Mutually Authenticated Key Exchange Protocol For Computationally Limited Devices

Yuh‐Min Tseng, Jian-Lun Chen, Sen‐Shan Huang

Duncan S. Wong, Agnes Hui Chan

Daojing He, Yanchang Cai, Shanshan Zhu +3 more

The number of IoT devices is growing rapidly, and the interaction between devices and servers is also more frequent. However, IoT devices are often at the edge of the network, which leads their communications with the server to be completely exposed, making it more vulnerable to attacks. Moreover, IoT devices have limited energy and computational resources. Therefore, we propose in this paper a lightweight authentication and key exchange protocol with anonymity for IoT devices. The proposed scheme supports mutual authentication between IoT devices and the server. We verify the security of the protocol through formal and informal analyses. Finally, we compare security and performance with other protocols, which shows that our protocol has the advantages of being lightweight and secure.

Loïc Ferreira

Yue Zheng, Wenye Liu, Chongyan Gu +1 more

Peer to Peer (P2P) or direct connection IoT has become increasingly popular owing to its lower latency and higher privacy compared to database-driven or server-based IoT. However, wireless vulnerabilities raise severe concerns on IoT device-to-device communication. This is further aggravated by the challenge to achieve lightweight direct mutual authentication and secure key exchange between IoT peer nodes in P2P IoT applications. Physical unclonable function (PUF) is a key enabler to lightweight, low-power and secure authentication of resource-constrained devices in IoT. Nevertheless, current PUF-enabled authentication protocols, with or without the challenge-response pairs (CRPs) of each of its interlocutors stored in the verifier’s side, are incompatible for P2P IoT scenarios due to the security, storage and computing power limitations of IoT devices. To solve this problem, a new lightweight PUF-based mutual authentication and key-exchange protocol is proposed. It allows two resource-constrained PUF embedded endpoint devices to authenticate each other directly without the need for local storage of CRP or any private secrets, and simultaneously establish the session key for secure data exchange without resorting to public-key algorithm. The proposed protocol is evaluated using the Mao and Boyd logic as well as the automatic security analysis tool ProVerif to corroborate its mutual authenticity, secrecy, and resistance against replay and man-in-the-middle attacks. Using two Avnet Ultra96-V2 boards to emulate the two IoT endpoint devices of a network, a physical prototype system is also constructed to demonstrate and validate the feasibility of the proposed secure P2P connection scheme.

Ali Shahidinejad, Jemal Abawajy, Shamsul Huda

Recent advances in quantum computing threaten key exchange protocols based on problems like prime factorization and discrete logarithms. In response, NIST is standardizing post-quantum cryptographic methods, selecting CRYSTALS-Kyber for its efficiency. However, Kyber’s key exchange protocol assumes prior authenticated communication and requires significant computational overhead. To address these limitations, we propose a NIST-compliant, quantum-resistant, password-authenticated key exchange protocol for mobile devices. Built on Kyber’s encryption primitives, it achieves mutual authentication and perfect forward secrecy. Compared to Kyber’s original protocol, ours reduces communication and computation costs by 46% and 67%, respectively. It also ensures strong anonymity and resists common attacks. Formal proofs and hardware implementation confirm its security and efficiency.