Perfect forward secrecy in VoIP networks through design a lightweight and secure authenticated communication scheme

Abstract

With the growth of the internet, development of IP based services has increased. Voice over IP (VoIP) technology is one of the services which works based on the internet and packet switching networks and uses this structure to transfer the multimedia data e.g. voices and images. Recently, Chaudhry et al., Zhang et al. and Nikooghadam et al. have presented three authentication and key agreement protocols, separately. However, in this paper, it is proved that the presented protocols by Chaudhry et al. and also Nikooghadam et al. do not provide the perfect forward secrecy, and the presented protocol by Zhang et al. not only is vulnerable to replay attack, and known session-specific temporary information attack, but also does not provide user anonymity, re-registration and revocation, and violation of fast error detection. Therefore, a secure and efficient two-factor authentication and key agreement protocol is presented. The security analysis proves that our proposed protocol is secure against various attacks. Furthermore, security of proposed scheme is formally analyzed using BAN logic and simulated by means of the AVISPA tool. The simulation results demonstrate security of presented protocol against active and passive attacks. The communication and computation cost of the proposed scheme is compared with previously proposed authentication schemes and results confirm superiority of the proposed scheme.

1 Introduction

VoIP technology has provided the possibility to use the internet to make phone calls in comparison with traditional phones. In VoIP technology, voice is sent by IP information packets through the internet. VoIP technology in comparison to traditional phone networks has many advantages such as easy expansibility, implementation flexibility, concentration management and lower cost [48]. VoIP is composed of session initiation protocol (SIP) and real-time transportprotocol (RTP). SIP was first developed by Internet Engineering Task Force on 1999 [13, 31]. It is an application layer signaling protocol whose function is to initiate, manage and terminate a session between two or more systems based on IP. H323 and MGCP are some of rival protocols of SIP [48, 34]. Authentication and key agreement schemes in SIP are either based on password, which are called one-factor schemes [6, 23, 32, 35], or based on password and smart card which are called two-factor schemes [1, 5, 12, 22, 26,27,28,29, 48].

In order to provide a secure key agreement on SIP, many protocols have been proposed in recent years [4, 10, 11, 15,16,17,18, 23, 27, 30, 36,37,38,39, 42,43,44,45,46,47,48]. One of the oldest technologies used for authentication and key agreement in SIP is HTTP digest single factor scheme which was dismissed due to inefficiency in providing security requirements such as mutual authentication, off-line password guessing and stolen verifier attacks [14, 33, 42]. Furthermore, some schemes based on Diffie-Hellman key agreement were presented which suffer from considerable computational costs. Nowadays, considering the importance of decreasing computation and communication costs, protocols are up to providing this matter.

Because of the efficiency of elliptic curve, the difficulty of Discrete Logarithm Problem, and shorter key length, nowadays most one-factor and two-factor authentication schemes use Elliptic Curve Cryptography to provide full security and reduce the computational cost [16, 22, 27, 29, 36, 39, 48].

In 2005, Yang et al. [42] showed that previous mechanism used for authentication and key agreement in SIP (HTTP digest) is vulnerable against offline password guessing and server spoofing attacks. Therefore, a new scheme based on Diffie-Hellman key exchange was presented that the security of this scheme was based on the difficulty of solving the Discrete Logarithm Problem. Durlanik and Sogukpinar [10] showed that Yang et al.’s protocol [42] was not suitable for resource-constrained equipment due to its high computational costs. In order to decrease computational costs, a new scheme based on Elliptic Curve Diffie–Hellman was presented [44]. Yoon and Yoo in 2009 [44] proved that the mentioned scheme [10] is vulnerable against some attacks including stolen verifier and Denning Sacco attacks. Wu et al. in 2009 [39] presented a key agreement and secure authentication scheme for SIP based on the difficulty of Elliptic Curve Cryptography problem. However, Yoon et al. [45] showed that their scheme [39] is vulnerable against offline password guessing attack. Later, it is shown that the presented scheme by Yoon et al. [45] is vulnerable against password guessing attack [21]. Tsai [37] presented a lightweight scheme for SIP. However, Arshad and Ikram [4] proved that the presented scheme by Tsai is vulnerable against offline password guessing and stolen verifier attacks, and does not provide perfect forward secrecy (PFS) and known key secrecy. They also presented a new mutual authentication scheme based on Elliptic Curve Cryptography. Some other researcher, [15, 24, 30, 36], illustrate vulnerability of Arshad and Ikram’s scheme [4] against offline password guessing, internal and masquerade attacks. Irshad et al. [16] demonstrated that the proposed scheme in [36] was insecure against server impersonation attack and they proposed a new scheme, however, their scheme was vulnerable to privileged insider attack [6]. Zhang et al. [46] presented an authentication and key agreement scheme for SIP based on password and smart card which unlike the mentioned schemes doesn’t need to store passwords in server or hold a verification table. Zhang et al. [46] claimed that their scheme is resistant to well-known attacks. Nevertheless, some other researchers affirmed that Zhang et al.’ scheme [46] is vulnerable against user impersonation and malicious insider attacks [18, 38, 47]. Irshad et al. [17] proved that Zhang et al. [46] scheme is vulnerable against Denial of Service attack. Arshad and Nikooghadam [5] proved that the presented protocol by Jiang et al. [18] is vulnerable against user impersonation attack, and Yeh et al.’s scheme [43] is not robust against offline password guessing attack, and can’t provide perfect forward secrecy. Recently, Chaudhry et al. [8] presented an authentication and key agreement scheme preserving privacy. In this paper, we proved their scheme doesn’t provide perfect forward secrecy.

Lu et al. [23] introduced a secure and efficient scheme for SIP in 2016. Nevertheless, Chaudhry et al. [9], Xu et al. [41] and Kumari et al. [20] pointed Lu et al.’s scheme [23] is still vulnerable against user and server impersonation attack, stolen verifier attack and identity guessing attack. Therefore, Xu et al. [41] in 2017 designed a provably secure anonymous mutual authentication scheme.

In 2016, Zhang et al. [48] also presented an efficient authentication and key agreement scheme for VoIP networks. Besides, Nikooghadam et al. [28] presented a scheme for key agreement to preserve privacy through anonymity. In this paper, security flaws of Zhang et al. [48] and Nikooghadam et al. [28] schemes are scrutinized and is demonstrated that Zhang et al. scheme [48] is vulnerable against replay attacks, known session specific temporary information attacks, ignoring re-registration and revocation, violation of fast error detection and does not provide user anonymity, Furthermore, Nikooghadam et al.’s scheme [28] does not provide perfect forward secrecy.

Our contribution: The contribution of this paper is as follows.

• Cryptanalysis of Chaudhry et al.’s scheme [8], Zhang et al. ‘s scheme [48] and Nikooghadam et al. ‘s scheme [28], and demonstrating their security challenges and flaws.

