The ISC International Journal of Information Security

Abstract Multi-Server Authentication and Key Agreement (MAKA) protocols in 5G networks play a pivotal role in securing communications due to their widespread applications in domains such as drones, cellular networks, and secure communications. We propose a novel and efficient protocol for multi-server authentication and key agreement in 5G networks, based on Elliptic Curve Cryptography (ECC). The proposed protocol is secure against attacks such as user and server impersonation, password guessing, insider attacks, tracking, session key disclosure, replay, denial-of-service, and man-in-the-middle attacks. Additionally, distinctive features such as user anonymity, avoidance of bilinear pairing, key confirmation, perfect forward secrecy, and the ability to perform authentication without an online registration server make the proposed scheme more efficient and secure, compared to previous schemes. Formal analysis using Proverif cryptographic protocol verifier, confirms the protocol’s confidentiality and authentication properties, while its computational and communication efficiency demonstrates relative superiority over comparable schemes. 

Abstract Today, the use of Multi-Server Authenticated Key Agreement (MAKA) schemes has become widespread. In the multiserver authenticated key agreement, each entity registers with a registration server, and the key agreement takes place. After that, based on the desired applications, the user communicates with the application servers and he/she does not need to register with these service providers anymore. There are many protocols introduced for MAKA in different environments such as the 5G and cloud service environments, each one could assure some security features such as confidentiality, authentication and privacy. However, some of these schemes are vulnerable to different attacks. In the current paper, we first study two well-known MAKA schemes called the Wang et al.’s protocol (Wang et al., 2022) and the Palit et al.’s protocol (Palit et al., 2023) and then we propose a server spoofing attack on Wang et al.’s protocol. On the other hand, we show that Palit et al.’s protocol is vulnerable to DoS and desynchronization attacks. We also propose some suggestions to make the schemes resistant to those attacks.