Lightweight Certificateless Authenticated Key Agreement Protocol

Lightweight Certificateless Authenticated Key Agreement Protocol Pivot Access Ltd, Kigali, Rwanda Abstract. Data security and privacy are important to prevent the reveal, modification and unauthorized usage of sensitive information. The introduction of using critical power devices for internet of things (IoTs), e-commerce, e-payment, and wireless sensor networks (WSNs) has brought a new challenge of security due to the low computation capability of sensors. Therefore, the lightweight authenticated key agreement protocols are important to protect their security and privacy. Several researches have been published about authenticated key agreement. However, there is a need of lightweight schemes that can fit with critical capability devices. Addition to that, a malicious key generation center (KGC) can become a threat to watch other users, i.e impersonate user by causing the key escrow problem. Therefore, we propose a lightweight certificateless Authenticated Key Agreement (AKA) based on the computation Diffie-Hellman problem (CDHP). The proposed protocol maintains the characteristics of certificateless public key cryptography. The protocol is split into two combined phases. In the first phase, our protocol establishes a session key between users (sender and receiver). In the second phase, we use a lightweight proxy blind signature based on elliptic curve discrete logarithm problem (ECDLP). The used proxy signature has small computation costs, and can fit for small devices such sensors and protects against un-authentication and un-authorization on decentralized system. Compared to the existing AKA schemes, our scheme has small computation costs. The protocol achieves the well known security features compared to the related protocols. Keywords: Cerificateless AKA ·distinguishability·Session key ·proxy blind signature ·forward secrecy ·decentralized. AKA protocols are one of the most important primitive that are useful for information security and privacy. AKA protocol involves the participation of two or more parties that share their public parameters so that they can compute a secret key for their secure communication over an open network. The parties in AKA 1 Introduction Dr. Eng. Mwitende Gervais Computer Science & Engineering: An International Journal (CSEIJ), Vol 13, No 5/6, December 2023 DOI:10.5121/cseij.2023.13602 11 can authenticate each other and encrypt messages in a way that only a computed session key can decrypt them. AKA protocol was introduced to prevent the passive and active attacks [1]. The implementation of AKA protocols can be realized by deploying a public-key infrastructure (PKI) or identity-based (IDbased) cryptography, which was proven to be difficult and vulnerable because of the PKI-based protocols suffer from heavy certificate management burden while ID-based cryptographic systems require all parties to trust a KGC. Our paper investigate AKA schemes and design a lightweight certificateless AKA which can be applied in different areas of technology such as on wireless sensor networks (WSN), wireless body area networks, as well as on other IoTs systems. The first introduced certificateless AKA without trust of third party was proved informally in [2]. Since then, alot of certificateless protocols have been designed. The formal proof of certificateless AKA was presented in [3], and has attracted many researches. Numerous certificateless AKA schemes using pairings have been proposed. However, the computation cost of a pairing is very higher than scalar multiplication over elliptic curve group. Therefore, certificateless AKA without pairing CLAKA protocols would be more useful in terms of efficiency. Recently, several lightweigh AKA protocols have been designed. Authors in [4] proposed an authentication and key agreement protocol to be used for WSNs. It established a session key between sensor node and management server. Their protocol can achieves important security properties for IoTs such as forward secrecy, known session key prevention, and key control. The KGC computes private keys for both entities. Authors in [5] proposed a certificateless AKA for WBAN. Their protocol achieves differents security properties and it is high in computation costs due to the bilinear pairings involved in their scheme. Gervais et al.