Pith. sign in

REVIEW 4 major objections 5 minor 83 references

Adaptive Group-based Zero Knowledge Proof-Authentication Protocol (AGZKP-AP) in Vehicular Ad Hoc Networks

T0 review · 4 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read AGZKP-AP is a zero-knowledge group protocol that lets vehicles authenticate to roadside units anonymously, with user-chosen privacy levels and distributed revocation, and claims false-authentication probability essentially zero.

desk verdict The adaptive-privacy knob is a reasonable idea, but the paper's core ZKP is broken as written: the ± square witnesses make the verification equation fail for half of all challenges. read the letter →

arxiv 1908.09085 v1 pith:6OTEHM4W submitted 2019-08-24 cs.CR

Amar A. Rasheed , Rabi N. Mahapatra , Felix G. Hamza-Lup This is my paper · ORCID
classification cs.CR
keywords vehicularadhocnetworkszero-knowledgeproofanonymousauthenticationadaptiveprivacydistributedrevocationRSUcheaterZKPsimulatorattackconditionalanonymity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes AGZKP-AP, a mutual-authentication protocol for vehicular ad hoc networks in which an onboard unit (OBU) proves to a roadside unit (RSU) that it belongs to an authorized group without revealing which vehicle it is. The proof system is built from the classical zero-knowledge trick of proving knowledge of a square root without disclosing it: each OBU and RSU holds secret square roots of published witness values, and authentication consists of answering random challenges on those roots. The protocol makes privacy tunable through a user-selected parameter $\alpha$ that sets how many of the $\mu$ proofs sent by the RSU must verify, trading stronger RSU authentication against latency and information exposure. A distributed revocation mechanism uses pseudorandom sequences seeded by an IV and a counter to identify and exclude misbehaving vehicles, with identity disclosure reserved for law enforcement. The authors claim that false-authentication probability approaches zero as the parameters $k$, $h$, $\mu$, and $n$ grow, and their simulations show modest communication delays and packet loss.

What carries the argument

The load-bearing identity is the quadratic-residuosity response equation: a prover who knows the secret square roots can answer a random binary challenge $(b_0,\dots,b_k)$ with $Y = R\cdot \prod S_x^{b_x} \pmod m$, and the verifier checks $Y^2 = W\cdot \prod I_x^{b_x} \pmod m$, where $W = \pm R^2 \pmod m$. A cheater who does not know the roots must guess the challenge, succeeding with probability $2^{-k}$ per iteration; the protocol repeats the check $h$ times and, on the RSU side, $\mu$ times with distinct $k$-secret subsets, which the paper estimates as making the RSU-cheater probability $(1/(2^{kh}\cdot \binom{n}{k}))^\mu$. The group-based witness sets $I_x$ and $g_y$ are what carry anonymity: an OBU proves only membership in group $G_i$, not its individual id. The revocation machinery uses a pseudorandom function seeded by a 64-bit IV and a counter so the same secret-id sequence can be regenerated for pattern matching. The Section VIII countermeasure replaces the plain product with a polynomial $g(x)$ whose coefficients come from a shared hash, producing $Y = R^2\cdot g(x) \pmod m$ and a check $Y\cdot Y' = W \pmod m$, to block simulator replay.

What would settle it

Choose a small instance of the Section VIII protocol, such as $k=1$ with a Blum modulus $m$, a single secret $S_1$, and the shared hash-derived polynomial $F(x)$, and check whether an honest prover's response $Y$ always satisfies the verification equation $Y\cdot Y' \equiv W \pmod m$; any honest transcript that fails the check shows the protocol is incomplete, which would collapse the claimed replay defense.

Watch

Extended reading notes

Core claim

The central claim is that anonymous, adaptive-privacy mutual authentication between OBUs and RSUs can be built from group-based zero-knowledge proofs, with revocation handled distributively so that no roadside unit or authentication server can track an honest driver. A key distribution centre assigns each OBU-group a master secret composed of $k$ private values; the published witness values $I_x$ and $g_y$ are $\pm S_x^2 \pmod m$ and $\pm Pr_y^2 \pmod m$ for a Blum modulus $m$ (a product of two primes, each congruent to 3 mod 4), so knowing a secret is equivalent to knowing a square root that a verifier can test without learning. OBU-to-RSU authentication is a single proof of group-master-key knowledge; RSU-to-OBU authentication runs $\mu$ independent proofs over randomly chosen $k$-secret subsets, and the OBU accepts after verifying at least $\alpha$ of them, with $\alpha$ chosen by the driver and agreed with the service provider. The revocation mechanism reconstructs the OBU's secret-id sequence from a pseudorandom seed (IV + counter), so RSUs can update revocation tables without a centralized certificate-revocation-list broadcast, and identity is revealed only in the case of a violation. Section VIII adds a polynomial-based variant with a shared hash-derived polynomial, intended to make replay by an inexpensive ZKP simulator infeasible.

Load-bearing premise

The load-bearing assumption is that the altered zero-knowledge proof in Section VIII, with its new polynomial $g(x)$ and the verification check $Y\cdot Y' = W$, is a real working proof system; the paper gives no proof of this and the subscripts in the equations do not line up, so if the variant fails, the claimed defense against ZKP simulator replay attacks collapses.

