Security Analysis and Designing Advanced Two-Party Lattice-Based Authenticated Key Establishment and Key Transport Protocols for Mobile Communication

Abstract

In this paper, we have proposed a two-party authenticated key establishment (AKE), and authenticated key transport protocols based on lattice-based cryptography, aiming to provide security against quantum attacks for secure communication. This protocol enables two parties, who may share long-term public keys, to securely establish a shared session key, and transportation of the session key from the server while achieving mutual authentication. Our construction leverages the hardness of lattice problems Ring Learning With Errors (Ring-LWE), ensuring robustness against quantum and classical adversaries. Unlike traditional schemes whose security depends upon number-theoretic assumptions being vulnerable to quantum attacks, our protocol ensures security in the post-quantum era. The proposed protocol ensures forward secrecy, and provides security even if the long-term key is compromised. This protocol also provides essential property key freshness and resistance against man-in-the-middle attacks, impersonation attacks, replay attacks, and key mismatch attacks. On the other hand, the proposed key transport protocol provides essential property key freshness, anonymity, and resistance against man-in-the-middle attacks, impersonation attacks, replay attacks, and key mismatch attacks. A two-party key transport protocol is a cryptographic protocol in which one party (typically a trusted key distribution center or sender) securely generates and sends a session key to another party. Unlike key exchange protocols (where both parties contribute to key generation), key transport protocols rely on one party to generate the key and deliver it securely. The protocol possesses a minimum number of exchanged messages and can reduce the number of communication rounds to help minimize the communication overhead.

1. Introduction

In the rapidly evolving landscape of mobile communications, ensuring both secure key exchange and user anonymity has become increasingly critical. Traditional cryptographic primitives, largely based on number-theoretic assumptions such as RSA or ECC, are vulnerable to quantum adversaries due to the development of quantum algorithms like Shor’s algorithm [1]. This emerging threat necessitates the exploration of post-quantum secure cryptographic schemes. Among the promising candidates, lattice-based cryptography, especially based on the hardness of problems like Ring Learning with Errors (RLWE), has gained significant attention for its strong security guarantees and computational efficiency. RLWE is an extension of the LWE problem [2], which is widely used as the basis for many cryptographic primitives in lattice-based cryptography. In the Ring-LWE problem [3], the underlying structure is a polynomial ring rather than a Euclidean lattice. The problem involves deducing the coefficients of a random polynomial having small coefficients when given noisy evaluations of the polynomial at various points in the ring.

This paper presents a novel two-party authenticated key establishment protocol that leverages ideal-lattice constructions to ensure post-quantum security while simultaneously preserving user anonymity, a critical requirement in privacy-sensitive mobile communication environments. Our protocol ensures mutual authentication between communicating parties and derives a shared session key resistant to quantum and classical attacks. Furthermore, the protocol incorporates lightweight mechanisms to provide identity concealment, making it suitable for deployment in resource-constrained mobile devices. We provide a detailed formal security analysis [4] of the proposed protocol under the standard security model and demonstrate that it satisfies crucial security properties including resistance against man-in-the-middle, impersonation, and key compromise impersonation attacks. In addition, we prove the correctness and performance efficiency of the protocol through both theoretical and experimental evaluations. Our work contributes to the growing body of post-quantum secure mobile communication protocols by offering a practical and secure solution that meets the dual requirements of authenticated key exchange and anonymous communication, paving the way for future mobile systems resilient to quantum-era threats.

2. Related Work

Authenticated Key Exchange (AKE) and transport protocols are cryptographic protocols that allow two parties to establish a session key over a public channel, while ensuring mutual authentication in the presence of active adversaries. In the era of quantum computers, traditional AKE protocols, whose security relies upon RSA, ECC, or discrete logarithms, are no longer considered secure. Ideal lattice-based assumptions such as Learning With Errors (LWE), and its advanced version Ring Learning With Errors (Ring-LWE) provide a promising foundation for post-quantum AKE protocols, offering both efficiency and security against quantum computers. Using these assumptions, several novel key exchange techniques (KETs) have been put forward, see [5,6,7,8,9,10,11,12,13,14,15,16,17,18,19]. Furthermore, these techniques are broadly classified into two categories (

Table 1. Comparison of lattice-based key transport and key agreement protocols.

