Cryptanalysis and improved mutual authentication key agreement protocol using pseudo-identity

Hyang-Rim Jo; Kyong-Sok Pak; Chung-Hyok Kim; Il-Jin Zhang

doi:10.1371/journal.pone.0271817

Peer Review History

Original SubmissionApril 18, 2022
9 May 2022 Decision Letter - Pandi Vijayakumar, Editor PONE-D-22-11432Cryptanalysis and improved mutual authentication key agreement protocol using pseudo-identityPLOS ONE Dear Dr. Pak, Thank you for submitting your manuscript to PLOS ONE. After careful consideration, we feel that it has merit but does not fully meet PLOS ONE’s publication criteria as it currently stands. Therefore, we invite you to submit a revised version of the manuscript that addresses the points raised during the review process. Please submit your revised manuscript by Jun 23 2022 11:59PM. If you will need more time than this to complete your revisions, please reply to this message or contact the journal office at plosone@plos.org. When you're ready to submit your revision, log on to https://www.editorialmanager.com/pone/ and select the 'Submissions Needing Revision' folder to locate your manuscript file. Please include the following items when submitting your revised manuscript: A rebuttal letter that responds to each point raised by the academic editor and reviewer(s). You should upload this letter as a separate file labeled 'Response to Reviewers'. A marked-up copy of your manuscript that highlights changes made to the original version. You should upload this as a separate file labeled 'Revised Manuscript with Track Changes'. An unmarked version of your revised paper without tracked changes. You should upload this as a separate file labeled 'Manuscript'. If you would like to make changes to your financial disclosure, please include your updated statement in your cover letter. Guidelines for resubmitting your figure files are available below the reviewer comments at the end of this letter. If applicable, we recommend that you deposit your laboratory protocols in protocols.io to enhance the reproducibility of your results. Protocols.io assigns your protocol its own identifier (DOI) so that it can be cited independently in the future. For instructions see: https://journals.plos.org/plosone/s/submission-guidelines#loc-laboratory-protocols. Additionally, PLOS ONE offers an option for publishing peer-reviewed Lab Protocol articles, which describe protocols hosted on protocols.io. Read more information on sharing protocols at https://plos.org/protocols?utm_medium=editorial-email&utm_source=authorletters&utm_campaign=protocols. We look forward to receiving your revised manuscript. Kind regards, Pandi Vijayakumar, Ph.D Academic Editor PLOS ONE Journal Requirements: When submitting your revision, we need you to address these additional requirements. 1. Please ensure that your manuscript meets PLOS ONE's style requirements, including those for file naming. The PLOS ONE style templates can be found at https://journals.plos.org/plosone/s/file?id=wjVg/PLOSOne_formatting_sample_main_body.pdf and https://journals.plos.org/plosone/s/file?id=ba62/PLOSOne_formatting_sample_title_authors_affiliations.pdf 2. We suggest you thoroughly copyedit your manuscript for language usage, spelling, and grammar. If you do not know anyone who can help you do this, you may wish to consider employing a professional scientific editing service. Whilst you may use any professional scientific editing service of your choice, PLOS has partnered with both American Journal Experts (AJE) and Editage to provide discounted services to PLOS authors. Both organizations have experience helping authors meet PLOS guidelines and can provide language editing, translation, manuscript formatting, and figure formatting to ensure your manuscript meets our submission guidelines. To take advantage of our partnership with AJE, visit the AJE website (http://learn.aje.com/plos/) for a 15% discount off AJE services. To take advantage of our partnership with Editage, visit the Editage website (www.editage.com) and enter referral code PLOSEDIT for a 15% discount off Editage services. If the PLOS editorial team finds any language issues in text that either AJE or Editage has edited, the service provider will re-edit the text for free. Upon resubmission, please provide the following: The name of the colleague or the details of the professional service that edited your manuscript A copy of your manuscript showing your changes by either highlighting them or using track changes (uploaded as a supporting information file) A clean copy of the edited manuscript (uploaded as the new manuscript file)” 3. Thank you for stating the following financial disclosure: "No" At this time, please address the following queries: a) Please clarify the sources of funding (financial or material support) for your study. List the grants or organizations that supported your study, including funding received from your institution. b) State what role the funders took in the study. If the funders had no role in your study, please state: “The funders had no role in study design, data collection and analysis, decision to publish, or preparation of the manuscript.” c) If any authors received a salary from any of your funders, please state which authors and which funders. d) If you did not receive any funding for this study, please state: “The authors received no specific funding for this work.” Please include your amended statements within your cover letter; we will change the online submission form on your behalf. 