Editorial extensions

If this is right

  • An RSU that runs AGZKP-AP never receives the OBU's identity, only a group membership proof, so honest RSUs cannot build per-vehicle movement profiles from authentication traffic.
  • The $\alpha$ threshold gives a direct privacy dial: a driver can set $\alpha$ low for speed in a time-critical service, or $\alpha$ high for stronger assurance that the RSU it is talking to is genuine.
  • The PRF-based revocation mechanism lets every RSU exclude a revoked OBU once its IV+counter sequence is published, avoiding the large certificate-revocation lists associated with pseudonym schemes.
  • With the parameter ranges plotted in the paper ($k=5$, $h=4$, $n=50$, $\mu$ from 5 to 10), the estimated RSU-cheater and false-authentication probabilities drop below $10^{-60}$, so small proof counts already make the protocol highly resistant to RSU cheaters.
  • The protocol's hybrid use of AES session encryption and ZKP keeps the per-authentication delay low enough, under the reported simulation numbers, for time-sensitive VANET services such as emergency response.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because every authentication message carries the group id $G_i$, the effective anonymity set is the members of that group, not the whole network; a deployment would need to keep groups large enough for that set to provide real privacy.
  • The accept-after-$\alpha$-of-$\mu$ rule is a generic pattern: any zero-knowledge credential system could adopt the same threshold trade-off, provided the underlying proof has a formal completeness and soundness analysis.
  • If the Section VIII polynomial variant is made correct and proven zero-knowledge, it may also change the transcript distribution across sessions, potentially reducing cross-session linkability of authentication records—a property the paper does not explicitly analyze.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The manuscript proposes AGZKP-AP, a group-based zero-knowledge-proof authentication protocol for VANETs. The protocol combines group-based secrets with two-way ZKP execution between OBUs and RSUs, an adjustable privacy parameter α, a distributed revocation mechanism based on IV/counter sequences, and a polynomial-based countermeasure against ZKP simulator attacks. The paper presents probabilistic security claims (Sections VI and IX), a threat model (Section VII), and OMNET++ performance results (Section X), concluding that the protocol achieves anonymous, adaptive mutual authentication with a probability of false authentication approaching zero.

Significance. If the protocol were correct, the adaptive privacy/resource trade-off and distributed revocation would be a useful contribution to VANET authentication, and the OMNET++ evaluation provides some evidence about practical overheads. The authors are also to be credited for explicitly describing a threat model and giving quantitative security estimates. However, the core ZKP construction suffers from a concrete completeness failure, the polynomial countermeasure in Section VIII is ill-defined, and the probability formulas in Section VI are not derived from a precise adversarial model. As written, the protocol cannot reliably authenticate even honest parties, so the central claims are not established and the significance of the contribution is only prospective.

major comments (4)
  1. [Section V, Fig. 5] The ZKP primitive is incomplete as specified. In both authentication legs, the public witnesses are defined with signs: I_x = ±S_x^2 mod m in the RSU-to-OBU leg and g_y = ±Pr_y^2 mod m in the OBU-to-RSU leg. The prover sends W = ±R^2 before receiving the challenge vector b = (b_0,...,b_k), and the verification equation is Y^2 = W·∏I_x^{b_x} (or with g_y). For a challenge vector that selects an odd number of negatively signed witnesses, ∏I_x^{b_x} ≡ -∏S_x^{2b_x}, while Y^2 ≡ +∏S_x^{2b_x}; the equation would require W ≡ -R^2. For the complementary challenge vectors it requires W ≡ +R^2. Since W is fixed before the challenge, no choice of sign can satisfy both parity classes. An honest prover therefore fails with probability 1/2 in each round, and after h rounds an honest proof succeeds only with probability 2^{-h}. This is a completeness failure of the core primitive used in both authentication directions, not merely a missing security proof; it invalidates the mutual-authentication claim and the probability estimates in Sections VI and IX that assume honest provers succeed.
  2. [Section VIII] The polynomial-based countermeasure against ZKP simulator attacks is not a well-defined protocol. F(x) is written as ∑_{k=0}^{k-1} a_k x^k b_k, using k both as the degree and as the summation index, and the polynomial argument x is never bound to any value in the protocol. The prover's g(x) = ∏_{i=1}^k ∑_{k=0}^{k-1} a_k S_i^{2k b_k} is not a function of x, and Y = (R^2·g(x)) mod m has no stated algebraic relationship to the verification condition Y·Y' = W with Y' = 1/(∏ ∑ a_k I_i^{k b_k}) mod m. Unless an unstated identity relates g(x) to the I_i, the verification equation is not implied by the protocol steps. No completeness, soundness, or zero-knowledge proof is given for this modified scheme. Since Section VII identifies the simulator attack as the main threat and Section VIII is the only defense against it, the claimed resistance to ZKP simulator attacks and the 'substantial resistance' conclusion in Section XI are unsupported.
  3. [Section VI] The probability formulas in Section VI are asserted without derivation and are not consistent with the protocol description. In Section VI.B, P_μ = (1/(2^{kh}·C(n,k)))^μ includes a factor 1/C(n,k) for each proof, but the protocol in Fig. 5 step 1 states that the verifier shares the μ k-secret-id sets with the prover before proof generation; the cheating probability per proof should therefore depend on guessing the challenge bits, not on choosing the secret subset, unless a different adversarial model is explicitly defined. More seriously, Section VI.D gives q_x = (1/(2^{x(k-1)})·C(n,k)^{x-1})^μ for the probability that x OBUs use the same sequence of μ ZKP proofs; no counting argument is provided, the exponent (k-1) and the power x-1 do not follow from the protocol, and the event 'same sequence of μ ZKP proofs' is not the same as 'same secret-id sets' because proofs also depend on random R and challenge values. Section VI.E gives p = 1/(C(n,k)(C(n,k)-1)...(C(n,k)-μ)), which has no μ in the numerator and cannot represent a collision probability for μ draws. The conclusion that false authentication approaches zero rests entirely on these unsubstantiated estimates.
  4. [Section VII] The threat model conflates a transcript-replay attack with a zero-knowledge simulator. A ZKP simulator is an internal algorithm used in proving the zero-knowledge property; it does not by itself give an attacker a way to replay recorded transcripts. The claimed memory requirement of 2^{2k+6}·C(n,k) bytes and the 2^k×2^k matrix representation in Fig. 8 are not derived from the protocol or from any precise attack strategy, and the description in Fig. 7 does not explain how the attacker obtains the W and Y matrices without knowing the random values R or the private secrets. Consequently, both the attack and the countermeasure in Section VIII are not crisply defined, and the security analysis in Sections VII and VIII does not support the paper's central security claims.
minor comments (5)
  1. [Table 1] The term 'whiteness' for I_x should be 'witness'; similarly, the text uses 'witnesses W_G1' in Section V.C, which conflicts with the commitment W used in the ZKP protocol.
  2. [References] Reference [33] is listed twice for two different papers; the numbering should be corrected.
  3. [Section V.B and Section X] The relationship between α and privacy is stated inconsistently: the text says α=1 gives the highest anonymity and higher α increases information disclosure, while Section X labels α=5 as a higher anonymity level with larger authentication packets; the paper should clarify whether α is a privacy level or a verification threshold.
  4. [Section VI.D and Section VIII] The variable x is used both as an index in q_x and as the polynomial variable in F(x); this makes the already terse equations harder to parse and should be renamed.
  5. [Section IX] The captions of Figures 10a and 10b appear swapped: the text describes plotting versus h in Fig. 10a, but the axis labels show k; please verify the figure ordering and axis labels.

