- 1 -
中国科技论文在线
Cryptanalysis of a Handover Authentication Protocol Based
on Bilinear Pairing Functions#
He Debiao*
(School of Mathematics and Statistics, Wuhan University, WuHan 430072) 5
Foundations: the Specialized Research Fund for the Doctoral Program of Higher Education of China (No.
20110141120003 ).
Brief author introduction:He Debiao received his . degree in applied mathematics from School of
Mathematics and Statistics, Wuhan University in 2009. He is currently a lecturer of Wuhan University. His main
research interests include cryptography and information security, in particular, cryptographic protocols. E-mail:
Abstract: Recently, He et al. proposed a novel handover authentication protocol based on bilinear
pairing functions. They claimed that their protocol could withstand various attacks. However, in this
letter, we will show that He et al.’s protocol is not secure at all, . the adversary could get a user’s
private key from transmitted messages.
Keywords: Wireless networks; security; privacy; efficiency; handover authentication 10
0 Introduction
Developing a secure and efficient handover authentication protocol is a very important topic
in various wireless networks such as WLAN, WiMAX, and 3GPP. For a secure handover, when a
Mobile Node (MN) moves from the current Attachment Point (AP) to a new AP, it needs to 15
authenticate securely the MN to protect itself from illegitimate users or attackers who are not
paying for using the wireless networks [1,2,3]. Moreover, a secure session key should also be
established between the MN and the AP to protect user’s communication data against passive and
active attacks. For an efficient handover, it needs to provide low-cost cryptography operations and
to minimize the communication overheads for a fast handover authentication [4,5]. 20
Very recently, He et al. [6] proposed a novel handover authentication protocol using
pairing-based cryptography to secure handover process and to reduce the communication and
computation overheads of the involved entities. In He et al.’s protocol, only two handshakes are
required between an MN and an AP and no certificate is needed to transmit or verify as in
traditional public key cryptosystems. Thus, He et al.’s protocol is very efficient. This paper 25
examines the security of the He et al.’s protocol and shows that the protocol still fails to achieve
secure communication unlike their claims. In particular, the adversary could get a user’s private
key when he intercept the message transmitted between the MN and the AP.
1 Review of He et al.’s protocol
This section reviews the handover authentication scheme using credentials based on 30
chameleon hashing proposed by He et al. [6]. The scheme is composed of two phases: system
initialization and handover authentication.
System Initialization
In this phase, the authentication server (AS) first initializes the whole system by running the
following steps. Let 1G be a cyclic additive group and 2G be a cyclic multiplicative group of 35
the same order q . Let P be an arbitrary generator of 1G . Let 1 1 2:e G G G× → be a bilinear
map. Then, AS chooses a random number *qs Z∈ as the master key and computes the public key
pubP sP= . Also, AS chooses two secure hash functions 1H and 2H , where
- 2 -
中国科技论文在线
*
1 1:{0,1}H G→ and * *2 :{0,1} qH Z→ . Then AS publishes
1 2 1 2{ , , , , , , }pubparams G G q P P H H= as public system parameters and keeps the master key 40
s secretly.
For each AP, AS computes 1( )APH ID as the public key, 1( )APsH ID as the private key,
and sends them to the AP using a secure transmission protocol, where APID is the identity of the
AP.
When an MN, say i , registers to AS with his real identity iID , AS first checks his validity. 45
If MN i is valid, AS chooses a family of unlinkable pseudo-IDs 1 2{ , , }PID pid pid= … . For
each pseudo-ID jpid PID∈ , AS computes the public key 1( )jH pid and the corresponding
private key 1( )jsH pid , and then securely sends all tuples ( 1( )jH pid , 1( )jsH pid ) back to MN
i . By this, MN i can constantly change its pseudo-ID to achieve identity privacy and location
privacy in handover authentication process. 50
Handover Authentication
To access the network, as illustrated in Fig. 1, an MN, say i , follows the handover
authentication protocol as specified below.
1) MN i picks an unused pseudo-ID ipid and the corresponding private key 1( )isH pid .