4. We note you have included a table to which you do not refer in the text of your manuscript. Please ensure that you refer to Tables 1 and 2 in your text; if accepted, production will need this reference to link the reader to the Table. Additional Editor Comments: The paper has many serious problems. So the authors should carefully address the reviewers comments and they should submit a revised version in the next round. [Note: HTML markup is below. Please do not edit.] Reviewers' comments: Reviewer's Responses to Questions Comments to the Author 1. Is the manuscript technically sound, and do the data support the conclusions? The manuscript must describe a technically sound piece of scientific research with data that supports the conclusions. Experiments must have been conducted rigorously, with appropriate controls, replication, and sample sizes. The conclusions must be drawn appropriately based on the data presented. Reviewer #1: Yes Reviewer #2: No ******** 2. Has the statistical analysis been performed appropriately and rigorously? Reviewer #1: N/A Reviewer #2: No ****** 3. Have the authors made all data underlying the findings in their manuscript fully available? The PLOS Data policy requires authors to make all data underlying the findings described in their manuscript fully available without restriction, with rare exception (please refer to the Data Availability Statement in the manuscript PDF file). The data should be provided as part of the manuscript or its supporting information, or deposited to a public repository. For example, in addition to summary statistics, the data points behind means, medians and variance measures should be available. If there are restrictions on publicly sharing data—e.g. participant privacy or use of data from a third party—those must be specified. Reviewer #1: Yes Reviewer #2: No ****** 4. Is the manuscript presented in an intelligible fashion and written in standard English? PLOS ONE does not copyedit accepted manuscripts, so the language in submitted articles must be clear, correct, and unambiguous. Any typographical or grammatical errors should be corrected at revision, so please note any specific errors here. Reviewer #1: Yes Reviewer #2: Yes ****** 5. Review Comments to the Author Please use the space provided to explain your answers to the questions above. You may also include additional comments for the author, including concerns about dual publication, research ethics, or publication ethics. (Please upload your review as an attachment if it exceeds 20,000 characters) Reviewer #1: The authors have developed a mutual key agreement scheme to be used in various applications. They have also analysed the performance of the proposed scheme using BAN logic and AVISPA tools. The authors must address the following comments before submitting the next version of the manuscript. The abstract must contain the name of the technical algorithm which the authors had used when comparing their work with the other two different schemes given in the abstract. The introduction section must be strengthened. It must cover the scope of the proposed work and the objectives must be clearly defined. Moreover, the proposed mutual key agreement scheme given in the manuscript must cover the following manuscripts. The following manuscript can be considered for analysis in the related work or for comparison in the performance analysis section. The titles of some notable referecnes are given below � Secure multifactor authenticated key agreement scheme for industrial IoT. � An efficient group key agreement protocol for secure P2P communication. � An efficient anonymous authentication and key agreement scheme with privacy-preserving for smart cities. � A provably secure dynamic ID-based authenticated key agreement framework for mobile edge computing without a trusted party. � An unlinkable authenticated key agreement with collusion resistant for VANET’s � A PUF-based lightweight authentication and key agreement protocol for smart UAV networks. Based on the above considerations, I would recommend MAJOR revision. Reviewer #2: In this proposed work, the authors mentioned about the Stolen smart card attack. However, practically, the smart card data should be available in the encrypted form with the support of the private key of the user like the ATM cards. In ATM cards, the the pin number is linked with the card number. Similarly, in such type of smart cards also, the data should be protected with the support of the users private keys. In User revocation phase, the communication is completely happened in the secure channel like SSL. It will enhance the computational overhead enormously. The authors mentioned that the proposed scheme is secure against the user impersonate attack and the forgery attack. However, there is no proper explanation available about the withstanding against the forgery. There is no proper justification against the main in the middle attack. In performance analysis, the simulation tools are not mentioned. How did they get the timing values for the cryptographic operations without mentioning the simulation tools. ****** 6. PLOS authors have the option to publish the peer review history of their article (what does this mean?). If published, this will include your full peer review and any attached files. If you choose “no”, your identity will remain anonymous but your review may still be made public. Do you want your identity to be public for this peer review?