Aspect	Key Transport Protocols	Key Agreement Protocols
Interaction	One-way (non-interactive)	Two-way (interactive)
Key Generation	Performed by one party	Jointly derived by both
Forward Secrecy	Not automatic	Naturally supported
Efficiency	Often more compact and faster	Slightly higher overhead
Authentication	Needs explicit digital signatures	Can support implicit/explicit
Lattice Basis	LWE/Module-LWE + KEM	Ring-LWE + reconciliation
Example	Kyber, FrodoKEM	NewHope, BCNS, Lizard

):

• A key transport protocol is a mechanism in which the sender generates a secret session key and securely transfers it to the receiver using a public key encryption scheme or a Key Encapsulation Mechanism (KEM).
• A key agreement protocol enables both the sender and receiver to actively contribute to the generation of a shared session key, typically through an interactive message exchange.

The first ideal lattice-based key exchange protocol using the reconciliation technique was proposed by Ding et al. [5]. In 2015 Zhang et al. proposed a method [20] that avoids reliance on additional cryptographic primitives, particularly digital signatures, which helps to streamline the protocol and allows the security to be grounded directly in the hardness of the Ring Learning With Errors (Ring-LWE) problem. The security is formally established within the Bellare–Rogaway model, offering weak perfect forward secrecy under the random oracle assumption. In 2016, Fluhrer et al. [21] demonstrated that several Ring-LWE-based key exchange protocols can be compromised when the same key share is reused across multiple sessions. The findings highlight the critical need for generating fresh key shares for each individual exchange to maintain security. However, this attack strategy proves to be ineffective against several other key agreement protocols that utilize the least significant bits (LSBs) of intermediate shared secrets to derive the final session keys between the two communicating parties. By extracting keys from LSBs, these protocols inherently introduce a non-linearity that reduces the exploitable structure available to adversaries, thereby enhancing resistance to key recovery and mismatch-based attacks. For example, this attacking strategy would not work on the scheme proposed by Ding et al. [6]. They designed a new attacking technique on Ring-LWE-based key exchange protocols using reconciliation approaches, and they named it the signal leakage attack (SLA). In an SLA, an adversary can exploit the reuse of key pairs to compromise the security of the cryptographic scheme. Reusing private or public keys across multiple sessions introduces correlation in computations, which can be leveraged through leakage analysis to recover secret information, thereby undermining the protocol’s confidentiality guarantees. Feng et al. [7] proposed an ideal lattice-based anonymous authentication protocol for a mobile client–server communication system. A comprehensive security proof illustrates that the protocol is provably secure in the random oracle model, relying on the hardness of the Ring Learning With Errors (Ring-LWE) assumption. However, the Feng et al. scheme [7] was found to be susceptible to various attacks like spoofing, manipulation, and anonymity violation. In 2020, Dharminder et al. [8] introduced a new Ring-LWE-based quantum-safe key agreement protocol. They also carried out implementation in Lattice crypto, MIRACL lib, and proved its security in the ROM model. In the year 2020, Dabra et al. proposed a new scheme [9] which is anonymous, and they claimed it to be secure against signal leakage attacks. In the scheme in [9], Chaudhary et al. [22] identified that instead of engaging the master key $pw$, a user server utilizes a pseudo identity $psi{d}_i$ and pseudo secret $s^{*}$, and adds $\{psi{d}_i,s^{*},pw\}$ into the repository. This is problematic as any dishonest party $\mathfrak{D}$ can easily create a session key for any user once the party gets access to the repository [22]. In the year 2020, Islam et al. proposed a protocol [23] based on CBi-ISIS that is short integer solution assumption secure against quantum attacks. In 2020, Rana et al. proposed a scheme [24] to mitigate the security vulnerabilities introduced by Shor’s algorithm. They proposed a lattice-based key agreement protocol based on the Ring Learning With Errors (RLWE) assumption. However, their scheme [24] suffers key mismatch and some mathematical errors while establishing the session key. In 2022, Akleylek et al. proposed a protocol [25] based on short integer solution assumption, and this scheme supports tag, server, reader, and informal security analysis. In the year 2021, Wang et al. proposed a protocol [26], and they took an initial step toward addressing this challenge by presenting Quantum2FA—a practical, quantum-resistant, smart card-based password authentication scheme. The design integrates Alkim et al.’s lattice-based key exchange protocol [27] with Wang and Wang’s “fuzzy-verifier plus honeywords” technique [28]. Quantum2FA effectively mitigates the recently discovered key reuse attacks (ACISP 2018; CT-RSA 2019) targeting lattice-based key exchange protocols, specifically by addressing two major threats: signal leakage attacks and key mismatch attacks. Although this protocol needs the exchange of only three messages to establish a session key, it suffers from computation cost overhead. In 2020, Islam et al. [10] proposed a two-party quantum-safe authenticated key agreement protocol, and proved their protocol is provably secure. In 2023, Kumar et al. [12] studied many protocols [5,6,7,8,9,12,13], and they found these protocols are susceptible to signal leakage attacks due to their reuse of the long-term key. In the year 2023, Mishra et al. [29] proposed a quantum enhanced authentication and key agreement protocol for autonomous vehicles, but this protocol does not support unlinkability. In this scheme, the vehicle user sends the message $<PI{D}_i,x_i,{\Sigma }_i>$ which contains non-repeating $PI{D}_i$, and it helps to link older messages with the new coming message. In the same yearg, Moony et al. [13] introduced a post-quantum two-party authentication protocol for mobile devices. This protocol lacks key control, as the user is able to compute the session key independently, without any direct involvement or contribution from the server. Moreover, the overall security of the protocol heavily relies on password-based authentication, yet it fails to incorporate robust countermeasures against offline password guessing attacks, leaving it vulnerable to brute-force exploitation. Recently, Pursharthi et al. [15] proposed a quantum-safe authenticated key agreement scheme for mobile devices, but their protocol does not provide unlinkability. One can observe that user $U_i$ sends information $\{PI{D}_i,x_i,T_i,{\sum }_i\}$ to the server over a public channel. In the message $\{PI{D}_i,x_i,T_i,{\sum }_i\}$, the value $PI{D}_i$ is chosen by the server, and it is a fixed value for each of the sessions; therefore, this protocol cannot provide unlinkability. Moreover, this protocol uses learning with error multiple times on the same component $k_j=(x_i.s_j+2c)d+2e^{\prime }$ that will increase the error added from the Gaussian; therefore, this is mathematically incorrect. These findings underscore the urgent need for carefully designed lattice-based protocols that offer strong security properties such as unlinkability, key control, and resilience against side-channel and guessing attacks, while maintaining correctness and efficiency under practical constraints.