[6] proposed a CLAKA protocol for healthcare based on decentralized system. Their protocol achieves the well known certificateless security properties and uses security mediated signature. Authors in [7] proposed a cloud-aided lightweight certificateless authentication protocol with anonymity for WBANs. Their protocol consists of a three layer structure, provides anonymity, and its cost for equipment could be high. Li et al. [8] designed an enhanced authentication protocol for body sensors. It provides mutual authentication and session key. The protocol is certificateless, resistant to offline-password guessing attack and was proved in BAN logic. Jiang et al. [9] designed a pairing-based anonymous authentication scheme for body sensors. The protocol establishes a session key between client and application server. It is a lightweight and it is proved under CDH assumption. An anonymous AKA fog computing for healthcare system was proposed in [10]. The protocol requires a password for user registration and fog revocation while establishing the session key between IoT devices, the fog devices and cloud. Authors [11] proposed an authentication scheme for WBAN. Their protocol offers some known security features such as anonymity and unlinkability. A mobile client and application server compute a shared key agreement. Authors of [12] proposed an authentication and key agreement protocol. Their protocol achieves some important security features such as anonymity and untraceability. Computer Science & Engineering: An International Journal (CSEIJ), Vol 13, No 5/6, December 2023 12 It is important to protect sensitive information transmitted and processed over small devices. A malicious can weaken a vulnerable medical system and gains access to the sensitive without authorization. Therefore, we set up a secure lightweight authenticated key agreement between communicating nodes/users. Additional to that, the service provider and storage should avoid security risks of single point of failure and management. Since the body sensors for healthcare are critical devices, the designed protocols require to be lightweight due to run on medical sensors. Hence, in this paper, we setup a lightweight certificateless AKA protocol to secure transmission in a decentralized system. The protocol prevents important security features for AKA and proxy blind signature while a decentralized architecture improves the security by avoiding the system administrator ownership of system. Our work contributes briefly in the following ways: •A Certificateless AKA for decentralized-based system is designed to provide forward secrecy. A session key is established between user Awho is the owner of the sensitive data and the user Bwho is the receiver of the data at the same time Bacts as the decentralized node. •A lightweight proxy blind signature based on ECDLP is used to provide some important security features such as authentication and verification of the data origin among the decentralized nodes. The proxy blinded signature provides distinguishability and unlinkability. It is an efficient signature suitable for resource constrained devices. •The protocol has less computation overhead due to few point multiplication and hash function used during the protocol design. •The formal and informal analysis prove that our protocol is secure in random oracle model under CDH and ECDL assumptions. In section 2, the preliminaries are discussed. In section 3, the modeling of certificateless AKA protocol is presented. In section 4, the proposed protocol is designed. Section 5, the analysis of the proposed protocol is discussed. Section 6, we conclude our paper. The common notation used in this paper are listed as follows in Table 1. 1.1 Motivation and Contribution 1.2 Organization 2 Preliminaries 2.1 Notations Computer Science & Engineering: An International Journal (CSEIJ), Vol 13, No 5/6, December 2023 13 Notation Description Ppub The public key of KGC sMaster secret key iith Users QiThe partial private key of user i IDiThe user’s identity uiThe secret value of user i XiThe public key of user i diThe private key of user i Kij , Kji The session key of user iand user j a,b,y, and rirandom numbers pA large prime number FpPrime field EAn elliptic curve Eover a prime field Fp GAdditive group PGenerator of G H, H1, H2Hash functions p, q Prime numbers xBThe receiver’s private key PBThe receiver’s public key AUser Aconsidered as a sending user BUser Bconsidered as a requesting node VUser Vconsidered as a verifier node P r User P r considered as a proxy signing node xsThe signer’s private key ysThe signer’s public key xpThe proxy’s private key ypThe proxy’s public key QsThe proxy’s public key of the signer Qs=xs.G GA finite point with order nin E/Fp Authors in [2] were the