• Presenting a two-factor authentication and key agreement protocol that (a) solves the security challenges of schemes [8, 28, 48]; (b) provides perfect forward secrecy and user anonymity; (c) is more efficient than most recent schemes in terms of both communication and computation costs; (d) uses no expensive operations over elliptic curves.

• Security analysis of the proposed scheme in the BAN logic and the AVISPA tool.

In the first section of this paper, VoIP, SIP and some related works are reviewed. Nikooghadam et al.’s scheme [28] and its security weakness is described in the second section. Chaudhry et al.’s scheme [8] is reviewed in Section 3. security weakness of Chaudhry et al.’s scheme [8] is also explained in this section. Zhang et al.’s scheme [48] is reviewed and analyzed in Section 4. In Section 5, we propose our suggested protocol. In Section 6, security of our suggested protocol is verified through informal and formal analyses. In Section 7, we analyze and compare performance of the suggested protocol with other protocols and finally, the conclusion part is presented.

2 Review of Nikooghadam et al.’s scheme

Nikooghadam et al.’s scheme [28] includes three phases: registration, login and authentication, and password changing phases. In this section, we briefly review the first two phases to analyze their proposed scheme, then its security flaw is demonstrated. The definition of notations used in Nikooghadam et al.’s scheme [28], Chaudhry et al.’s scheme [8] and Zhang et al.’s scheme [48] are shown in Table 1.

Table 1 The notations used in Nikooghadam et al., Chaudhry et al., and Zhang et al.’s schemes

2.1 Registration phase

In registration phase, user performs the following steps over a secure channel. At the end of this phase, a smart card is issued by server to a user.

• Step 1. First, an identity ID_i, a password PW_i, and a random number, r, are chosen by the user. Then the masked password MPW_i = h( ID_i‖r‖PW_i) is computed by the user. The values of ID_i and MPW_i are transferred to the server via a secure channel.

• Step 2. After receiving {ID_i, MPW_i}, the server searches registered user’s table whether received ID_i exists or not. If received ID_i was repetitive, the server asks for a new ID_i. Otherwise, the server computes the values of A_i = h( ID_i‖x), B_i = A_i ⨁ MPW_i and selects a random number, N, and calculates masked identity of user MID_i = E_x( ID_i‖N). At last, the server stores ID_i to the table of registered user, and issues a smart card that, includes {B_i, MID_i, E_key(.)/D_key(.), h(.)}. Then the server sends the smart card to user through a secure channel.

• Step 3. As soon as the user receives smart card, stores the value of random number r into the smart card.

2.2 Login and authentication phase

• Step 1. The user inserts his/her smart card into the card reader and inputs his/her ID_i and PW_i. Then the smart card selects a random number RN_i, captures the current time stamp T_i, and calculates A_i = B_i ⨁ h(ID_i‖r‖PW_i) = h(ID_i‖x),${M}_1={E}_{A_i}\left({ID}_i\left\Vert\ {RN}_i\right\Vert\ {T}_i\left\Vert\ {MID}_i\right.\right)$. Then login request message REQUEST{MID_i, M₁, T_i} is transmitted to the server via an insecure channel.

• Step 2. when, the server receives login request message at T_s, checks condition |T_s − T_i| ≤ ∆T holds or not. If |T_s − T_i| ≤ ∆T holds, then the server calculates D_x( MID_i) = (ID_i‖N) and${A}_i^{\ast }=h\left({ID}_i\left\Vert x\right.\right)$. After that, the server decrypts received M₁ by${A}_i^{\ast }$ as${D}_{A_i^{\ast }}\left({M}_1\right)=\left({ID}_i\left\Vert\ {RN}_i\right\Vert \left.\ {T}_i\right\Vert\ {MID}_i\right)$, acquires (ID_i‖ RN_i‖ T_i‖ MID_i) and compares them with received MID_i and T_i. If they are equal, then the server selects two random numbers N^new and RN_s and computes${MID}_i^{new}={E}_x\left({ID}_i\left\Vert {N}^{new}\right.\right)$,$\kern0.50em {M}_2={E}_{A_i^{\ast }}\left({MID}_i^{new}\left\Vert\ {RN}_s\right\Vert\ {ID}_i\left\Vert\ {RN}_i\right.\right)$ and transmits a challenge message CHALLENGE {M₂} to the user.

• Step 3. Upon receiving {M₂}, user decrypts M₂ as${D}_{A_i}\left(\ {M}_2\right)=\left({MID}_i^{new}\left\Vert\ {RN}_s\right\Vert \left.\ {ID}_i\right\Vert\ {RN}_i\right)$ and verifies ID_i and RN_i. After calculating ${M}_3=h\left(\ {RN}_s\left\Vert {MID}_i^{new}\right\Vert\ {RN}_i\right)$ and SK = h( RN_i‖ A_i‖ RN_s) by the user, he/she replaces MID_i with ${MID}_i^{new}$ and sends a response message RESPONSE {M₃} to the server.

• Step 4. Upon the server receives {M₃}, calculates ${M}_3^{\ast }=h\left(\ {RN}_s\left\Vert {MID}_i^{new}\right\Vert\ {RN}_i\right)$ and verifies condition${M}_3^{\ast }=?{M}_3$. If this condition holds, the user is authenticated by the server. Then server and user agree on same session key $SK=h\left(\ {RN}_i\left\Vert\ {A}_i^{\ast}\right\Vert\ {RN}_s\right)$.

2.3 Cryptanalysis of Nikooghadam et al.’s scheme

If the adversary obtains the private key of the server, x, he/she can acquire session key SK = h( RN_i‖A_i‖ RN_s) by performing the following steps:

• Step 1. In first step of login and authentication phase of Nikooghadam et al.’s scheme [28], M₁ and MID_i are sent through a public channel. So, the adversary can decrypt MID_i with private key of server (x) as D_x( MID_i) = ( ID_i‖N), and obtains ID_i and N. Then the adversary calculates A_i as A_i = h( ID_i‖x) and decrypts M₁ using A_i as${D}_{A_i}\left(\ {M}_1\right)=\left(\ {ID}_i\left\Vert\ {RN}_i\right\Vert \left.\ {T}_i\right\Vert\ {MID}_i\right)$, and derives RN_i.

• Step 2. In second step of login and authentication phase, M₂ is sent to user via an insecure channel, therefore the adversary reaches RN_s with decrypting M₂ with A_i as${D}_{A_i}\left(\ {M}_2\right)=\left({MID}_i^{new}\left\Vert\ {RN}_s\right\Vert \left.\ {ID}_i\right\Vert\ {RN}_i\right)$. As a result, by exposing the private key of server, the adversary is able to derive RN_i, RN_s,and A_i, then calculates session key SK = h( RN_i‖A_i‖ RN_s). Therefore, Nikooghadam et al.’s scheme does not provide the perfect forward secrecy.