Then, MN i computes the signature 2 1( ) ( )i i iH M sH pidσ = ⋅ , where 55
( || || )i i AP sM pid ID t= and st is the current timestamp. Subsequently, MN i computes the
shared symmetric key 1 1 1( ( ), ( ))i APK e sH pid H ID= and sends the access request message
{ , }i iM σ to AP.
2) Upon receiving { , }i iM σ , AP checks whether st is fresh. If st is not fresh, AP stops
the session. Otherwise, AP checks the validity of iσ by verifying whether the equation 60
2 1( , ) ( ( ) ( ), )i i i pube P e H M H pid Pσ = ⋅ holds. If the equation does not hold, AP stops the
session. Otherwise, AP computes the shared symmetric key 2 1 1( ( ), ( ))AP iK e sH ID H pid= and
the authentication code 2 2( || || )i APAuth H K pid ID= . At last, AP sends the access request
message { , , }i APpid ID Auth to MN i .
3) Upon receiving { , , }i APpid ID Aut , MN i checks whether Auth and 65
2 1( || || )i APH K pid ID are equal. If they are not equal, MN i stops the session. Otherwise, MN
i believes AP is legitimate.
- 3 -
中国科技论文在线
Fig. 1. Handover authentication of He et al.’s protocol
70
2 Cryptanalysis of He et al.’s protocol
The environment of wireless networks is very open, then the adversary has total control over
the communication channel between the users and the server in the login and authentication
phases. That is, A may intercept, insert, delete, or modify any message in the channel.
If the adversary A intercepts the access request message { , }i iM σ , where 75
2 1( ) ( )i i iH M sH pidσ = ⋅ , ( || || )i i AP sM pid ID t= and st is the current timestamp. A
could compute the private key 1( )isH pid through the following steps.
1) A computes 2 ( );ih H M=
2) A computes � 1 mod ;h h q−=
3) A computes �1( )i isH pid h σ= ⋅ . 80
With public key ipid and the private key 1( )isH pid , he could do everything like the real
user does when ipid is still before the specified expiry date. He also could generate another
legal access request. The adversary A does not know the real identity of MN i , but he is
successful as long as the AP accepts his access request. Then He et al.’s protocol is not secure for
practical applications. 85
3 Conclusions
This paper demonstrated that He et al.’s handover authentication scheme using bilinear
pairings fails to achieve secure communication unlike their claims. It is the subject of our future
work to design a secure handover authentication scheme without using bilinear pairings.
90
References
[1] Chang C, Lee C, Chiu Y. Enhanced authentication scheme with anonymity for roaming service in global
mobility networks[J]. Computer Communication 2009, 32(4): 611-618.
[2] Choi J, Jung S. A handover authentication using credentials based on chameleon hashing[J], IEEE
Communication Letters,2010,14(1):54-56. 95
[3] He D, Bu J, Chan S, Chen C, Yin M. Privacy-preserving universal authentication protocol for wireless
communications[J],IEEE Trans. Wireless Commun., 2011, (10)2: 431-436.
[4] D. He, J. Bu, S. Chan, C. Chen, and M. Yin, "Privacy-preserving
universal authentication protocol for wireless communications[J], IEEE Trans. Wireless Commun., 2011, 10(2):
431-436. 100
- 4 -
中国科技论文在线
[5] He D, Ma M, Zhang Y, Chen C, Bu J. A strong user authentication scheme with smart cards for wireless
communications[J], Computer
Commun., 2011, 34(3): 367-374.
[6] He D, Chen C, Chan S, Bu J. Secure and efficient handover authentication based on bilinear pairing
functions[J], IEEE Trans. Wireless Commun., 2012, 14(1): 48-53. 105
一种使用双线性对的切换认证机制安全性分析
何德彪
（武汉大学数学与统计学院，武汉 430072）
摘要：最近，He 等提出了一种使用双线性对的切换认证机制，并认为他们的机制能够抵抗110
各种攻击. 然而我们发现敌人通过且获的消息可以得到用户的私钥，因此他们的机制是不
安全的.
关键词：无线网络; 安全性; 隐私性; 性能; 切换认证
中图分类号：TP309
115