Circularity Check

1 steps flagged · score 2.0 of 10

The α privacy/latency trade-off is definitional rather than measured; the core ZKP security and revocation analysis is not circular.

  1. self definitional [Section V.B (Authentication Protocol, definition of α) and Section X (Simulation Results, Fig. 14)]
    "In the proposed protocol, we consider the use of a privacy performance metric α that is incorporated into the design of AGZKP-AP. We use this performance metric to limit the number of ZKPs needed to be verified for successful authentication. ... Since anonymity level is directly proportional to the size of the authentication packets, we consider different simulation scenarios: (i) authentication packet size = 50Bytes, α=2 (ii) authentication packet size = 100Bytes, α=4, and (iii) packet size=125Bytes, α=5."

    α is defined in Section V.B as the threshold number of ZKP proofs the OBU must verify (α ≤ μ), so increasing α mechanically requires more proofs and more bytes of authentication data. Section X then sets the simulated packet size directly proportional to α (50, 100, 125 bytes) and reports that delay and packet loss increase with α. The claimed privacy-versus-latency trade-off is therefore a consequence of the parameter definition and the scenario construction, not an independently measured prediction.

full rationale

The main security derivation is self-contained. Section VI's probabilities (Pc, Pμ, PL, q, qx, p) are closed-form functions of the protocol parameters k, h, μ, and n, and are not fitted to empirical data; they follow from the challenge-response structure of the stated ZKP. No load-bearing self-citation chain is used: the authors' own reference [8] appears only in related work, and the protocol relies on standard external primitives [30], [31]. I do not count the Section V/Figure 5 completeness problem and the unproved Section VIII polynomial ZKP countermeasure as circularity; those are soundness/completeness risks, not reductions of an output to an input. The only definitional element I identified is the α trade-off, which is peripheral to the core mutual-authentication and revocation claims, so the overall circularity score is low.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The paper introduces no new physical entity. Its only new abstract object is the polynomial-based proof construction in Section VIII, which is captured as an unproved axiom above.

free parameters (5)
  • alpha (privacy threshold) = 1, 2, 4, 5; simulation uses alpha=2,4,5
    User-selected threshold for number of RSU proofs the OBU must verify; central to the claimed privacy and resource trade-off, but not fitted to external data.
  • mu (number of ZKP proofs) = 5 to 10
    Number of parallel ZKP sessions in RSU-to-OBU authentication; used as reliability and latency trade-off knob in probability plots.
  • k (secrets per proof or member) = 5 to 15
    Number of secrets in each ZKP proof; chosen in security analysis to set impersonation probability.
  • n (pool size) = 15 to 50
    Number of group secrets; used in combinatorial probability estimates and simulations.
  • h (rounds per proof) = 4 to 8
    Iterations of the ZKP challenge-response loop; affects impersonation probability and communication cost.
assumptions (5)
  • domain assumption Quadratic residuosity and square-root extraction modulo a Blum integer m are computationally hard
    The ZKP anonymity relies on the difficulty of extracting square roots mod m to hide secrets Sx and Pry, as used in Sections V.A and VI.
  • domain assumption KDC, VRS, and RSUs do not collude during authentication
    Section V.A states 'We assume that authentication servers, RSUs and KDCs are not cooperating during the OBU-to-RSU authentication process'; if false, KDC can reveal the mapping from group secrets to vehicles.
  • domain assumption AES-128 and the PKI-based session key distribution are secure
    Section V.B uses AES128 and public-key certificates to encrypt proofs and distribute session keys; no analysis of these primitives is given.
  • domain assumption The pseudo-random function seeded with IV+counter generates unpredictable, collision-resistant sequences of secret ids
    Section V.D's revocation matching assumes uniqueness and unpredictability of the generated sequences; it cites [30] but does not instantiate or analyze it.
  • ad hoc to paper The polynomial-based ZKP in Section VIII is complete, sound, and zero-knowledge
    The countermeasure against simulator attacks defines a new proof format and immediately asserts security; no proof of these properties appears anywhere in the paper.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adaptive Group-based Zero Knowledge Proof-Authentication Protocol (AGZKP-AP) in Vehicular Ad Hoc Networks." pith.science (2026). https://pith.science/paper/6OTEHM4W

@misc{pith2026190809085,
  author       = {Pith},
  title        = {Pith review of: Adaptive Group-based Zero Knowledge Proof-Authentication Protocol (AGZKP-AP) in Vehicular Ad Hoc Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6OTEHM4W}},
  note         = {Machine review of arXiv:1908.09085}
}
read the original abstract

Vehicular Ad Hoc Networks (VANETs) are a particular subclass of mobile ad hoc networks that raise a number of security challenges, notably from the way users authenticate the network. Authentication technologies based on existing security policies and access control rules in such networks assume full trust on Roadside Unit (RSU) and authentication servers. The disclosure of authentication parameters enables user's trace-ability over the network. VANETs' trusted entities (e.g. RSU) can utilize such information to track a user traveling behavior, violating user privacy and anonymity. In this paper, we proposed a novel, light-weight, Adaptive Group-based Zero Knowledge Proof-Authentication Protocol (AGZKP-AP) for VANETs. The proposed authentication protocol is capable of offering various levels of users' privacy settings based on the type of services available on such networks. Our scheme is based on the Zero-Knowledge-Proof (ZKP) crypto approach with the support of trade-off options. Users have the option to make critical decisions on the level of privacy and the amount of resources usage they prefer such as short system response time versus the number of private information disclosures. Furthermore, AGZKP-AP is incorporated with a distributed privilege control and revoking mechanism that render user's private information to law enforcement in case of a traffic violation.