3 Review of Chaudhry et al.’s scheme

In this section, first two phases of Chaudhry et al.’s scheme [8] is briefly discussed and then we prove that it does not provide perfect forward secrecy. Chaudhry et al.’s scheme [8] includes three phases: registration phase, login and authentication phase, and password change phase. The used notations in their scheme are listed in the Table 1.

3.1 Registration phase

In this phase, user and server performs the following steps:

• Step 1. The user chooses an identity ID_i, a password PW_i, a random number c, and calculates RP_i = h(c‖ ID_i). Then he/she transmits {ID_i, RP_i } to the server through a secure channel.

• Step 2. The server computes pseudo-identity PID_i = E_ks2( ID_i‖T_s0) for the user. After that, the values of G_i = h( ID_i‖k_s1) ⊕ RP_i, K_i = k_i ⊕ RP_i, H_i = h( ID_i‖k_i‖ RP_i) and J_i = k_i ⊕ h(k_s2‖ID_i) are calculated by the server, the server saves {K_i, H_i, J_i, PID_i, h(.)} into the smart card and forwards the smart card SC_ui and G_i to the user over a secure channel.

• Step 3. When the user receives {SC_ui, G_i }, he/she computes R_i = ( ID_i‖PW_i) ⊕ c and L_i = G_i ⊕ c, and stores both R_i and L_i in SC_ui. At last, the smart card SC_ui subtends {K_i, H_i, J_i, PID_i, h(.), R_i, L_i}.

3.2 Login and authentication phase

Through the login phase, a valid user is able to login to the server after the following calculation.

• Step 1. The user inserts his/her SC_ui, ID_i and PW_i. Then, SC_ui computes c = R_i ⊕ (ID_i‖PW_i), RP_i = h(c‖PW_i), h( ID_i‖k_s1) = L_i ⊕ RP_i ⊕ c ,  k_i = K_i ⊕ h(c‖PW_i) and ${H}_i^{\ast }=h\left(\ {ID}_i\left\Vert {k}_i\right\Vert {RP}_i\right)$.

• Step 2. The smart card SC_ui compares${H}_i^{\ast }=?{H}_i$, if this condition does not hold, the smart card SC_ui stops this session.

• Step 3. After that, the smart card SC_ui calculates h( k_s2‖ID_i) = k_i ⊕ J_i, G_i = L_i ⊕ c, $\overline{G_i}={G}_i\oplus h\left({k}_i\Big\Vert\ {T}_{ui}\right)$, Q_i = h(G_i‖k_i‖P_i‖ T_ui), P_i = G_i ⨁ RP_i, and S_i = k_i ⨁ (h( k_s2‖ID_i)‖ T_ui), transmits authentication request message $\left\{{PID}_i,\overline{G_i},{Q}_i,{S}_i,{T}_{ui}\right\}$ to the server.

• Step 4. Upon receiving the authentication request message, the server S validates time stamp T_ui and calculates $\left(\ {ID}_i\left\Vert {T}_{s0}\right.\right)={D}_{k_{s2}}\left(\ {PID}_i\right)$, k_i = S_i ⨁ (h( k_s2‖ID_i)‖ T_ui), ${G}_i=\overline{G_i}\oplus h\left({k}_i\Big\Vert\ {T}_{ui}\right)$, ${P}_i^{\ast }=h\left(\ {ID}_i\left\Vert {k}_{s1}\right.\right)$ and ${Q}_i^{\ast }=h\left({G}_i\left\Vert {k}_i\right\Vert {P}_i^{\ast}\left\Vert\ {T}_{ui}\right.\right)$.

• Step 5. The server S checks whether Q_i is equal with${Q}_i^{\ast }$. If they are equal, S authenticates the user U_i.

• Step 6. The values $a=h\left({P}_i^{\ast}\left\Vert {k}_i\right\Vert {T}_{s2}\right)$ and ${Z}_i={P}_i\oplus {E}_{k_{s2}}\left(\ {ID}_i\left\Vert {T}_{s1}\right.\right)$ are computed and {a, T_s2, Z_i} are sent by the server to the user.

• Step 7. After receiving {a, T_s2, Z_i}, initially the user verifies T_s2, then computes a^∗ = h( P_i‖k_i‖T_s2) and compares it with received {a}. If a^∗ is equal with received a, the user authenticates the server as a valid server.

• Step 8. The server S and the user U_i calculates the shared key as SK = h( P_i‖k_i‖T_ui‖T_s2‖h( k_s2‖ID_i)).

3.3 Cryptanalysis of Chaudhry et al.’s scheme

Assume secret keys k_s1 and k_s2 of the server are disclosed, by executing the following calculations, the attacker is able to acquire the session key SK = h( P_i‖k_i‖T_ui‖T_s2‖h( k_s2‖ID_i)).

The attacker eavesdrops exchanged messages over a public channel and obtains values {PID_i, T_ui, T_s2, S_i, Z_i}. Then, the attacker decrypts PID_i with k_s2 as ${D}_{k_{s2}}\left(\ {PID}_i\right)=\left(\ {ID}_i\left\Vert {T}_{s0}\right.\right)$ and evolves ID_i. For deriving k_i and P_i, the attacker computes k_i = S_i ⊕ (h( k_s2‖ID_i)‖T_ui) and P_i = PID_i ⨁ Z_i. Thus, in this scheme, perfect forward secrecy does not provide.

4 Review of Zhang et al.’s scheme

In this section, Initialization, registration and authentication phases of Zhang et al.’s scheme [48] is reviewed, then its security flaws are explained. Zhang et al.’s scheme [48] contains four phases: Initialization, registration, authentication, and password changing phases. The used notations in their scheme are listed in the Table 1.

4.1 Initialization phase

• Step 1. An Elliptic Curve equation E_p(a, b) : y² = x³ + ax + b(mod p) over a prime finite field F_p, (where a, bϵF_p and 4a³ + 27b² ≠ 0(mod p)) are chosen by the SIP server. Then, the SIP server selects a base point P over E_p(a, b).

• Step 2. The server selects a high entropy random integer s as its secret key and a one-way hash function h(.) : {0, 1}^∗ → {0, 1}^k, next computes P_pub = sP.

• Step 3. The secret key s is protected by server and {E_p(a, b), P, P_pub, h(.)} as public parameters are published.

4.2 Registration phase

In this phase, a new user registers in the SIP server and at the end of this phase, he/she receives a smart card.

• Step 1. Initially, the user chooses his/her identity ID_i, password PW_i, a high entropy random integer r, and calculates C₁ = h(PW_i ⨁ r). Next, {ID_i, C₁} is sent to the SIP server through a secure channel.

• Step 2. The SIP server calculates C₂ and C₃ as C₂ = h(ID_i ⨁ s) and C₃ = C₁ ⨁ C₂, respectively. Also, it stores C₃ in the memory of the smart card and sends the smart card to the user, via a secure channel.

• Step 3. After receiving the smart card by the user, he/she saves r in to the smart card.

