20 Y. YAO ET AL.
performance analysis of the proposed scheme. Finally, we conclude this paper
and present future work in Section 5.
2. Background knowledge and related work
This section rst presents the fundamental knowledge of RLWE-PAK, which is
used by our proposed protocol. Then attack models and security requirements
are presented. Finally, the existing authentication schemes in VANETs and VCC
are discussed.
2.1. Ring learning with error-based password authenticated key exchange
(RLWE-PAK)
This subsection briey introduces RLWE-PAK which is the basis of our proposed
mechanism. RLWE-PAK is based on the ring learning with errors problem. More
detailed descriptions are referred to [10].
Before describing RLEW-PAK, some variables are dened rst. Let n be a power
of 2, and f(x)=x
n
+1. Let q=2
ω(logn)
+1 be an odd prime such that
qmod 2n = 1
. Let
H
1
:{0,1}
*
→R
q
be a hash function, H
l
:{0,1}
*
→{0,1}
κ
for l∊{2,3} be hash functions for
verication of communications and H
4
:{0,1}
*
→{0,1}
κ
be a key derivation function
(KDF). Here, κ is the bit-length of the nal shared key. Let a be a xed element cho-
sen uniformly at random from R
q
and given to all users. Let χ
β
be a discrete Gaussian
distribution with parameter
𝛽 ∈
ℝ
∗
+
. The protocol consists of the following steps:
Step 1: Initiation. Client C randomly samples s
C
,e
C
←χ
β
, computes α=as
C
+2e
C
,
γ=H
1
(pw
C
) and m=α+γ, and sends 〈C,m〉 to party S.
Step 2: Response. Server S receives 〈C,m〉 from party C and checks whether
m ∊R
q
. If not, abort the communication; otherwise it computes α = m +γ′
where γ′=−H
1
(pw
C
). Server S then randomly samples s
S
,e
S
←χ
β
and computes
μ=as
S
+2e
S
and k
S
=α⋅s
S
, with which ω=Cha(k
S
)∊{0,1}
n
and σ=Mod
2
(k
S
,ω)
are computed. Then, it sends μ,ω and k=H
2
(C,S,m,μ,σ,γ′) to party C. After
that, Server S computes the value k″=H
3
(C,S,m,μ,σ,γ′).
Step 3: Initiator nish. Client C checks whether μ∊R
q
, and computes μ∊R
q
and
σ=Mod
2
(k
C
,ω). Client C veries whether H
2
(C,S,m,μ,σ,γ′) matches the value
of k received from Server S where γ′=−γ. If it does not, Client C ends the com-
munication. Otherwise, Client C computes k′=H
3
(C,S,m,μ,σ,γ′) and derives
the session key sk
C
=H
4
(C,S,m,μ,σ,γ′). It then sends k′ back to server S. Here
Cha and Mod
2
functions are dened in [13]. The details are as following: denote
Z
q
=
{
−
q−1
2
, … ,
q−1
2
}
and consider the set
E
: =
{
−
⌊
q
4
⌋
, … ,
⌊
q
4
⌋}
, i.e. the ‘mid-
dle’ of Z
q
. Cha is the characteristic function of the complement of E, which
returns 0 if the input in E and returns 1 if it is not in E, and Mod
2
:Z
q
×{0,1}→{0,1}
is dened as:
剩余22页未读，继续阅读
weixin_38594266
- 粉丝: 4
- 资源: 907
我的内容管理
展开
最新资源
- Vue实现iOS原生Picker组件：详细解析与实现思路
- Arduino蓝牙小车：参数调试与功能控制
- 百度Java面试精华：200页精选资源涵盖核心知识点
- Swift使用CoreData填坑指南：CoreData在Swift 3.0的变化
- 微距离无线充电器创新设计及其实验探索
- MTK Android平台开发全攻略：44步详解流程
- RecyclerView全面解析：替代ListView的新选择
- Android开发：自动适配中英文键盘解决方案
- Android调用WebService接口教程
- Android开发：BitmapUtil图片处理全解析与实例
- Android多线程断点续传实现详解
- PCA算法在人脸识别会议签到系统中的应用
- EventBus 3.0：Android事件总线详解与实战应用
- Android FileUtil：全面解析文件操作实用技巧与实例
- RecyclerView添加头部和尾部实战教程
- Android实现微博滑动固定顶部栏实战与优化
资源上传下载、课程学习等过程中有任何疑问或建议，欢迎提出宝贵意见哦~我们会及时处理！
点击此处反馈