first to propose a certificateless AKA protocol. Since then, several researches about certificateless AKA protocols have been conducted based on pairings and without pairings. Most of the AKA protocols have been designed based on PKI and ID-based cryptography. The PKI certificate management is difficult in terms of computation and storage and ID-based cryptography trusts KGC which can launch an active attack to eavesdrop the communication between users [13]. Therefore, we are required to solve the problem of PKI and avoid the trust on KGC in ID-based AKA. Much efforts have been made to alleviate the previous limitations in authentication and key agreement protocols. The approach to solve the PKI and ID-based AKA problems has been the implementation of certificateless cryptography [14]. During the design of certificateless AKA protocols, the KGC creates a half of the private keys for communicating parties. Users can generate their own private keys using the random selected secret values. Therefore, the key escrow problem is prevented in certificateless cryptography. Hence, certificateless cryptography does not need additional certificate to show the ownership of a public key [15]. Let set pas a prime number. The finite field Fpis comprised of the set of integers {0,1,2, ..., p −1}with the following arithmetic operations: •Addition: If a, b ∈Fp, then a+b=rwhere ris the reminder when a+bis divided by pand 0 ≤r≤p−1. This is known as addition modulo p Table 1. Notations and description 2.2 Background of Certifcateless AKA 2.3 The Finite Field Computer Science & Engineering: An International Journal (CSEIJ), Vol 13, No 5/6, December 2023 14 •Multiplication: If a, b ∈Fp, then a.b =s. where sis the reminder when a.b is divided by pand 0 ≤r≤p−1. This is known as multiplication modulo p •Inversion: If a non-zero element in Fp, the inverse of a modulo p, denoted a−1, is the unique integer c∈Fpfor which a.c = 1. pbe elliptic curve Eover a finite field Fp, defined by the equation: y2= (x3+ax +b), a, b ∈Fp(1) the discriminant  ∆= (4a3+ 27b2)= 0.(2) The points on E/Fp, and the point at infinity make a group of points G. G={(x, y) : x, y ∈Fp, E(x, y)=0}∪{O}.(3) Assume qto be the order of G. The scalar multiplication over E/Fpis defined as tP =P+P+P+· · · +P(ttimes).(4) The detailed mathematical operations related to elliptic curve can be found in [16]. The following defined problems over Gare assumed to be intractable within polynomial time. Definition 1. DLP assumption: Given (P, aP ), for an unknown selected value a∈Z∗ qand Pgenerator of G, compute aP. The DLP states that it is intractable to determine the value afor any probabilistic polynomial-time Definition 2. CDH assumption: Given (P, aP, bP), for unknown a, b ∈Z∗ qand Pgenerator of G, compute abP. The CDH hard assumption states that for any probabilistic polynomial-time, it is intractable to solve the CDH problem. system parameter list params. •Partial-Private-Key-Extract: A KGC takes as input params, a master key, and a user identity IDito return a user partial private key Qi. •Set-Secret-Value: The algorithm takes as input params and a user IDito return user’s secret value ui. •Set-Private-Key: The algorithm takes as inputs params,IDi, a partial private key Qi, and a secret value uito return a private key difor the user. 2.4 Elliptic curve defnition For p≥3 let E/F 2.5 Hard assumptions 2.6 Algorithms for Certifcateless AKA We achieve a Certificateless AKA protocol following six algorithms. •Setup: A KGC takes ȷas input security parameter, output a master key and Computer Science & Engineering: An International Journal (CSEIJ), Vol 13, No 5/6, December 2023 15 •Set-Public-Key: This algorithm takes as inputs params, user IDi, and the secret value uito return a public key Xifor the user. •Key-Agreement: It is a polynomial participative algorithm for both users. It takes as inputs params for users Aand B, with (dA, IDA, XA) for user A, and (dB, IDB, XB) for user B; where dAand dBare private keys for users A and B;IDAand IDBare identities for users Aand B. The XAand XBare set to be public key of users Aand B. Finally both users compute a session key KAB =KBA =K. In this section, we present the security model and system model for the proposed certificateless AKA. The certificateless AKA protocol requires to be resistant to the two types of attacks said Type I and Type II adversaries as described in [17]. •Type I Adversary A1: The A1does not have access to the master secret key, but can replace public key of any party with a value of his choice. •Type II Adversary A2: The A2has access to the master secret key but can not replace public key of any party. The system model is composed of two phases with the following entities: KGC, user Aand Bfor the first phase. The KGC registers and computes partial private keys for both users. Upon receiving partial private keys, both users computes a session key to authenticate themselves and secure data transmission. Note that the key is established in every session when the two entities want to communicate by preventing the known key share problem. In the second phase, we have A, proxy Pr, Verifier V, and other decentralized nodes. Two nodes of the second phase participate in proxy blind signature creation. Figure 1 illustrates the proposed system model architecture as explained in the following steps. •The KGC is dedicated to register the users Aand B. Also, it generates system parameters list. KGC cannot know about the private keys of users Aand B. •The user Acan communicate and transmits data to user Bvia wireless network. User Acomputes its private key and establishes a session key with user B. The session key will encrypt data transmitted from Ato the receiver B. •The receiver Bshould be registered with KGC and get partial-private key and system parameters. It also establishes a session key with A. The session key is used to encrypt and decrypt data that is sent by A over an open network. •User Band proxy Pr and the verifier Vparticipate in the establishment of proxy blind signature for decentralized system 3 Model of the proposed protocol 3.1 Security modeling of the proposed protocol 3.2 System model Computer Science & Engineering: An International Journal (CSEIJ), Vol 13, No 5/6, December 2023 16 The formal security model follow the model discussed in [18]. It is modeled as the game between challenger Cand adversary A∈ {A1, A2}. The adversary monitors all interactions between two parties. Every party possesses an identity IDi. The characteristics of Arepresented by the number of oracles kept by C. Assume that an oracle ϕr i,j represents rth instance of party iand his counterpart jin a session. The game starts when Csets up algorithm with security parameter ȷto return master secret and system pars. If Ais Type I adversary A1,Ctransmits params to Aand maintains master key secret; else Ais Type II adversary A2, Cissues params and master key to A. Adversary Ais a probabilistic polynomial time turing machine. All communications go through A. Parties answer to the queries from Aand do not interact between them. Aacts as benign, i.e Ais deterministic and prefer to choosing two oracles ϕn i,j and ϕl j,i and takes each message from one oracle to another. in addition, Acan ask for the following queries, including one Test query in the following way: •Create(IDi): This query permits Ato request Cto create a new party iwhose identity is IDi. Upon receiving such query, Ccreates private and public keys for i. •Public-Key(IDi): Acan may ask for public key of a party iwhose identity is IDi. To answer, Creplays with the public key Xiof party i. •Partial-Private-Key(IDi): Amay ask for partial private key of party i whose identity is IDi. To respond, Creplays with partial private key Qi of party i. •Corrupt(IDi): Amay ask for private key of party iwhose identity is IDi. To respond, Creplays with the private key diof party i. Fig. 1. System model 3.3 Formal security model Computer Science & Engineering: An International Journal (CSEIJ), Vol 13, No 5/6, December 2023 17 •Public-Key-Replacement(IDi, X′ i): For a party iwhose identity is IDi;A may select another public key X′and set X′as the public key. Crecord this change to be used in the future. •Send(ϕn i,j, µ): Amay select and issues a message µto an oracle Φn i,j, by which, a party iassumes to be sent from party j.Acan also create a particular Send query with µ=αto an oracle Φn i,j, which tells ito start a protocol runs with j. It is called an initiator oracle when the first message it has obtained is α. Otherwise, it is called a responder oracle. •Reveal(ϕn i,j): Amay request a special oracle to reveal the session key, if any, it is currently holding to A. •Test(ϕn i,j): At certain level, Acan choose one of the oracles, for example ΦT I,J to request for one Test query. Such oracle should be fresh. To answer the query, the oracle guesses a coin b∈ {0,1}, and outputs the session key held by ΦT I,J if b= 0, or a random sample from the distribution of session key if b= 1. An oracle (ϕn i,j) can be set to one of the three states •Accepted: An oracle is in Accepted state if it has accepted the