4.3 Authentication phase

At the end of this phase, the user and the SIP server agree to a same session key.

• Step 1. The user inserts his/her smart card into the card reader, and inputs his/her ID_i and PW_i. The smart card chooses a high entropy random integer r₁, a random integer r₂, and calculates the following computations:

$$ {C}_2={C}_3\oplus h\left(\ {PW}_i\oplus r\right)=h\left(\ {ID}_i\oplus s\right), $$

$$ {C}_4={r}_1P, $$

$$ {C}_5={r}_1{C}_2{P}_{pub}, $$

$$ {C}_6=h\left(\ {C}_5\right)\oplus \left(h\left(\ {ID}_i\oplus s\right)\oplus {r}_2\left\Vert {\left(\ {C}_5\right)}_x\right\Vert {\left(\ {C}_5\right)}_y\right). $$

where ( C₅)_x and ( C₅)_y are x/y-coordinates values of elliptic curve point C₅, respectively.

Finally, the request message REQUEST {ID_i, C₄, C₆} is sent by the user to the SIP server through a public channel.

• Step 2. The SIP server computes C₂ = h( ID_i ⊕ s) and retrieves (h( ID_i ⊕ s) ⊕ r₂‖( C₅)_x‖( C₅)_y) as (h( ID_i ⊕ s) ⊕ r₂‖( C₅)_x‖( C₅)_y = h(sC₂C₄) ⨁ C₆. Next, it verifies whether the condition ( C₅)_x‖( C₅)_y = (s C₂ C₄)_x‖(s C₂ C₄)_y holds or not. If it is not equal, the request is rejected. Otherwise, the SIP server acquires r₂ as C₂ ⨁ h( ID_i ⨁ s) ⨁ r₂, then it selects two random integers (r₃, r₄) and calculates C₇ = r₃P and session key SK = h( C₄‖ r₃ C₄‖ C₇). In the following, the SIP server calculates an authentication message Auth_s = h(h( ID_i ⊕ s)‖ r₂‖(SK)_x‖( C₅)_x‖(SK)_y‖( C₅)_y) and forwards a challenge message CALLENGE {realm, C₇, Auth_s, r₄} to the user U_i.

• Step 3. Upon receiving the message CALLENGE {realm, C₇, Auth_s, r₄}, the smart card calculates the session key SK = h( C₄‖ r₁ C₇‖ C₇), and then it computes h( C₂‖ r₂‖(SK)_x‖( C₅)_x‖(SK)_y‖( C₅)_y), and checks the condition h( C₂‖ r₂‖(SK)_x‖( C₅)_x‖(SK)_y‖( C₅)_y) =  ? Auth_s. If it was true, the user U_i and the SIP server S agree to a same session key SK. The user U_i computes the authentication information Auth_u = h((SK)_x‖( r₄ + 1)‖(SK)_y); otherwise, it aborts the session. At last, U_i transmits a response message RESPONSE {realm, Auth_u} to the SIP server S.

• Step 4. The SIP server checks whether Auth_u is equal with h((SK)_x‖( r₄ + 1)‖(SK)_y) or not. If it is not equivalent, the authentication process is terminated. Otherwise, the session key is equal to SK = r₁ r₃P.

4.4 Security weaknesses of Zhang et al.’s scheme

Lack of user anonymity and probability of user traceability

At the end of first step of authentication phase of Zhang et al.’s scheme [48], identity of user is revealed in message REQUEST{ ID_i, C₄, C₆}. So, the adversary is able to eavesdrop request message and obtain identity ID_i of user. Also, the adversary can trace a certain user. Thus, in Zhang et al.’s scheme [48] both user anonymity and user untraceability are violated.

Ignoring re-registration and revocation

The adversary can retrieve the identity of user, ID_i, because ID_i is sent as a plaintext via an insecure channel. So, if an outsider attacker selects a new password ${PW}_i^{\prime }$ and a new random integer r^′, he/she can register in the SIP server S using identity of legal user and the SIP server S cannot distinguish that formerly another user with same identity is registered and thus, it issues a new smart card for outsider attacker. Also, if user’s smart card is stolen/lost, there is no mechanism to prevent misuse stolen/lost smart card.

Known-session-specific temporary information attack

Assume a random number r₁ that it is chosen by smart card in the first step of authentication phase, is unexpectedly revealed to the adversary. Since the values C₄ and C₇ are sent through an insecure channel. The adversary is able to compare the value of r₁P with C₄. If r₁P is equal with C₄, the adversary can retrieve the session key SK as h( C₄‖ r₁ C₇‖ C₇).

Replay attack

In authentication phase of Zhang et al.’s scheme [48], assume the adversary obtains overheard message REQUEST {ID_i, C₄, C₆} and resent it to the SIP server S, he/she is able to login to the SIP server S. Because the SIP server S does not check the freshness of received message REQUEST {ID_i, C₄, C₆}. The server calculates all of computations in Step 2 of authentication phase and sends message CALLENGE{realm, C₇, Auth_s, r₄}. Therefore, time and energy of the SIP server S is wasted.

Violation of fast error detection

In the first step of authentication phase of Zhang et al.’s scheme [48], the smart card calculates ( C₂, C₄, C₅, C₆) without verification through ID_i and PW_i, and sends REQUEST {ID_i, C₄, C₆} to the server. An attacker can enter incorrect ID_i and PW_i, and creates denial of service attack, because the smart card doesn’t check the entered information.

5 The proposed scheme

In this section, we explain our secure and efficient proposed scheme. The proposed scheme includes three phases: (1) registration phase, (2) authentication and key agreement phase, and (3) password update phase. The used symbols in the proposed scheme are shown in the Table 2.

Table 2 The notations used in proposed scheme

5.1 Registration phase

The server and the user perform the following steps‌. At the end of this phase, server issues a smart card to the user.

• Step 1: The user selects identity ID_i, password PW_i and two high-entropy random numbers r_i and b_i, then computes values RB and IP_i as RB = h( r_i‖ b_i) and IP_i = h(h( ID_i‖ PW_i‖RB) mod m) where m is an integer between 2⁸ and 2¹⁶ to avoid simultaneous guess identity and password [19, 25]. Next, he/she sends {ID_i, IP_i, b_i} to the server through a secure channel.

• Step 2: After receiving the registration request {ID_i, IP_i, b_i}, the server calculates A_i, B_i and NID_i as A_i = h( SID_i‖ x_s‖ ID_sc‖ ID_i), B_i = A_i ⨁ IP_i and NID_i = ID_i ⨁ IP_i, then selects time stamp T₁ and computes${RID}_i={E}_{x_s}\left(\ {ID}_{sc}\left\Vert\ {ID}_i\right\Vert\ {T}_1\right)$. The server stores RID_i and B_i in the smart card and forwards it through a secure channel. Also, the server saves 〈NID_i, status, b_i〉 in its database. If the user is logged in, set a status bit, otherwise status = 0. Note: If the user logged out and status = 0, it is impossible that the attacker logs in, because the proposed scheme provides user anonymity and resists against password guessing attack.