Figures

Figures reproduced from arXiv: 1908.09085 by the authors.

Figure 1
Figure 1. VANET infrastructure Profiling user’s activities [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. VANET with the proposed architecture Internet [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Key distribution and groups’ formation n randomly generated secrets k randomly chosen secrets [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: The proposed authentication protocol (AGZKP [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: AGZKP-AP algorithm C.1 Scenario: Two OBUs accessing VANET via RSUj To illustrate the visibility of the proposed protocol in terms of preserving the privacy of two OBUs trying to authenticate to the VANET via the same RSU. We consider the case of two OBUs, 𝑂𝐵𝑈𝐺1,𝑎 and 𝑂…
Figure 6
Figure 6. Figure 6: Privilege control and revoking mechanism [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 10
Figure 10. Figure 10: b, presents the resiliency of the proposed protocol with various µ ZKP proofs used for verification, as the value of µ increases from 5 ZKP proofs to 10 ZKP proofs, the probability of cheater decreases since it takes more effort for an attacker to correctly guess all …
Figure 11
Figure 11. Figure 11: The probability 𝑃𝜇 of an RSU cheater versus the number of assigned secrets per group The number of assigned secrets per group, n, and µ=5 (a) The number of assigned secrets per group, n, and µ=6 (b) The number of assigned secrets per group, n, and µ=8 (c) The number o…
Figure 13
Figure 13. Figure 13: The probability of false authentication, [PITH_FULL_IMAGE:figures/full_fig_p012_13.png]
Figure 14
Figure 14. Figure 14: Average communication delays and average packet loss ratio under various anonymity levels (α=2, α =4, and α =5) [PITH_FULL_IMAGE:figures/full_fig_p012_14.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

83 extracted references · 80 canonical work pages

  1. [1]

    The proposed protocol provides vehicles’ owners with the c apability of anonymous authentication over the network

    Authentication protocol . The proposed protocol provides vehicles’ owners with the c apability of anonymous authentication over the network. Trusted entities that are part of the VANET system will not be capable of tracking users’ acti vities based on the information they provided during the authentication process

  2. [2]

    As authorized OBUs try to acc ess the network, privilege revocation methods will be executed on RSU s to validate if these OBUs are allowed to access the network or not

    Distributed privilege control & revoking mechanism. As authorized OBUs try to acc ess the network, privilege revocation methods will be executed on RSU s to validate if these OBUs are allowed to access the network or not. Misbehaved OBUs that are detected and identified during the network’s access time will be broadcasted over the network via a distribute...

  3. [3]

    The proposed scheme is based on ZKP crypto with the support of trade-off options

    Privacy-preserving threshold defensive scheme . The proposed scheme is based on ZKP crypto with the support of trade-off options. Users have the option to make critical decisions on the level of privacy and the s ize of resource usage they prefer such as short system response time versus the amount of private information disclosed. Moreover, the scheme en...

  4. [4]

    The KDC will generate a pool of certificates and will act as the certification authority for the RSUs

    work page

  5. [5]

    A signed certificate will be distributed to each RSU

    work page

  6. [6]

    The signed public keys can be advertised by both the RSU and the KDC to which the RSU belongs at the moment

    RSUs transmit signed certificate as beacon signals to identify their presences over the network. The signed public keys can be advertised by both the RSU and the KDC to which the RSU belongs at the moment. Authentication process takes place between the RSUs and the OBUs, KDCs were employed only during the keys distribution Table 1: A list of notations use...

    work page

  7. [7]

    A set X of n secrets {𝑆1, 𝑆2,…, 𝑆𝑥,…, 𝑆𝑛} are randomly chosen from the finite field Zm

    work page

  8. [8]

    A subset of k secrets is randomly selected from set X and assigned to each group’s member of Gi, where k<<n

    work page

Show all 83 references
  1. [9]

    Compute Ix = ±𝑆𝑥 2(𝑚𝑜𝑑 𝑚),where 𝑥 ∈ {1, 2, … , 𝑛}

  2. [10]

    Publish I1, I2, … In over the group ’s members (OBUs) , keeping 𝑆1, 𝑆2,…, 𝑆𝑛 private to RSUs

  3. [11]

    The k secrets are preloaded into each OBU-group member

    Assigns a unique master secret 𝑆𝐺𝑖 which is composed of k secrets 𝑃𝑟1, 𝑃𝑟2, … , 𝑃𝑟𝑦, … , 𝑃𝑟𝑘, randomly chosen from the Finite field Zm. The k secrets are preloaded into each OBU-group member

  4. [12]

    Computes gy = ±𝑃𝑟𝑦 2(𝑚𝑜𝑑 𝑚), where 𝑦 ∈ {1, 2, … , 𝑘}

  5. [13]

    Publishes and distribute s g1, g2,…,gk to RSUs, keeping{𝑃𝑟1, 𝑃𝑟2,…, 𝑃𝑟𝑦,…, 𝑃𝑟𝑘} private to OBUs. Symbols Descriptions OBU Onboard Unit RSU Roadside Unit KDC Key Distribution Center q The total number of randomly generated OBU-groups Gi The OBU-group id, where 1 ≤ 𝑖 ≤ 𝑞 X Repre...

  6. [14]

    RSU announces its presence periodically with its digital public certificate

    RSUOBU: Cert (Pubs). RSU announces its presence periodically with its digital public certificate. OBURSU: Pubs (Gi, T1, Ksession, SERV -ID, α). OBU constructs a message with its group identifier Gi, current time T1, a session key Ksession, the requested service’s id SERV-ID,...