** For information about this choice, including consent withdrawal, please see our Privacy Policy. Reviewer #1: No Reviewer #2: No [NOTE: If reviewer comments were submitted as an attachment file, they will be attached to this email and accessible via the submission site. Please log into your account, locate the manuscript record, and check for the action link "View Attachments". If this link does not appear, there are no attachment files.] While revising your submission, please upload your figure files to the Preflight Analysis and Conversion Engine (PACE) digital diagnostic tool, https://pacev2.apexcovantage.com/. PACE helps ensure that figures meet PLOS requirements. To use PACE, you must first register as a user. Registration is free. Then, login and navigate to the UPLOAD tab, where you will find detailed instructions on how to use the tool. If you encounter any issues or have any questions when using PACE, please email PLOS at figures@plos.org. Please note that Supporting Information files do not need this step. Attachments Attachment Submitted filename: CRYPTANALYSIS PAPER.pdf https://doi.org/10.1371/journal.pone.0271817.r001
Revision 1
22 Jun 2022 Author Response Responses to the reviewer1 1) You pointed that “The abstract must contain the name of the technical algorithm which the authors had used when comparing their work with the other two different schemes given in the abstract.” in your comments. In our paper, we have used the experiment results of Odelu et al.’s scheme and Kilinc et al.’s scheme when comparing the computational cost of our proposed scheme with other related schemes. And we describe about this in the abstract and Section 6 of our manuscript. 2) You also pointed that “The introduction section must be strengthened.” We added a more detailed description of the scope and purpose of the study in the introduction section. We also studied the papers you suggested and cited them and included them in the related work. Responses to the reviewer2 1) You pointed that the communication was completely happened through the secure channel in user revocation phase. If a user loses or is stolen by a malicious user, the user must revocate the already registered user at the user revocation phase. Since the user information in the proposed protocol is stored on a smart card, we argue that the user should work on a secure channel in the revocation phase as well as in the registration phase. 2) You pointed that there was no proper explanation available about the withstanding against the forgery attack. We considered the same type of attack as the impersonate attack and forgery attack in the previous manuscript. In this revised manuscript, we individually analysed the forgery attack resistance by distinguishing it from impersonate attack resistance. In the informal security analysis section, we analysed the resistance of the proposed scheme to forgery attacks. We describe about this in lines from 930 to 941. 3) You pointed that there was no proper justification against the man-in-the-middle attack. We have analysed in detail the man-in-the-middle attack resistance of the proposed scheme in the revised manuscript. We focused on the fact that the man-in-the-middle attack was largely composed of the initiator impersonate attack and the responder impersonate attack, and revealed the attack resistance against it.In our protocol, the session initiator is just the user and the session responder is the server. We have analysed the resistance of our proposed scheme against the man-in-the-middle-attack in the informal security analysis section. We describe about this in lines from 904 to 918. 4) You pointed that the simulation tools were not mentioned in performance analysis. In the previous manuscript, we used the labels we defined without numerically comparing the computational cost. In the revised manuscript, we use the experimental results of the previous researchers to calculate the computational cost more accurately, based on which we compare the computational cost with the previous schemes. In our paper, we have used the experiment results of Odelu et al.’s scheme, Kilinc et al.’s scheme and Jangirala et al’s scheme to compare the computational cost of our proposed scheme with other related schemes. We describe about it in lines from 945 to 967. Additionally, we also compare the communication overhead with previous works and describe it in line from 968 to 980. We hope that the revised manuscript meets the requirements of the editors and reviewers. Thank you and best regards. from Kyongsok Pak Attachments Attachment Submitted filename: Response to Reviewers.doc https://doi.org/10.1371/journal.pone.0271817.r002
8 Jul 2022 Decision Letter - Pandi Vijayakumar, Editor Cryptanalysis and improved mutual authentication key agreement protocol using pseudo-identity PONE-D-22-11432R1 Dear Dr. Pak, We’re pleased to inform you that your manuscript has been judged scientifically suitable for publication and will be formally accepted for publication once it meets all outstanding technical requirements. Within one week, you’ll receive an e-mail detailing the required amendments. When these have been addressed, you’ll receive a formal acceptance letter and your manuscript will be scheduled for publication. An invoice for payment will follow shortly after the formal acceptance. To ensure an efficient process, please log into Editorial Manager at http://www.editorialmanager.com/pone/, click the 'Update My Information' link at the top of the page, and double check that your user information