• Step 3: when the user receives his/her smart card, computes K_i = B_i ⨁ r_i, W_i = h(h( b_i‖ PW_i‖ ID_i‖ ID_sc) mod m), and H_i = W_i ⨁ r_i. Then, he/she deletes B_i and saves {b_i, K_i, H_i, ID_sc } in the smart card. Finally, his/her smart card contains values {RID_i, b_i, K_i, H_i, ID_sc, E_key(.)/D_key(.), h(.) }. We suppose that database of server is secure and only the server has access to the database. The registration phase of proposed scheme is shown in Fig. 1.

Fig. 1

Registration phase of proposed scheme

5.2 Authentication and key agreement phase

• Step 1: In the beginning of this phase, the user inserts his/her smart card and next, enters his/her identity ID_i and password PW_i. Then, the smart card computes the following calculations:

$$ {W}_i^{\ast }=h\left(h\left(\ {b}_i\left\Vert {PW}_i^{\ast}\right\Vert {ID}_i^{\ast}\left\Vert {ID}_{sc}^{\ast}\right.\right)\mathit{\operatorname{mod}}\ m\right), $$

$$ {r}_i^{\ast }={H}_i\oplus {W}_i^{\ast }, $$

$$ {B}_i^{\ast }={K}_i\bigoplus {r}_i^{\ast }, $$

$$ {RB}^{\ast }=h\left({r}_i^{\ast}\left\Vert\ {b}_i\right.\right), $$

$$ {IP}_i^{\ast }=h\left(h\left({ID}_i^{\ast}\left\Vert {PW}_i^{\ast}\left\Vert {RB}^{\ast}\right.\right.\right)\mathit{\operatorname{mod}}\ m\right), $$

$$ {A}_i^{\ast }={B}_i^{\ast}\bigoplus {IP}_i^{\ast }. $$

Then, it chooses a time stamp T₂ and a random number r_c, calculates ${E}_{A_i^{\ast }}\Big({A}_i^{\ast}\left\Vert {r}_c\right\Vert {T}_2\left\Vert {IP}_i^{\ast}\Big)=E\right.{A}_i$ and forwards message REQUEST {EA_i, RID_i, T₂} to the server via an insecure channel.

• Step 2: When the server receives the login request message REQUEST {EA_i, RID_i, T₂}, checks whether |T₃ − T₂| ≤ ∆T is true or not. If this condition holds, the server decrypts RID_i with secret key x_s as ${D}_{x_s}\left(\ {RID}_i\right)=\left({ID}_{sc}^{\ast}\left\Vert {ID}_i^{\ast}\right\Vert {T}_1\right)$. Next, it calculates ${A}_i^{\ast }=h\left({SID}_i\left\Vert\ {x}_s\right\Vert\ {ID}_{sc}\left\Vert\ {ID}_i\right.\right)$ and decrypts EA_i with ${A}_i^{\ast }$ and extracts A_i, r_c, T₂^′ and IP_i. Then, the server compares A_i with ${A}_i^{\ast }$, and verifies |T₃ − T₂^′ | ≤ ∆T, if these values are not equal, the session is aborted. Otherwise, the user is authenticated by the server. The server calculates NID_i^∗ = ID_i ⨁ IP_i, searches NID_i^∗ in its database and extracts 〈NID_i, status, b_i〉, if the value of status = 1, then, the session is terminated, otherwise the server chooses a time stamp T₄ and a random number r_s. Afterward, it computes the following calculations and forwards a challenge message CHALLENGE {RID_i^′, T₄, EA₂}:

$$ SK=h\left({A}_i\left\Vert {r}_s\right.\left\Vert {r}_c\right.\left\Vert {IP}_i\left\Vert {b}_i\right.\right.\right), $$

$$ m=h\left({IP}_i\left\Vert {r}_c\right.\left\Vert {r}_s\right.\left\Vert SK\right.\right), $$

$$ {EA}_2={E}_{IP_i}\left({IP}_i\left\Vert {r}_c\right.\left\Vert {r}_s\right.\left\Vert {T}_4\right.\right), $$

$$ {RID_i}^{\prime }={E}_{x_s}\left({ID}_{sc}\left\Vert {ID}_i\right.\left\Vert {T}_4\right.\right). $$

• Step 3: When the user receives the challenge message at the time T₅, he/she verifies |T₅ − T₄| ≤ ∆T is true or not. If not, the session is aborted. Otherwise, the smart card decrypts EA₂ using IP_i and extracts ( IP_i^∗, r_c^∗,  r_s^∗, T₄). Then, it compares IP_i^∗ with IP_i and r_c^∗ with r_c. If, IP_i^∗ = IP_i and r_c^∗ = r_c, the smart card authenticates the server and calculates the session key SK and m as SK = h(A_i‖r_s‖r_c‖IP_i‖b_i) and m^∗ = h(IP_i‖r_c‖r_s‖SK) and replaces RID_i with RID_i^′. Finally, the smart card sends response message RESPONSE {m^∗} to the server through a public channel.

• Step 4: After receiving RESPONSE {m^∗}, the server verifies condition m^∗ =  ? m is valid or not. If the condition holds, the server updates status = 1 and agrees with the user on the session key. After computing the session key, the server changes the value of status to zero. The authentication and key agreement phase of proposed scheme is shown in Fig. 2.

Fig. 2

Authentication and key agreement phase of proposed scheme

5.3 Password update phase

In this phase, a legal user is able to change his/her Password, securely.

• Step 1: This step is same as the first step of authentication and key agreement phase.

• Step 2: This step is same as the second step of authentication and key agreement phase.

• Step 3: When the user receives challenge message at the time T₅, he/she verifies |T₅ − T₄| ≤ ∆T is true or not. If not, the session is aborts. Otherwise, the smart card decrypts EA₂ using IP_i and extracts (IP_i^∗, r_c^∗,  r_s^∗, T₄). Then, it compares IP_i^∗ with IP_i and r_c^∗ with r_c. If, IP_i^∗ = IP_i and r_c^∗ = r_c, the smart card authenticates the server and calculates SK = h(A_i‖r_s‖r_c‖IP_i‖b_i). Then, the smart card requests the user to enter his/her new password PW_i^new, and calculates values (IP_i^new, B_i^new, W_i^new, K_i^new, H_i^new, NID_i^new) as following:

$$ {IP_i}^{new}=h\left(h\left(\ {ID}_i\left\Vert {PW_i}^{new}\right\Vert RB\right)\mathit{\operatorname{mod}}\ m\right), $$

$$ {B_i}^{new}={B_i}^{old}\oplus {IP_i}^{old}\oplus {IP_i}^{new}, $$

$$ {W_i}^{new}=h\left(h\left(\ {b}_i\left\Vert {PW_i}^{new}\right\Vert\ {ID}_i\left\Vert\ {ID}_{sc}\right.\right)\mathit{\operatorname{mod}}\ m\right), $$

$$ {K_i}^{new}={B_i}^{new}\oplus {r}_i, $$

$$ {H_i}^{new}={W_i}^{new}\oplus {r}_i, $$

$$ {NID_i}^{new}={ID}_i\oplus {IP_i}^{new}. $$

Finally, the smart card replaces ( K_i, H_i) with ( K_i^new, H_i^new), respectively, and encrypts ( b_i‖NID_i^new) with SK as E_SK( b_i‖NID_i^new) = ESK. Next, it sends ESK to the server.