  7. [15]

    In order for a user to access a service on the network, both the requester and th e service provider must establish a mutual agreement on the level of privacy used

    Requests submitted by authorized users will be verified with the services providers to determine if a given request with a privacy parameter α is allowed through the network or not. In order for a user to access a service on the network, both the requester and th e service pro...

  8. [16]

    RSU and OBU initiate the Z KP protocol, OBU acts as a prov er and sends a proof of knowledge PF( 𝑆𝐺𝑖) generated at time T2

    OBU:PRSU:V. RSU and OBU initiate the Z KP protocol, OBU acts as a prov er and sends a proof of knowledge PF( 𝑆𝐺𝑖) generated at time T2. The proof is encrypted using the session key Ksession (T2, PF( 𝑆𝐺𝑖)). RSU will verify the OBU’s proof to achieve OBU -to- RSU authentication

  9. [17]

    OBU and RSU engage in µ ZKP sessions

    RSU:POBU:V. OBU and RSU engage in µ ZKP sessions. RSU submits µ encrypted proofs of knowledge (Ksession (PF(𝑡1)), Ksession (PF (𝑡2)),…, Ksession (PF (𝑡𝑖)),…, Ksession (PF (𝑡𝜇))), where each PF (𝑡𝑖) is computed by randomly choosing k secrets from the OBU-group-based secrets (𝑆...

  10. [18]

    Upon successful decryption and verification, it construct s a reply message with the value α

    OBU decrypts these µ RSU’s proofs and confirms anonymity. Upon successful decryption and verification, it construct s a reply message with the value α. In the proposed protocol, the value of the privacy parameter α is used to determine the minimum numbers of RSU’s proofs that ...

  11. [20]

    The prover (RSU) uses these secrets-ids to establish µ ZKP proofs as follows: do loop µ times (OBU tries to verify α ZKP proofs out of µ) do loop h times (execute for each ZKP proof)

  12. [21]

    A prover (RSU) picks a random number R, and sends W = ±𝑅2(𝑚𝑜𝑑 𝑚)

  13. [22]

    A verifier (OBU) sends a random binary string (b0, …, bk)

  14. [23]

    ∏ 𝑆𝑥 𝑏𝑥(𝑚𝑜𝑑 𝑚)𝑥=𝑘 𝑥=0 and sends it to the verifier

    The prover computes the value Y = 𝑅. ∏ 𝑆𝑥 𝑏𝑥(𝑚𝑜𝑑 𝑚)𝑥=𝑘 𝑥=0 and sends it to the verifier

  15. [24]

    ∏ 𝐼𝑥 𝑏𝑥(𝑚𝑜𝑑 𝑚)𝑥=𝑘 𝑥=0 Repeat Repeat

    The verifier receives Y and verifies that 𝑌2 = 𝑊. ∏ 𝐼𝑥 𝑏𝑥(𝑚𝑜𝑑 𝑚)𝑥=𝑘 𝑥=0 Repeat Repeat

  16. [25]

    To establish access to the network, this number must be at least equal to the privacy parameter α

    The verifier returns the number of ZKP proofs successfully verified. To establish access to the network, this number must be at least equal to the privacy parameter α. do loop h times

  17. [26]

    A prover (OBU) picks a random number R, and sends W = ±𝑅2(𝑚𝑜𝑑 𝑚)

  18. [27]

    A verifier (RSU) sends a random binary string (b0, …, bk)

  19. [28]

    ∏ 𝑃𝑟𝑦 𝑏𝑦(𝑚𝑜𝑑 𝑚)𝑦=𝑘 𝑦=0 and sends it to the verifier

    The prover computes the value Y = 𝑅. ∏ 𝑃𝑟𝑦 𝑏𝑦(𝑚𝑜𝑑 𝑚)𝑦=𝑘 𝑦=0 and sends it to the verifier

  20. [29]

    ∏ 𝑔𝑦 𝑏𝑦(𝑚𝑜𝑑 𝑚)𝑦=𝑘 𝑦=0 Repeat OBU:PRSU:V RSU:POBU:V * * Steps 1 and 2 are only executed once during the authentication process

    The verifier receives Y and verifies that 𝑌2 = 𝑊. ∏ 𝑔𝑦 𝑏𝑦(𝑚𝑜𝑑 𝑚)𝑦=𝑘 𝑦=0 Repeat OBU:PRSU:V RSU:POBU:V * * Steps 1 and 2 are only executed once during the authentication process. * 8 keys, 𝑆𝐺1and 𝑆𝐺2 are stored in every RSU conn ected to the network including RSUj. The followi...

  21. [30]

    The discovery of RSUj by OBUs using the PKI approach  OBUG1,a , transmits a message encrypted with RSU j public key. The encrypted message com prised of a timestamp, a randomly generated session key K1, the group’s id, G 1, the requested service’s id SERV -ID, and a user-sele...

  22. [31]

     𝑂𝐵𝑈𝐺2,𝑏constructs a proof of knowledge K2(Time stamp, PF( 𝑆𝐺2)) encrypted with key, K2 and send s it to RSUj

    OBUG1,a and OBUG2,bin this step act as proofer s and RSUj acts as a verifier  𝑂𝐵𝑈𝐺1,𝑎constructs a proof of knowled ge K1(Timestamp, PF( 𝑆𝐺1)) encrypted with key, K1 and sends it to RSUj.  𝑂𝐵𝑈𝐺2,𝑏constructs a proof of knowledge K2(Time stamp, PF( 𝑆𝐺2)) encrypted with key, K2 ...

  23. [32]

    RSU j sends the encrypted proofs to 𝑂𝐵𝑈𝐺1,𝑎

    RSUj acts as a proofer, and OBUG1,a,OBUG2,bact as verifiers  RSUj constructs µ encrypted proofs of knowledge (K1 (PF(𝑡1)), K1 (PF (𝑡2)),…, K1 (PF (𝑡𝜇))). RSU j sends the encrypted proofs to 𝑂𝐵𝑈𝐺1,𝑎. Proofs are computed by randomly choosing k secrets from the OBU-group- based ...