request to create a session key. •Rejected: An oracle is in Rejected state if it has rejected the request to create a session key. •State* : If none of the previous states decision has been taken. •Opened: If an oracle has answered the Reveal query. Definition 3. A matching conversation: Two oracles (ϕn i,j)and (ϕl j,i)have a matching conversation if they have identical session key. Definition 4. Fresh Oracle: An oracle (ϕn i,j)is fresh if it is in the accepted state; or it is not in the opened state; or party j=iis not corrupted; or (ϕl j,i) does not exist in opened state to have the matching conversation with (ϕn i,j); or if Ais Type I and has not requested the private key of party jand if Ais Type II and has not replaced the public key of party j The fresh oracle definition can allow party ito be corrupted so that it is used to solve the key compromise impersonation attack. After a Test query, Amay go on to query the oracles except make Reveal query to test oracle ΦT I,J , or to Φl J,I who has a matched conversation with ΦT I,J , and it can not corrupt the user J. In addition, if Ais Type I, Acan not ask for partial private key of the participant J; and if Ais a Type II adversary, J cannot replace the public key of the user J. At the end of the game, Amust output a guess bit b′.Awins if and only if b′=b.A’s advantage to win the game, is defined as: Aȷ=    Pr[b′−b]−1 2     (5) Definition 5. A certificateless AKA protocol is secured if: •In the presence of a benign adversary on Φn i,j and Φl j,i, both oracles always agree on the same session key, and this key is distributed uniformly at random. •For an adversary A, advantage Aȷof winning game is negligible. Computer Science & Engineering: An International Journal (CSEIJ), Vol 13, No 5/6, December 2023 18 The proposed protocol consists of a new lightweight certificateless AKA for WBAN sensors and other IoT environments. In this section, a certificate AKA scheme is proposed. It consists of six polynomial time algorithms. •Setup: This algorithm takes security parameter ȷas its input and returns system parameters and master key. KGC performs the following operations. 1. Given a security parameter ȷ, KGC selects an additive group Gof prime order qand Pis a generator of the group. 2. Selects a random master key s∈Z∗ qand calculates Ppub =sP as master public key. 3. Selects hash functions H1:{0,1}∗×G−→ Z∗ qand H2:{0,1}∗×{0,1}∗× G×G×G×G−→ {0,1}ȷ 4. KGC publishes system params (Fp, E/Fp, G, q, P, Ppub, H1, H2) and keeps ssecret. •Partial-Private-Key: KGC takes as inputs params, the master key sand user identity IDiand returns partial private key of users as follows 1. KGC selects a random number ei∈Z∗ qcomputes Ri=eiP,hi= H1(IDi, Ri). 2. KGC computes KGC computes si= (ei+shi) mod q. 3. KGC sets Qi= (si, Ri) as user’s partial private key. 4. User iverifies whether the partial private key is valid by computing the equation siP=Ri+H1(IDi, Ri)Ppub. •Set-Secret-Value: This algorithm takes params and user’s ID, selects randomly ui∈Z∗ q.uiis sets as secret value. •Set-Private-Key: The algorithm takes as inputs params, partial private key Qi, user’s IDi, and secret value uiand returns user’s private key di= (ui, Qi). •Set-Public-Key: The algorithm takes as input params, user IDiand user’s secret value uito return user’s public key Xi=uiP. •Key-Agreement: Assuming that user Acan establish an authenticated key agreement with user B. Lets users Aand Bestablish a certificateless AKA, and one is the sender another one receiver. The sender Awith identity IDA possesses the private key dA= (uA, QA) and the public key XA=uAP. The receiver Bwith identity IDBpossesses the private key dB= (uB, QB) and the public key XA=uAP. The sender Aand receiver Bcompute the protocol as follows: 1. User Aselects a∈Z∗ q, computes TA=aP and sends a message (IDA, TA) to B. 4 The proposed protocol 4.1 The proposed Certifcateless AKA Computer Science & Engineering: An International Journal (CSEIJ), Vol 13, No 5/6, December 2023 19 query of the form (IDi T, IDj T, Ti T, Tj T, Ki,j T). If ΦT I,J is the initiator oracle or else (IDi T, IDj T, Ti T, Tj T, Ki,j T), with overwhelming probability because H2 is a random oracle. Thus Ccan find the corresponding item in the H2list with probability and 1 qH2and outputs Ki T−sIaP −(RJ+hJPpub −rT I,J Xi) as a solution to the CDH problem. The probability that Csolves the CDH problem is ε q2 cqsqH2. Lemma 3. Under the assumption that the CDH problem is intractable, the advantage of a Type II adversary A2 dv against our protocol is negligible in the ROM. Proof. Suppose