3. Authenticated Key Establishment and Key Transport Protocols

In modern cryptographic systems, establishing a secure communication channel is foundational to ensuring the confidentiality, integrity, and authenticity of exchanged information. Two primary classes of cryptographic protocols—Authenticated Key Establishment (AKE) and key transport protocols—address this need by enabling entities to securely agree on or distribute cryptographic keys.

3.1. Authenticated Key Establishment

Authenticated Key Establishment (AKE) protocols enable two or more parties to mutually derive a shared secret key over an insecure channel, ensuring that the key is known only to the legitimate participants. Unlike unauthenticated key exchange mechanisms that are susceptible to man-in-the-middle (MitM) attacks, AKE protocols incorporate authentication mechanisms such as digital signatures, certificates, or message authentication codes (MACs) to confirm the identity of communicating parties. These protocols are widely used in internet security protocols such as TLS, IPsec, and SSH, and are especially important in scenarios requiring forward secrecy, where the compromising of long-term keys does not affect past session keys.

With the advent of quantum computing, classical AKE protocols based on discrete logarithms and elliptic curves are being reconsidered in favor of post-quantum AKE schemes, particularly those based on lattice problems, code-based, or hash-based cryptography.

3.2. Key Transport Protocols

In contrast, key transport protocols involve a single party generating and securely transmitting a key to another party. This model is often simpler and more efficient than key agreement protocols but typically lacks forward secrecy. Key transport mechanisms usually rely on asymmetric encryption: a session key is generated by the sender and encrypted with the recipient’s public key. Upon receiving, the recipient uses their private key to decrypt the session key. Such protocols are widely used in email encryption (e.g., S/MIME), digital envelopes, and centralized systems like Kerberos, where a trusted authority distributes session keys.