  24. [33]

    A prover (RSU) picks a random number R, and sends W= ±𝑅2(𝑚𝑜𝑑 𝑚)

  25. [34]

    The verifier (OBU) and the proofer securely construct the shared polynomial F(x) independently using a secure cryptographic hash function

  26. [35]

    The verifier (OBU) sends a random binary string ( b0, …, bk)

  27. [36]

    𝑔(𝑥))𝑚𝑜𝑑 𝑚 and sends it to the verifier

    The prover computes the following values: 𝑔(𝑥) = ∏ ∑ 𝑎𝑘 𝑘−1 𝑘=0 𝑆𝑖 2𝑘∙𝑏𝑘 𝑘 𝑖=1 Y = (𝑅2. 𝑔(𝑥))𝑚𝑜𝑑 𝑚 and sends it to the verifier

  28. [37]

    𝑌′ = 𝑊, where 𝑌′ = (1/ ∏ ∑ 𝑎𝑘 𝑘−1 𝑘=0 𝐼𝑖 𝑘∙𝑏𝑘𝑘 𝑖=1 ) 𝑚𝑜𝑑 𝑚

    The verifier receives Y and verifies that 𝑌. 𝑌′ = 𝑊, where 𝑌′ = (1/ ∏ ∑ 𝑎𝑘 𝑘−1 𝑘=0 𝐼𝑖 𝑘∙𝑏𝑘𝑘 𝑖=1 ) 𝑚𝑜𝑑 𝑚

  29. [38]

    Steps 1 through 5 are repeated h times. IX. PERFORMANCE RESULTS OF AGZKP-AP We evaluate the resiliency of the proposed protocol against an RSU cheater. As illustrated in section VI, an RSU cheater needs to guess a random binary string with a probability 2−𝑘 per iteration, prep...

  30. [39]

    A verifier (OBU) randomly picks µ sets of 𝑘 −secrets-ids, and shares them with the prover, where 0 ≤ secret-id ≤ n

  31. [40]

    do loop µ times (For each spoofed ZKP proof, pick a simulator ) do loop h times (execute a simulation for each spoofed ZKP proof)

    The prover (Attacker) uses these secrets-ids to identify the correct µ ZKP simulators for execution. do loop µ times (For each spoofed ZKP proof, pick a simulator ) do loop h times (execute a simulation for each spoofed ZKP proof)

  32. [41]

    The attacker picks a value 𝑊𝑅𝑖 from the W-matrix, and sends it to the verifier

  33. [42]

    A verifier (OBU) sends a random binary string S (s0, …, sk)

  34. [43]

    The attacker picks a value 𝑌𝑠,𝑅𝑖 from the Y-Matrix and sends it to the verifier

  35. [44]

    ∏ 𝐼𝑖 𝑠𝑖(𝑚𝑜𝑑 𝑚)𝑖=𝑘 𝑖=0 Repeat Repeat

    The verifier receives 𝑌𝑠,𝑅𝑖 and verifies that (𝑌𝑠,𝑅𝑖) 2 = 𝑊𝑅𝑖. ∏ 𝐼𝑖 𝑠𝑖(𝑚𝑜𝑑 𝑚)𝑖=𝑘 𝑖=0 Repeat Repeat

  36. [45]

    To establish access to the network, this number must be at least equal to the privacy parameter α

    The verifier returns the number of ZKP proofs successfully verified. To establish access to the network, this number must be at least equal to the privacy parameter α. Attacker: POBU:V * Steps 1 and 2 are only executed once during the authentication. 𝑌1,𝑅1 𝑌1,𝑅2 𝑌1,𝑅3 …𝑌1,𝑅𝑖 ...

  37. [46]

    Yousefi, et al., Vehicular ad hoc networks (VANETs): challenges and perspectives, in: ITS Telecommunications Proceedings, 2006 6th International Conference on, 2006, pp

    S. Yousefi, et al., Vehicular ad hoc networks (VANETs): challenges and perspectives, in: ITS Telecommunications Proceedings, 2006 6th International Conference on, 2006, pp. 761–766

    2006

  38. [47]

    Towards a Security Architecture for Vehicular Ad Hoc Networks,

    K. Plo¨ ßl, T. Nowey, and C. Mletzko, “Towards a Security Architecture for Vehicular Ad Hoc Networks,” Proc. First Int’l Conf. Availability, Reliability and Security (ARES ’06), Apr. 2006

    2006

  39. [48]

    Challenges in Securing Vehicular Networks,

    B. Parno and A. Perrig, “Challenges in Securing Vehicular Networks,” Proc. Fourth Workshop Hot Topics in Networks (IV), Nov. 2005

    2005

  40. [49]

    Securing Vehicular Ad Hoc Networks,

    M. Raya and J -P. Hubaux, “Securing Vehicular Ad Hoc Networks,” J. Computer Security, special issue on security of ad hoc and sensor networks, vol. 15, no. 1, pp. 39-68, 2007

    2007

  41. [50]

    Balancing Auditability and Privacy in Vehicular Networks,

    J.Y. Choi, M. Jakobsson, and S. Wetzel, “Balancing Auditability and Privacy in Vehicular Networks,” Proc. First ACM Int’l Workshop QoS and Security for Wireless and Mobile Networks (Q2SWinet ’05), pp. 79- 87, Oct. 2005

    2005

  42. [51]

    Improved Security in Geographic Ad Hoc Routing through Autonomous Position Verification,

    T. Leinmu¨ ller, C. Maiho¨ fer, E. Schoch, and F. Kargl, “Improved Security in Geographic Ad Hoc Routing through Autonomous Position Verification,” Proc. Third ACM Int’l Workshop Vehicular Ad Hoc Networks (VANET ’06), Sept. 2006

