M_{G - S_{j}} = z_{i}^{*} \oplus R N_{j}$
	M_G₋_Ui* = h(DID_i∥M_G₋_Sj∥M_Ui₋_G∥x_s∥T_G′)
	The smart card compares M_G₋_Ui* with M_G₋_Ui. If M_G₋_Ui* = M_G₋_Ui, then mutual authentication between U_i and S_j is completed successfully; otherwise, this phase is aborted.
A-12	The smart card computes K_s = f((DID_i∥R_Ni),x_s) to obtain a session key for commu_nication with S_j. Meanwhile, S_j also computes K_S = f((DID_i∥R_Ni),x_s) to share a session key with U_i.