Cryptanalysis and Countermeasures of “LAAKA: Lightweight Anonymous Authentication and Key Agreement Scheme for Secure Fog-Driven IoT Systems”

Fog computing is a technology that fog servers cover the computational tasks of cloud server. Therefore, end devices can receive more real-time and localized services from fog servers. Therefore, researchers integrate fog computing and Internet of Things (IoT) to supplement the resource constraint problem of IoT devices and process data services in network edge. In 2024, Ali et al. proposed a mutual authentication and key agreement protocol to preserve anonymous and lightweight communications in fog-driven IoT environments. They utilized only hash functions and exclusive-OR (XOR) operators considering hardware specifications of IoT devices. In this work, we cryptanalysis Ali et al.’s authentication protocol to prove that “ephemeral secret leakage (ESL)” and “stolen verifier attacks” can be performed in their protocol. Moreover, we discover that Ali et al.’s protocol has a “desynchronization problem”, where network entities cannot conduct authentication after initial communication. To supplement these security flaws, we conduct a discussion and present countermeasures, such as physically unclonable function (PUF), dynamic update of temporary identity, and usage of long-term secret parameters.