    2006

  43. [52]

    Security Issues in a Future Vehicular Network,

    M.E. Zarki, S. Mehrotra, G. Tsudik, and N. Venkatasubramanian, “Security Issues in a Future Vehicular Network,” Proc. European Wireless Conf. ’02, Feb. 2002

    2002

  44. [53]

    The Three -Tier Security Scheme in Wireless Sensor Networks with Mobile Sinks,

    Amar Rasheed and Rabi Mahapatra, "The Three -Tier Security Scheme in Wireless Sensor Networks with Mobile Sinks, "IEEE Transaction on Parallel and Distributed Systems (TPDS), May 2012, Volume, 23,Issue 5, Page(s):958-965

    2012

  45. [54]

    Sun, et al., Secure vehicular communications based on group signature and ID -based signature scheme, in: Communications, 2007

    X. Sun, et al., Secure vehicular communications based on group signature and ID -based signature scheme, in: Communications, 2007. ICC’07. IEEE International Conference on, 2007, pp.1539–1545

    2007

  46. [55]

    Golle, et al., Detecting and correcting malicious data in VANETs, in: Proceedings of the 1st ACM international workshop on Vehicular ad hoc networks, 2004, pp

    P. Golle, et al., Detecting and correcting malicious data in VANETs, in: Proceedings of the 1st ACM international workshop on Vehicular ad hoc networks, 2004, pp. 29–37

    2004

  47. [56]

    Kyasanur, N.H

    P. Kyasanur, N.H. Vaidya, Detection and Handling of MAC Layer Misbehavior in Wireless Networks, in: DSN, 2003, pp. 173–182

    2003

  48. [57]

    Biswas, M.L

    K. Biswas, M.L. Ali, Security threats in mobile Ad Hoc Network, Department of Interaction and System Design School of Engineering, march 2007, pp. 9–26

    2007

  49. [58]

    Wu, et al., A survey of attacks and countermeasures in mobile ad hoc networks, in: Wireless Network Security, Springer, 2007, pp

    B. Wu, et al., A survey of attacks and countermeasures in mobile ad hoc networks, in: Wireless Network Security, Springer, 2007, pp. 103–135. 14

    2007

  50. [59]

    Review of solutions for securing the vehicular networks,

    U. Singh and P. Singh, “Review of solutions for securing the vehicular networks,” International Journal for Computer Technology Application, vol. 2, pp. 1652–1656, 2011

    2011

  51. [60]

    Raise: An efficient rsu -aided message authentication scheme in vehicular communication networks,

    C. Zhang, X. Lin, R. Lu, and P. -H. Ho, “Raise: An efficient rsu -aided message authentication scheme in vehicular communication networks,” in ICC. Proceedings of IEEE International Conference on Communications, ICC 2008, Beijing, China, 19-23 May 2008, 2008, pp. 1451–1457

    2008

  52. [61]

    The threat of intelligent collisions,

    J. Blum and A. Eskandarian, “The threat of intelligent collisions,” IT Professional 6(1) (2004), 2429., vol. 6, pp. 24–29, 2004

    2004

  53. [62]

    Eviction of Misbehaving and Faulty Nodes in Vehicular Networks,

    M. Raya, P. Papadimitratos, I. Aad, D. Jungels, and J. -P. Hubaux, “Eviction of Misbehaving and Faulty Nodes in Vehicular Networks,” IEEE J. Selected Areas Comm., vol. 25, no. 8, pp. 1557-1568, Oct. 2007

    2007

  54. [63]

    An Identity - Based Ring Signature Scheme with Enhanced Privacy,

    C. Gamage, B. Gras, B. Crispo, and A.S. Tanenbaum, “An Identity - Based Ring Signature Scheme with Enhanced Privacy,” Proc. Second Int’l Conf. Security and Privacy in Comm. Networks (SecureComm ’06), Aug. 2006

    2006

  55. [64]

    GSIS: A Secure and Privacy - Preserving Protocol for Vehicular Communications,

    X. Lin, X. Sun, P. -H. Ho, and X. Shen, “GSIS: A Secure and Privacy - Preserving Protocol for Vehicular Communications,” IEEE Trans. Vehicular Technology, vol. 56, no. 6, pp. 3442-3456, Nov. 2007

    2007

  56. [65]

    ECPP: Effici ent Conditional Privacy Preservation Protocol for Secure Vehicular Communications,

    R. Lu, X. Lin, H. Zhu, P. -H. Ho, and X. Shen, “ECPP: Effici ent Conditional Privacy Preservation Protocol for Secure Vehicular Communications,” Proc. IEEE INFOCOM, Apr. 2008

    2008

  57. [66]

    TACKing Together Efficient Authentication, Revocation, and Privacy in VANETs,

    A. Studer, E. Shi, F. Bai, and A. Perrig, “TACKing Together Efficient Authentication, Revocation, and Privacy in VANETs,” Proc. Sixth Ann. IEEE SECON Conf. (SECON ’09), 2009

    2009

  58. [67]

    Caravan: Providing Location Privacy for Vanet,

    K. Sampigethaya, L. Huang, M. Li, R. Poovendran, K. Matsuura, and K. Sezaki, “Caravan: Providing Location Privacy for Vanet,” Proc. Embedded Security in Cars (ESCAR), 2005

    2005

  59. [68]

    An Identity -Based Security Framework for VANETs,

    P. Kamat, A. Baliga, and W. Trappe, “An Identity -Based Security Framework for VANETs,” Proc. Third ACM Int’l Workshop Vehicular Ad Hoc Networks (VANET ’06), pp. 94-95, Sept. 2006

    2006

  60. [69]

    Secure, Pseudonymous, and Auditable Communication in Vehicular Ad Hoc Networks,

    P. Kamat, A. Baliga, and W. Trappe, “Secure, Pseudonymous, and Auditable Communication in Vehicular Ad Hoc Networks,” J. Security and Comm. Networks, vol. 1, no. 3, pp. 233-244, June 2008

