Cryptanalysis of Two Lightweight Authentication Protocols for IoT Environments

Internet of Things (IoT) play an increasingly important role in the field of smart-healthcare, intelligent industry, and smart city, etc. Authentication protocol is vital to ensure data security and user privacy. Recently, Guo and Guo put forward a lightweight authentication protocol for IoT environments. Zhang et al. presented a privacy-preserving authentication protocol for IoT-based e-health systems. Both these two schemes are designed to be rigorous, and preserve critical security properties. But after careful analysis, we found there are a few peccadilloes in their schemes. Specifically, Guo-Guo's scheme is vulnerable to multiple insider attacks, smart device captured attack, and violates forward secrecy. Zhang et al.'s scheme is susceptible to replay attack, and fails to preserve three-factor secrecy and forward secrecy.