is up-to-date. If you have any billing related questions, please contact our Author Billing department directly at authorbilling@plos.org. If your institution or institutions have a press office, please notify them about your upcoming paper to help maximize its impact. If they’ll be preparing press materials, please inform our press team as soon as possible -- no later than 48 hours after receiving the formal acceptance. Your manuscript will remain under strict press embargo until 2 pm Eastern Time on the date of publication. For more information, please contact onepress@plos.org. Kind regards, Pandi Vijayakumar, Ph.D Academic Editor PLOS ONE Additional Editor Comments (optional): Reviewers' comments: Reviewer's Responses to Questions Comments to the Author 1. If the authors have adequately addressed your comments raised in a previous round of review and you feel that this manuscript is now acceptable for publication, you may indicate that here to bypass the “Comments to the Author” section, enter your conflict of interest statement in the “Confidential to Editor” section, and submit your "Accept" recommendation. Reviewer #1: All comments have been addressed Reviewer #2: All comments have been addressed ******** 2. Is the manuscript technically sound, and do the data support the conclusions? The manuscript must describe a technically sound piece of scientific research with data that supports the conclusions. Experiments must have been conducted rigorously, with appropriate controls, replication, and sample sizes. The conclusions must be drawn appropriately based on the data presented. Reviewer #1: Yes Reviewer #2: Yes ****** 3. Has the statistical analysis been performed appropriately and rigorously? Reviewer #1: Yes Reviewer #2: Yes ****** 4. Have the authors made all data underlying the findings in their manuscript fully available? The PLOS Data policy requires authors to make all data underlying the findings described in their manuscript fully available without restriction, with rare exception (please refer to the Data Availability Statement in the manuscript PDF file). The data should be provided as part of the manuscript or its supporting information, or deposited to a public repository. For example, in addition to summary statistics, the data points behind means, medians and variance measures should be available. If there are restrictions on publicly sharing data—e.g. participant privacy or use of data from a third party—those must be specified. Reviewer #1: Yes Reviewer #2: Yes ****** 5. Is the manuscript presented in an intelligible fashion and written in standard English? PLOS ONE does not copyedit accepted manuscripts, so the language in submitted articles must be clear, correct, and unambiguous. Any typographical or grammatical errors should be corrected at revision, so please note any specific errors here. Reviewer #1: Yes Reviewer #2: No ****** 6. Review Comments to the Author Please use the space provided to explain your answers to the questions above. You may also include additional comments for the author, including concerns about dual publication, research ethics, or publication ethics. (Please upload your review as an attachment if it exceeds 20,000 characters) Reviewer #1: (No Response) Reviewer #2: (No Response) ****** 7. PLOS authors have the option to publish the peer review history of their article (what does this mean?). If published, this will include your full peer review and any attached files. If you choose “no”, your identity will remain anonymous but your review may still be made public. Do you want your identity to be public for this peer review? For information about this choice, including consent withdrawal, please see our Privacy Policy. Reviewer #1: No Reviewer #2: No ******** https://doi.org/10.1371/journal.pone.0271817.r003
Formally Accepted
18 Jul 2022 Acceptance Letter - Pandi Vijayakumar, Editor PONE-D-22-11432R1 Cryptanalysis and improved mutual authentication key agreement protocol using pseudo-identity Dear Dr. Pak: I'm pleased to inform you that your manuscript has been deemed suitable for publication in PLOS ONE. Congratulations! Your manuscript is now with our production department. If your institution or institutions have a press office, please let them know about your upcoming paper now to help maximize its impact. If they'll be preparing press materials, please inform our press team within the next 48 hours. Your manuscript will remain under strict press embargo until 2 pm Eastern Time on the date of publication. For more information please contact onepress@plos.org. If we can help with anything else, please email us at plosone@plos.org. Thank you for submitting your work to PLOS ONE and supporting open access. Kind regards, PLOS ONE Editorial Office Staff on behalf of Dr. Pandi Vijayakumar Academic Editor PLOS ONE https://doi.org/10.1371/journal.pone.0271817.r004

Open letter on the publication of peer review reports

PLOS recognizes the benefits of transparency in the peer review process. Therefore, we enable the publication of all of the content of peer review and author responses alongside final, published articles. Reviewers remain anonymous, unless they choose to reveal their names.

We encourage other journals to join us in this initiative. We hope that our action inspires the community, including researchers, research funders, and research institutions, to recognize the benefits of published peer review reports for all parts of the research system.

Learn more at ASAPbio .