    2008

  61. [70]

    An Id -Based Framework Achieving Privacy and Non -Repudiation in Vehicular Ad Hoc Networks,

    J. Sun, C. Zhang, and Y. Fang, “An Id -Based Framework Achieving Privacy and Non -Repudiation in Vehicular Ad Hoc Networks,” Proc. IEEE Military Comm. Conf., pp. 1-7, Oct. 2007

    2007

  62. [71]

    Defense Against Misbehavior in Anonymous Vehicular Ad Hoc Networks,

    J. Sun and Y. Fang, “Defense Against Misbehavior in Anonymous Vehicular Ad Hoc Networks,” Ad Hoc Networks, vol. 7, no. 8, pp. 1515- 1525, Nov. 2009

    2009

  63. [72]

    Efficient and R obust Pseudonymous Authentication in VANET,

    G. Calandriello, P. Papadimitratos, J.-P. Hubaux, and A. Lioy, “Efficient and R obust Pseudonymous Authentication in VANET,”Proc. Fourth ACM Int’l Workshop Vehicular Ad Hoc Networks (VANET ’07), pp. 19-28, 2007

    2007

  64. [73]

    An Efficient Identity- Based Batch Verification Scheme for Vehicular Sensor Networks,

    C. Zhang, R. Lu, X. Lin, P.-H. Ho, and X. Shen, “An Efficient Identity- Based Batch Verification Scheme for Vehicular Sensor Networks,” Proc. IEEE INFOCOM, pp. 816-824, Apr. 2008

    2008

  65. [74]

    Blacklistable Anonymous Credentials: Blocking Misbehaving Users without TTPs,

    P. Tsang, M.H. Au, A. Kapadia, and S.W. Smith, “Blacklistable Anonymous Credentials: Blocking Misbehaving Users without TTPs,” Proc. ACM Conf. Computer and Comm. Security, pp. 72-81, 2007

    2007

  66. [75]

    Efficient Oblivious Pseudorandom Function with Applications to Adaptive OT and Secure Computation of Set Intersection,

    Stanislaw Jarecki, Xiaomin Liu, "Efficient Oblivious Pseudorandom Function with Applications to Adaptive OT and Secure Computation of Set Intersection," Proceeding TCC'09 of the 6th Theory of Cryptography Conference on Theory of Cryptography

  67. [76]

    How To Prove Yourself: Practical Solutions To Identification and Signature Problems

    Fiat, A. and A. Shamir, "How To Prove Yourself: Practical Solutions To Identification and Signature Problems" Proceeding of CRYPTO 1986

    1986

  68. [77]

    EAAP:Efficient Anonymous Authentication With Conditional Privacy- Preserving Scheme for Vehicular Ad Hoc Networks

    Maria Azees, Pandi Vijayakumar, Lazarus Jegatha Deboarth, "EAAP:Efficient Anonymous Authentication With Conditional Privacy- Preserving Scheme for Vehicular Ad Hoc Networks", IEEE Transaction on Intelligent Transportation Systems (T-ITS), Vol:18, no. 9, Sept. 2017

    2017

  69. [78]

    Computationally efficient privacy preserving anonymous mutual and batch authentication schemes for vehicular ad hoc networks

    P. Vijayakumar, Victor Chang, L. Jegatha Deboarth, Balamurugan Balusamy P.G. Shynu, "Computationally efficient privacy preserving anonymous mutual and batch authentication schemes for vehicular ad hoc networks", Elsevier: Future Generation Computer Systems, Volume 78, Part 3, ...

    2018

  70. [79]

    A robust and efficient password-based conditional privacy -preserving authentication and group -key agreement protocol for VANETs

    Sk Hafizul Islam, Mohammad S. Obaidat, Pandi Vijayakummar, Enas Abdulhay, Fagen Li, M. Krishna Chaitanya a Reddy, "A robust and efficient password-based conditional privacy -preserving authentication and group -key agreement protocol for VANETs", Elsevier: Future Generation Co...

    2018

  71. [80]

    CPAV: Computationally efficient privacy preserving anonymous authentication scheme for vehicular ad hoc networks

    P. Vijayakumar, M. Azees, L. J. Deborah, "CPAV: Computationally efficient privacy preserving anonymous authentication scheme for vehicular ad hoc networks", Proc. 2nd IEEE Int. Conf. Cyber Secur. Cloud Comput. (CSCloud), pp. 62-67, Nov. 2015

    2015

  72. [81]

    PACP: An efficient pseudonymous authentication -based conditional privacy protocol for VANETs

    D. Huang, S. Misra, M. Verma, G. Xue, "PACP: An efficient pseudonymous authentication -based conditional privacy protocol for VANETs", IEEE Trans. Intell. Transp. Syst., vol. 12, no. 3, pp. 736-746, Sep. 2011

    2011

  73. [82]

    A threshold anonymous authentication protocol for VANETs

    J. Shao, X. Lin, R. Lu, C. Zuo, "A threshold anonymous authentication protocol for VANETs", IEEE Trans. Veh. Technol., vol. 65, no. 3, pp. 1711-1720, Mar. 2016

    2016

  74. [83]

    An efficient identity -based conditional privacy-preserving authentication scheme for vehicular ad hoc networks

    D. He, S. Zeadally, B. Xu, X. Huang, "An efficient identity -based conditional privacy-preserving authentication scheme for vehicular ad hoc networks", IEEE Trans. Inf. Forensics Security, vol. 10, no. 12, pp. 2681-2691, Dec. 2015

    2015

  75. [84]

    Secure Message Communication Protocol Among Vehicles in Smart City

    Amit Dua, Neeraj Kumar, Ashok Kumar Das, Willy Susilo, "Secure Message Communication Protocol Among Vehicles in Smart City", Vehicular Technology IEEE Transactions on, vol. 67, no. 5, pp. 4359 - 4373, 2018. Dr. Amar Rasheed is an Assistant Professor in the Department of Comput...

    2018

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.