that there is a Type II adversary A2 dv who can win the game defined in section 4, with a non-negligible advantage Aȷin polynomial time t. Then, A2 dv can win the game with no-negligible probability ε. Therefore, We show how to use the ability of A2dv to construct an algorithm Cto solve the CDH problem. Suppose a challenger Cis given an instance (aP, bP ) of the CDH problem, and wants to compute cP with c=ab mod q.Cfirst chooses s∈G at random, sets sP as the system public key Ppub, selects the system params ⟨Fp, E/Fp, G, P, Ppub, H1, H2⟩, sends params and master key sto A2dv. Supposed A2 dv makes at most qHitimes Hiqueries and creates at most qcparticipants. Let qsbe the maximum number of sessions each participant can compute. Then, C selects randomly I, J ∈[qH1], T∈[1, qs], responds to the queries as follows. •Create(IDi): Cmaintains an initially empty list Lcconsisting of tuples of the form (IDi, ui, Xi). If IDi=IDI,Cselects a random ri, hi∈Z∗ qand computes Ri=riP,si= (ei+his)mod q, public key Xi=uiPthen i’s partial private key, private key and public key are Qi= (si, Ri), di={⊥, Qi} and i’s public key is Xi. Otherwise, Cselects randomly ui, ei, hi∈Z∗ nand computes si=ei+shi,Ri=eiPand Xi=uiPseparately. Then i’s partial private key, private key and public key are Qi= (si, Ri), di={ui, Qi} and Xi. Finally, Cadds a tuple (IDi, Ri, hi) and (IDi, Qi, ui, Xi) to the list LH1and Lc, separately. Canswers A2dv’s H1(IDi, Ri), P ublic −Key(IDi), Corrupt(IDi), Send(Φn i,j, µ), Reveal(Φn i,j), H2and Test(ΦT I,J ) queries as it is done in Lemma 2. The probability that challenger Cselects ΦT I,J as the Test oracle is 1 q2 cqs. In this case, challenger Cwould not have made Corrupt(ΦT I,J ) or Reveal(ΦT I,J ) queries, and so challenger Cwould not have aborted. If challenger Ccan win in such game, then challenger Cmust have made the corresponding f2query of the form (IDi T, IDj T, Ti T, Tj T, Ki,j T). If ΦT I,J is the initiator oracle. Else (IDj T, IDi T, Tj T, Ti T, Ki,j T), with overwhelming probability because H2is a random oracle. Thus challenger Ccan find the corresponding item in the H2-list with the probability 1 qH2and outputs Ki T− sIbP −(RJ+hJPpub −rT I,J Xj) as a solution to the CDH problem. The probability that Csolves the CDH problem is ε q2 cqsqH2. Theorem 2. The proposed protocol provides the perfect forward security if the CDH assumption in Gis hard. Computer Science & Engineering: An International Journal (CSEIJ), Vol 13, No 5/6, December 2023 26 Proof: Assuming that user Aand Bcompute the session key SK by applying Certificateless AKA protocol, therefore, the private keys KAand SKBget compromised. Assume that aand bare secret values used by user Aand user B when they compute a common session key. For an attacker who possesses SKA, SKB,TA=aP and TB=bP for secrets aand b, must reveal abP. To reveal the value abP without knowing either aor b, the attacker should be able to solve the CDH problem in G. Under the CDH, the probability is negligible. Therefore, the Certificateless AKA proves the perfect forward secrecy feature. We present informally the security features provided by our proposed lightweight Certificateless AKA. •Unknown key share: An attacker the session key to encrypt and sign the message Mbecause at each session a new key is established between Aand user B, and it is hard to compute the CDH problem c=ab. •Key compromise impersonation: If a user Along-term key leaks, the adversary will send a request to the KGC to query users’s partial private key; then the Type I attack is met. However in our protocol if an adversary wants to find the master key or a private key of a user, he has to give aP to seek a; from our assumption of it is a hard problem on the elliptic curve, of a group Gwith generator P. •Key control: None of the users can compute the key agreement because it is derived from a temporary key and computed by two parties Aand B. •Key escrow: Since a malicious KGC can calculate a partial private key Qi. It does not compute di= (ui, Qi) because the user Aand user Bselect randomly uito complete their private keys. •Anonymity: The proposed protocol protects anonymity of nodes during the mediated signature creation. since the content of the message is not revealed due to the proxy signature blindness. •Norepudiation: Other nodes on the chain can not deny the use of data since they can verify the authenticity of user Bsince the proxy blind signature is verifiable. •Immutability: Since the data broadcast by user Bforms a decentralized ledger; no other user/node can modify its content. •Verifiability: Blockchain/Decentralized transaction are publicly known to the chain. Any user can check the transactions and hash along way back to the previous block. •Consensus mechanism: A user Asend a consensus message K||Mto the blockchain as a permission to use its data. This is important before the use of data. •Unlinkability: When the signer is revealed, the proxy signer Pr can not identify the association between the message and the blind signature he created. This shown in verification phase, the signer checks only whether δ=H((β′′G+g.Qp)||M) holds. He is not aware of the original signer’s private 5.2 Informal analysis of security requirements Computer Science & Engineering: An International Journal (CSEIJ), Vol 13, No 5/6, December 2023 27 key and proxy’s private key. Thus the signer knows neither the message nor the signature associated with the signature scheme. •Indistinguishable: The proxy’s key is not similar to original signer’s private key and proxy keys created by different proxy signers are different from each other, any proxy signature is distinguishable from original signer’s signature and different proxy signer’s signature are different. In this section, we compare our protocol in terms of security features, computation costs and communication costs with other recent related protocols. Five related protocols were compared including our proposed certificateless AKA. The protocols designed in [4], [11], [1], [5], and our proposed protocol achieve different security properties. We take into consideration five security properties such as key escrow avoidance, distinguishability,verifiability,unlinkability,consensus,strong undeniable,decentralized architecture. Table 2 presents the comparison about the achieved security properties. We represent point multipliFeature [4] [11] [1] [5] Ours Key escrow ✗✓✗✓ ✓ Distinguishability ✓✗ ✗ ✗ ✓ Unlinkability ✗ ✗ ✗ ✗ ✓ Strong undeniability ✗ ✗ ✗ ✗ ✓ Decentralized ✗✗ ✗✓ ✓ cation as Tm, hash function operations as Th, bilinear pairing operations as Te, symmetric encryption and decryption as Tse. Table 3 illustrates the comparative charts of computation cost and communication cost. Assuming that the size of |m|=160 80 bytes, similar to that of Z∗ q, the size of |ID|=80 8bytes, the size of compressed is reduced to |G1|= 65 bytes, the size of |tc|= 2 bytes [11]. Schemes Computation costs Communication costs User AUser B [5] 2Tm+Te+ 2Th2Tm+Te+ 2Th   2ID + 2Z∗ q    [4] 6Tm6Tm   4Z∗ q+ 4G1+ 2tc+ 2ID   [11] 3Tm+ 4Th7Tm+ 4Th2   Z∗ q+G1+tc    [1] 2Tm+ 1Th1Te+ 1Tse + 1Th   1Z∗ q+ 1G1+ID +Right +tc+MAC   Ours 4Tm+ 2Th4Tm+ 2Th   2ID + 2Z∗ q    The comparison in Table 3 about computation and communication costs of five protocols shows that our proposed protocol has less computation costs with 4Tm+ 2Thon user Aand B. 5.3 Performance analysis Table 2. Functionality features comparison Table 3. The comparison based on computation and communication costs Computer Science & Engineering: An International Journal (CSEIJ), Vol 13, No 5/6, December 2023 28 Authenticated key agreement protocols are important for critical power devices to provide security and privacy of sensitive information. Thus, a certificateless AKA is proposed. A session key is established between user Aand decentralized user Bto assure a secure communication. A certificate AKA achieves more security features than the existing compared AKA protocols such as key escrow, avoidance, distinguishability, verifiability, consensus, and strong undeniable. In addition to that, a lightweight proxy blind signature between decentralized users/nodes is presented to provide the anonymity of the content of message. The proposed protocol is secure in a random oracle model. It is a lightweight for low capability devices. In the future, we propose and recommend to design lightweight AKA based on proxy re-signature that can work on both cloud and IoT big data. This work is supported by the Pivot Access Ltd, Kigali, Rwanda ment for decentralized wbans. In: International Conference on Frontiers in Cyber authentication protocol for wireless body area networks. Future generation 1round authentication protocol for wireless body area networks with user based anonymous authentication scheme in wireless body area networks for scheme for fog-driven iot healthcare system. Wireless Networks 25(8), 4737–4750(2019) mhealth.Journal of medical systems 40(11), 1–10 (2016) [10] Jia, X., He, D., Kumar, N., Choo, K.K.R.: Authenticated key agreement anonymity.Computers & Electrical Engineering 61, 238–249 (2017) [9] Jiang, Q., Lian, X., Yang, C., Ma, J., Tian, Y., Yang, Y.: A bilinear pairing computer systems78, 956–963 (2018) [8] Li, X., Peng, J., Kumari, S., Wu, F., Karuppiah, M., Choo, K.K.R.: An enhanced Security. pp. 268–290. Springer (2019) [7] Shen, J., Chang, S., Shen, J., Liu, Q., Sun, X.: A lightweight multi-layer for blockchain-based wbans. Journal of Systems Architecture 110, 101777 (2020) [6] Gervais, M., Sun, L., Wang, K., Li, F.: Certificateless authenticated key agreekeyagreement for internet of things. Wireless Networks 25(6), 3081–3101 (2019) [5] Mwitende, G., Ye, Y., Ali, I., Li, F.: Certificateless authenticated key agreement [3] Swanson, C.M.: Security in key agreement: Two-party certificateless schemes. Mas-ter’s thesis, University of Waterloo (2008) [4] Saeed, M.E.S., Liu, Q.Y., Tian, G., Gao, B., Li, F.: Akaiots: Authenticated [2] Al-Riyami, S.S., Paterson, K.G.: Certificateless public key cryptography. In: International conference on the theory and application of cryptology and informationsecurity. pp. 452–473. Springer (2003) [1] Li, T., Zheng, Y., Zhou, T.: Efficient anonymous authenticated key agreement scheme for wireless body area networks. Security and Communication Networks 2017 (2017) 6 Conclusion and future work Acknowledgements References Computer Science & Engineering: An International Journal (CSEIJ), Vol 13, No 5/6, December 2023 29 [14]Li, F., Shirase, M., Takagi, T.: Key management using certificateless public key cryptography in ad hoc networks. In: IFIP international conference on networkand parallel computing. pp. 116–126. Springer (2008) [15]Sayid, J., Sayid, I., Kar, J.: Certificateless public key cryptography: A research survey. International Journal of Security and Its Applications 10(7), 103–118 (2016) [16]Hankerson, D., Menezes, A.J., Vanstone, S.: Guide to elliptic curve cryptography. Springer Science & Business Media (2006) [17]He, D., Chen, J., Hu, J.: A pairing-free certificateless authenticated keyagreement protocol. International Journal of Communication Systems 25(2), 221–230 (2012) [18]Zhang, L., Zhang, F., Wu, Q., Domingo-Ferrer, J.: Simulatable certificateless twoparty authenticated key agreement protocol. Information Sciences 180(6), 1020– 1030 (2010) [19]Alghazzawi, D.M., Salim, T.M., Hasan, S.H.: A secure proxy blind signature scheme using ecc. In: International Conference on Networked Digital Technologies. pp. 47–52. Springer (2011) [20] He, D., Chen, Y., Chen, J., Zhang, R., Han, W.: A new two-round certificateless authenticated key agreement protocol without bilinear pairings. Mathematical and Computer Modelling 54(11-12), 3143–3152 (2011) [21] Bellare, M., Rogaway, P.: Random oracles are practical: A paradigm for designing efficient protocols. In: Proceedings of the 1st ACM Conference on Computer and Communications Security. pp. 62–73 (1993) [13] Hou, M., Xu, Q.: A two-party certificateless authenticated key agreement protocol without pairing. In: 2009 2nd IEEE International Conference on Computer Scienceand Information Technology. pp. 412–416. IEEE (2009) [12] Wazid, M., Das, A.K., Kumar, N., Conti, M., Vasilakos, A.V.: A novel authentication and key agreement scheme for implantable medical devices deployment. IEEE journal of biomedical and health informatics 22(4), 1299–1309 (2017) [11] Omala, A.A., Kibiwott, K.P., Li, F.: An efficient remote authentication scheme forwireless body area network. Journal of medical systems 41(2), 1–9 (2017) Computer Science & Engineering: An International Journal (CSEIJ), Vol 13, No 5/6, December 2023 30 BIOGRAPHY Dr. Mwitende Gervais is Deputy Principal of Academics and Training, Senior Lecturer at Rwanda Polytechnic/IPRC Gishari. He started his career of education from former National University of Rwanda-NUR for four years and moved to Rwanda Polytechnic in 2013 as Lecturer in ICT department. Gervais is a consultant of ICT industry in Cybersecurity R& D and Compliance. During his 16 years in Education many students were supervised and graduated under his responsibilities. He earned his bachelor degree of computer science from National University of Rwanda, Postgraduate from CDAC Mohali India, Masters of computer science NUR, PhD in Cryptography and Cybersecurity from University of Electronic science and Technology of China-UESTC. He published 6 scientific industry oriented papers in well-known journals and He is a member of Telecommunication Systems-Springer, and Blockchain & Cryptocurrency B2C. He is Certified of ISO27003 of Cybersecurity Lead Auditor, Certified as Inclusive Education Trainer, and recently completed the certification of GVV Africa.