A Security Analysis of "A Privacy-Preserving Three-Factor Authentication System for IoT-Enabled Wireless Sensor Networks"

Wireless sensor network (WSN) is a main component of the internet of things (IoT) technology, it can be predicted to apply in various areas including smart city, smart home, healthcare, vehicular network, and so on. However, in WSN environments, sensors and data users communicate wirelessly and it can be prone to malicious attacks such as forgery, impersonation, denial-of-service. Therefore, many researchers have proposed to establish a session key securely in WSN environments. In 2024, Thakur et al. designed a three-factor based authentication protocol for IoT-enabled WSNs. They indicated that Sahoo et al.'s protocol has weaknesses, and therefore, they suggested an enhanced scheme that resolved the previous security weaknesses. Nevertheless, we reviewed Thakur et al.'s scheme and we analyze that their scheme fails to support mutual authentication and does not provide perfert forward secrecy. Furthermore, their scheme is also prone to DoS attack because of lack of mutual authentication. We provide a detailed analysis of Thakur et al.'s scheme and propose countermeasures to address them.