• Step 4: The server decrypts ESK, with SK and extracts ( b_i‖NID_i^new). Then, it searches b_i in its database, extracts 〈NID_i, status, b_i〉 and replaces NID_i with NID_i^new in the database.

6 Security analysis

6.1 Informal security analysis

Anonymity

In REQUEST, CHALLENGE and RESPONSE messages, identity of user will not be sent plain to the server. Also, if the attacker steals/finds smart card of user and extracts its stored information as {RID_i, b_i, K_i, H_i, ID_sc, E_key(.)/D_key(.), h(.)},and interrupts the login request message REQUEST {EA_i, RID_i, T₂}, the challenge message CHALLENGE {RID_i^′, T₄, EA₂}, and response message RESPONSE {m^∗}, he/she is not able to acquire identity of user ID_i.

$$ {RID}_i={E}_{x_s}\left(\ {ID}_{sc}\left\Vert\ {ID}_i\right\Vert\ {T}_1\right), $$

$$ {EA}_i={E}_{A_i^{\ast }}\Big({A}_i^{\ast}\left\Vert {r}_c\right\Vert {T}_2\left\Vert {IP}_i\Big)\right., $$

$$ {EA}_2={E}_{IP_i}\left({IP}_i\left\Vert {r}_c\right.\left\Vert {r}_s\right.\left\Vert {T}_4\right.\right), $$

$$ {RID_i}^{\prime }={E}_{x_s}\left({ID}_{sc}\left\Vert {ID}_i\right.\left\Vert {T}_4\right.\right), $$

$$ {m}^{\ast }=h\left({IP}_i\left\Vert {r}_c\right.\left\Vert {r}_s\right.\left\Vert SK\right.\right). $$

For obtaining identity of user, ID_i, the attacker needs to have secret key of the server x_s, whereas secret key of the server x_s has been kept securely by the server, therefore, anonymity of user is preserved.

Perfect forward secrecy

If user’s password PW_i and server’s secret key x_s is disclosed, without knowing random numbers r_s, r_c and b_i, the attacker cannot compute the session key SK = h(A_i‖r_s‖r_c‖IP_i‖b_i). For obtaining r_s and r_c, the attacker should know IP_i, that IP_i = h(h(ID_i‖ PW_i‖RB) mod m). Since, value of RB is secret, thus, the attacker is not able to compute IP_i. Therefore, the proposed scheme provides perfect forward secrecy. Also, the attacker has no way to find the value of r_i.

Known-key secrecy

Since the session key is equal to SK = h(A_i‖r_s‖r_c‖IP_i‖b_i) and random numbers r_s and r_c are generated randomly and different to selected random numbers in the other sessions, and also, random numbers r_s and r_c are not related to selected random numbers in previous sessions, even if the session key is disclosed, the attacker is not able to compute other session keys.

Session key security

In our proposed scheme, only the user and the server know the session key. Whereas, the attacker is not able to calculate b_i, A_i and IP_i, therefore, he/she cannot obtain random numbers r_s and r_c, and cannot compute the session key.

Known-session-specific temporary information attack

If session random numbers r_s, r_c and b_i are unexpectedly revealed to the attacker, he/she is not able to compute session key SK. Because the attacker cannot calculate IP_i and A_i. Since, the attacker doesn’t know secret key of the server x_s, user’s password PW_i and identity of user ID_i, the proposed scheme is robust against known-session-specific temporary information attack.

Offline guessing attack

In our proposed scheme, if the attacker interrupts REQUEST, CHALLENGE and RESPONSE messages, he/she acquires following values.

$$ {RID}_i={E}_{x_s}\left(\ {ID}_{sc}\left\Vert\ {ID}_i\right\Vert\ {T}_1\right), $$

$$ {EA}_i={E}_{A_i^{\ast }}\Big({A}_i^{\ast}\left\Vert {r}_c\right\Vert {T}_2\left\Vert {IP}_i\Big)\right., $$

$$ {EA}_2={E}_{IP_i}\left({IP}_i\left\Vert {r}_c\right.\left\Vert {r}_s\right.\left\Vert {T}_4\right.\right), $$

$$ {RID_i}^{\prime }={E}_{x_s}\Big({ID}_{sc}\left\Vert {ID}_i\right.\left\Vert {T}_4\Big),\right. $$

$$ {m}^{\ast }=h\left({IP}_i\left\Vert {r}_c\right.\left\Vert {r}_s\right.\left\Vert SK\right.\right). $$

According to IP_i = h(h( ID_i‖ PW_i‖RB) mod m), for calculating user’s password, the attacker should know IP_i, because the attacker does not aware A_i and B_i (IP_i = A_i ⨁ B_i), he/she is not able to compute IP_i. So, using any of aforementioned messages, the attacker cannot acquire password of user.

Whereas stored parameters in the smart card are {RID_i, b_i, K_i, H_i, ID_sc, E_key(.)/D_key(.), h(.)}, even if the attacker finds/steals smart card, he/she is not able to find PW_i. Also, in our presented scheme, to avoidance guessing two parameters PW_i and ID_i, we use mod m which 2⁸ < m < 2¹⁶.

User impersonation attack

If the attacker wants to impersonate user and send a reliable REQUEST and RESPONSE messages to the server. He/she needs to calculate valid EA_i^∗ and m^∗. To compute a valid EA_i^∗, the attacker should obtain PW_i, ID_i and RB. But, these values are kept securely by the user. Also, to calculate a valid m^∗, the attacker should know IP_i, r_s, r_c, and SK. The attacker is not able to acquire session key SK and he/she does not know selected random numbers by the server, r_s, and the user, r_c.

Server impersonation attack

If the attacker wants to forge the server, he/she should produce a valid challenge message as {RID_i^′∗, T₄^∗, EA₂^∗}. To compute a valid EA₂^∗ and RID_i^′∗, the attacker should know IP_i and the random number generated by the user as r_c. Since the attacker is not able to detect PW_i and ID_i, also, he/she doesn’t know secret key of server, x_s, and RB, thus the attacker cannot impersonate the server. Therefore, the proposed scheme resists against impersonation attacks.

Stolen-verifier attack

In our presented scheme, neither password nor secret key of the server x_s are stored in the server’s database. Therefore the attacker can not retrieve the verification information.

Denning-sacco attack

In this attack, the attacker tries to find a long term private key e.g. user’s password or other session keys through obtained old session key. In the proposed scheme, if the attacker acquires old session key, he/she cannot retrieve user’s password, server’s secret key or other session keys. Because, the session key is equal to SK = h(A_i‖r_s‖r_c‖IP_i‖b_i) that random numbers r_s and r_c are chosen by the server and the user, randomly. So, the attacker cannot detect other session keys using an old session key. Hence, the proposed scheme can resist against denning-sacco attack.

Replay attack

Assume an attacker A, replays the old message REQUEST{EA_i, RID_i, T₂} to the server. In our scheme, the server will find out that this message is repetitive and old. At first, the server verifies|T₃ − T₂| ≤ ∆T, and if this condition is not true, the session terminates. Even if the attacker changes T₂ with current time ${T}_2^{\ast }$ and sends $\left\{{EA}_i,{RID}_i,{T}_2^{\ast}\right\}$ to the server, the server is able to distinguish that the message is old. The server computes ${A}_i^{\ast }$, decrypts EA_i with ${A}_i^{\ast }$ and compares ${T}_2^{\prime }$ with T₃, (${T}_2^{\prime }$ extracts from decryption EA_i). Since the attacker is not able to calculate new EA_i^′ with current time${T}_2^{\ast }$, so$\left|{T}_3-{T}_2^{\prime}\right|\nleqq \Delta T$, our proposed scheme is resist against replay attack.

Privileged insider attack

Assume an insider obtains the registration information {ID_i, IP_i, b_i} from the registration request message. The insider needs to obtain b_i and r_i to guess the user’s password, but, b_i and r_i are random selected numbers by the legal user and they are high entropy. Hence, insider user of the server is not able to guess b_i and r_i during a polynomial time. As a result, our scheme is secure against privileged insider attack.

6.2 Formal security analysis using AVISPA tool

We prove security of our proposed scheme by means of AVIPSA tool [3]. The two widely-accepted back-ends, OFMC and CL-AtSe are selected for the execution tests and a bounded number of sessions model checking. For verification whether the replay attack is possible, these back-ends check whether the legitimate agents can execute the specified protocol by performing a search of a passive intruder. The back-ends then provide the intruder the knowledge of some normal sessions among the legitimate agents. For the Dolev–Yao model checking, these back-ends also verify possibility man-in-the-middle attack by the attacker. The output format contains the following sections:

• SUMMARY shows that the proposed scheme is safe, unsafe, or whether the analysis is also inconclusive.

• DETAILS denotes that under what condition the proposed scheme is safe, or what conditions are used to detect an attack, or why the result was inconclusive.

• PROTOCOL, GOAL and BACKEND are other sections for the protocol name, goal of the analysis and the back-end that has been used, respectively.

• Finally, the trace of an attack (if there is) is also presented in the standard Alice–Bob format [26]. Eventually, we simulate our scheme under OFMC and CL-AtSe back-ends using AVISPA tool.

6.2.1 Simulation results

In this section, we present the simulation results of our proposed scheme. Figs. 3 and 4 show the simulation results for the two back-ends OFMC and CL-AtSe. The results affirm that the proposed scheme is SAFE and secure against active and passive attacks, including replay attack and man-in-the-middle attack.

Fig. 3

The simulation result of the analysis using OFMC of our proposed scheme

Fig. 4

The simulation result of the analysis using CL-AtSe of our proposed scheme

6.3 Formal security proof based BAN logic

Table 3 defines the symbols that are used in the BAN logic rules and the assumptions. In this section, using the BAN logic [7], we analyze our proposed scheme to affirm the correctness of the proposed protocol. In the following, the BAN logic’s rules, assumptions, security goals, and idealized form are defined.

Table 3 The BAN notations

Rules:

• The message meaning rule: $\frac{P\mid \equiv P\overset{K}{\leftrightarrow }Q,P\vartriangleleft {\left\{X\right\}}_K}{P\mid \equiv Q\mid \sim X}.$

• The freshness rule: $\frac{P\mid \equiv \#(X)}{P\mid \equiv \#\left(X,Y\right)}$.

• The nonce verification rule: $\frac{P\mid \equiv \#(X),P\mid \equiv Q\mid \sim X}{P\mid \equiv Q\mid \equiv X}$.

• The jurisdiction rule: $\frac{P\left|\equiv Q\right|\Longrightarrow X,P\left|\equiv Q\right|\equiv X}{P\mid \equiv X}$.

• The belief rule: $\frac{P\mid \equiv (X),P\mid \equiv (Y)}{P\mid \equiv \left(X,Y\right)}$.

Assumptions:

• A1: ${U}_i\mid \equiv \left({U}_i\overset{A_i}{\leftrightarrow }S\right)$.

• A2: $S\mid \equiv \left(S\overset{A_i}{\leftrightarrow }{U}_i\right)$.

• A3: U_i ∣  ≡  ⋕ (r_c).

• A4: U_i ∣  ≡  ⋕ (T₂).

• A5: S ∣  ≡  ⋕ (r_s).

• A6: S ∣  ≡  ⋕ (T₄).

• A7: ${U}_i\mid \equiv S\Longrightarrow \left({U}_i\overset{SK}{\leftrightarrow }S\right)$.

• A8: $S\mid \equiv {U}_i\Longrightarrow \left({U}_i\overset{SK}{\leftrightarrow }S\right)$.

• A9: ${U}_i\mid \equiv \left({U}_i\overset{IP_i}{\leftrightarrow }S\right)$.

• A10: $S\mid \equiv \left(S\overset{IP_i}{\leftrightarrow }{U}_i\right)$.

• A11: ${U}_i\mid \equiv \left({U}_i\overset{b_i}{\leftrightarrow }S\right)$.

• A12: $S\mid \equiv \left(S\overset{b_i}{\leftrightarrow }{U}_i\right)$.

Goals:

• Goal1: ${U}_i\mid \equiv \left({U}_i\overset{SK}{\leftrightarrow }S\right)$ .

• Goal2: $S\mid \equiv \left({U}_i\overset{SK}{\leftrightarrow }S\right)$.

Idealized form:

• Message1: ${U}_i\to S:\left({\left\{{A}_i,{r}_c,{T}_2,{IP}_i\right\}}_{A_i},{\left\{{ID}_{sc},{ID}_i,{T}_1\right\}}_{x_s},{T}_2\right)$.

• Message2: $S\to {U}_i:\left({\left\{{ID}_{sc},{ID}_i,{T}_4\right\}}_{x_s},{T}_4,{\left\{{IP}_i,{r}_c,{r}_s,{T}_4\right\}}_{IP_i}\right)$.

• Message3: ${U}_i\to S:\left({\left({r}_c,{r}_s,{U}_i\overset{SK}{\leftrightarrow }S\right)}_{IP_i}\right)$.

According to the BAN logic rules and the assumptions, the idealized form of the proposed scheme are analyzed as follows:

Based on the message1, we can achieve the following:

• R1) $S\vartriangleleft \left({\left\{{A}_i,{r}_c,{T}_2,{IP}_i\right\}}_{A_i},{\left\{{ID}_{sc},{ID}_i,{T}_1\right\}}_{x_s},{T}_2\right)$

According to the assumption A2, after exerting the message meaning rule to R1, we can conclude R2:

• R2) S ∣  ≡ U_i ∣ ~ (A_i, r_c, T₂, IP_i).

Based on the message2, we can derive R3:

• R3) ${U}_i\vartriangleleft \left({\left\{{ID}_{sc},{ID}_i,{T}_4\right\}}_{x_s},{T}_4,{\left\{{IP}_i,{r}_c,{r}_s,{T}_4\right\}}_{IP_i}\right)$.

Based on assumption A9, after applying the message meaning rule to R3, we can conclude R4:

• R4) U_i|≡S|~(IP_i, r_c, r_s, T₄).

According to A3, after applying the nonce verification rule to R4, we can derive R5:

• R5) U_i|≡S| ≡ (IP_i, r_c, r_s, T₄).

Based on R5, assumptions A2, A12, and session key SK = h(A_i‖r_s‖r_c‖IP_i‖b_i), R6 is concluded:

• R6) ${U}_i\mid \equiv S\mid \equiv \left({U}_i\overset{SK}{\leftrightarrow }S\right)$.

According to assumption A7, we apply the jurisdiction rule to R6 and we can conclude the goal1:

• R7) ${U}_i\mid \equiv \left({U}_i\overset{SK}{\leftrightarrow }S\right).\left(\mathrm{Goal}1\right)$

Based on the message3, we can achieve R8:

• R8) $S\vartriangleleft \left({\left({r}_c,{r}_s,{U}_i\overset{SK}{\leftrightarrow }S\right)}_{IP_i}\right)$.

According to assumption A10, we apply the message meaning rule to R8, and derive R9:

• R9) $S\mid \equiv {U}_i\mid \sim \left({r}_c,{r}_s,{U}_i\overset{SK}{\leftrightarrow }S\ \right)$.

Based on A5, after applying the nonce verification rule to R9, R10 is retrieved as follow:

• R10) $S\mid \equiv {U}_i\mid \equiv \left({r}_c,{r}_s,{U}_i\overset{SK}{\leftrightarrow }S\kern0.5em \right)$.

We apply the belief rule on R10 and can obtain R11:

• R11) $S\mid \equiv {U}_i\mid \equiv \left({U}_i\overset{SK}{\leftrightarrow }S\right)$.

According to assumption A8, after applying the jurisdiction rule to R11, we can achieve to goal2:

• R12) $S\mid \equiv \left({U}_i\overset{SK}{\leftrightarrow }S\right).\left(\mathrm{Goal}2\right)$

7 Analysis of performance and features

The notations T_hf, T_mu, T_ad, T_en/d, T_mm, T_inv are considered to show the computing complexity of one-way hash function, performing the scalar multiplication operation of elliptic curve, a point addition operation of elliptic curve, performing symmetric encryption/decryption and the modular multiplication and modular inversion, respectively. Due to the low computation cost of concatenation (||) and XOR operation, their cost is not considered. According to [2, 40], execution time of T_hf, T_mu, T_ad, T_en/d, T_mm, T_inv are 0.0004 ms, 7.3529 ms, 0.009 ms, 0.1303 ms, 0.0147 ms, and 0.1032 ms, respectively.

The computation costs of recent protocols including the registration, authentication, and key agreement phases for clients and server are represented in Table 4.

Table 4 Computation cost comparison between recent protocols and proposed protocol

As it is shown in Table 4 and Fig. 5, our proposed scheme comes third in terms of computation cost. The protocol of Chaudhry et al. [8] has the least calculation costs but Chaudhry et al.’s scheme [8] and Nikooghadam et al.’s scheme [28] do not provide the perfect forward secrecy security requirement.

Fig. 5

Comparison of execution time between our proposed protocol and other protocols

According to [40], communication costs for sending identity ID_i is considered to be 160 bits, for timestamp 32-bits, for symmetric encryption and decryption operations is 128-bits, elliptic curve point multiplication and output hash function are 320 bits and 160 bits, respectively.

According to the Table 5, in the login phase of our proposed scheme, three messages will be sent. Communication cost of our proposed scheme based on the given aforementioned numbers is:

• The sending request: $\left\lceil \frac{160+128}{128}\ \right\rceil$*128+ $\left\lceil \frac{160+128}{128}\ \right\rceil$*128 + 32 = 800 bits.

• The sending challenge: 32+ $\left\lceil \frac{160+128}{128}\ \right\rceil$*128+ $\left\lceil \frac{160+128}{128}\ \right\rceil$*128 = 800 bits.

• The sending response: 160 bits.

Table 5 Communication costs comparison between recent protocols and proposed protocol

According to the performed computation, the cost of communication in our proposed protocol is 1760 bits. Communication costs of the other protocols are calculated in the same way and given in Table 5.

Although the communication cost of the proposed protocol in comparison with schemes [8, 9, 20, 28, 41, and] is increased, the schemes [9] and [41] are vulnerable against known session specific temporary information attack and ignore re-registration and revocation, scheme [20] is vulnerable against ignoring re-registration and revocation, schemes [8] and [28] do not provide the perfect forward secrecy. As shown in Table 5, this additional communication cost provides all security aspects that are provided by the proposed scheme.

The performed analysis of the recent protocols are presented in Table 6. As it can be observed in Table 6, our suggested protocol is resistant to all of the attacks and provides security requirements such as perfect forward secrecy and known key secrecy. Moreover, the user anonymity is provided in our presented protocol. Therefore, our proposed scheme is a secure scheme with reasonable cost among all latest authentication schemes.

Table 6 Functionality comparison between recent protocols and proposed protocol

8 Conclusion

In this paper, we first investigate the security weaknesses in the represented protocols by Chaudhry et al., Nikooghadam et al. and Zhang et al. As it was investigated, the presented protocols by Chaudhry et al. and Nikooghadam et al. do not provide the perfect forward secrecy and the represented protocol by Zhang et al. does not resist against the replay attack, known session-specific temporary information attack and also, does not provide user anonymity, fast error detection and ignores re-registration and revocation. Therefore, in order to resolve the mentioned security flaws, we present an authentication and key agreement scheme based on password and smart card. Then, the presented protocol is analyzed formally and informally. Security verifications show security of the proposed protocol against various attacks. Informal proof shows that the presented scheme provides significant security requirements. Then, we show that the presented scheme has low calculating costs as it does not use expensive operators in elliptic curve including multiplication on elliptic curve. Thus, we present an efficient scheme that it provides security and has low computation and communication costs, therefore, this is an efficient and secure scheme for VoIP.