3.3. Importance and Applications

Both AKE and key transport protocols serve as the backbone of secure communication protocols, enabling encrypted messaging, secure file transfer, protected authentication, and more. Choosing between them depends on the security requirements of the application—whether mutual contribution to the key and forward secrecy are critical, or centralized distribution suffices.

In the evolving landscape of cybersecurity, designing efficient, scalable, and quantum-resistant key establishment and transport mechanisms remains a significant research challenge, particularly for applications such as Internet of Things (IoT), vehicular networks, mobile communication, and cloud services.

4. Motivation and Contribution

With the increasing reliance on digital communication across domains such as finance, healthcare, critical infrastructure, and defense, secure and authenticated key establishment has become a cornerstone of modern cryptographic systems. Traditional public key primitives like RSA, Diffie–Hellman, and Elliptic Curve Cryptography (ECC), while widely used, are vulnerable to quantum algorithms such as Shor’s algorithm, which threatens to break their underlying hardness assumptions. This looming threat has spurred significant interest in post-quantum cryptography, with lattice-based cryptography emerging as one of the most promising alternatives. Lattice-based cryptography offers quantum-resistant alternatives, providing security even in the presence of powerful quantum adversaries. There are many advantage of the proposed protocol compared with existing protocols.

• An authenticated key transport protocol is a cryptographic mechanism that securely delivers a secret key from a sender to a receiver over an insecure channel while ensuring the authenticity of both the key and the communicating parties. The proposed authenticated key transport protocol (see Section 7.4) is an anonymous two-party lattice-based key protocol that enables two parties to communicate without revealing their identities to the adversary.
• These protocols ensure that forward secrecy enables two parties to establish a secret key securely while ensuring that compromise of long-term secret keys does not compromise the confidentiality of past communication. Even if an attacker gains access to a party’s long-term secret key (e.g., a private signing or decryption key), they cannot retroactively decrypt previously recorded communications or derive previously established session keys.
• To ensure real-world security of post-quantum communication protocols, especially on untrusted platforms, resisting signal leakage attacks is as essential as mathematical soundness. This protocol resists well-known signal leakage attacks, and is efficient in both communication and computation overheads.

5. Preliminaries

Preliminaries and notations (see

Table 2. Symbols’/Notations’ descriptions.

Symbols/Notations	Descriptions
$R={\displaystyle \frac{\mathbb{Z}}{<f\left(x\right)>}}$	Finite Degree Ring
$R_q={\displaystyle \frac{{\mathbb{Z}}_q}{<f\left(x\right)>}}$	Finite Ring
$B\in {\mathbb{Z}}^{M\times M}$	Square Matrix of Order M
$Cha(.)$	Characteristic Function
$Mo{d}_2(.,.)$	Modular Function
${\left|\right|.\left|\right|}_2$	Euclidean Norm
$U_i$	$ith$ User
$S_j$	$jth$ Server
$q_{H_1},q_{H_2}$	Oracle Queries
$\mathcal{A}$	Adversary
$ROM$	Random Oracle Model
q	Prime Number
${\mathcal{D}}_{\beta }^n$	n-Dimension Gaussian
$sk$	Session Key

) for lattice-based key exchange protocols provide the foundational elements and symbols necessary for understanding, analyzing, and implementing these cryptographic protocols. The function f(x) can also be defined as cyclotomic polynomial $x^n+1$. Let us take a finite ring $R={\displaystyle \frac{\mathbb{Z}\left[x\right]}{<f\left(x\right)>}}$, and the finite ring $R_q={\displaystyle \frac{{\mathbb{Z}}_q\left[x\right]}{<f\left(x\right)>}}$ with integer coefficients. Here $R_q$ is interpretable as a polynomial ring over ${\mathbb{Z}}_q$, where $a=a_0+a_1.x+\dots +a_{n-1}.x^{n-1}$. L₂ and $L_{\infty }$ standard can also be described as $\Vert a\Vert =\sqrt{a_0^2+a_1^2+\dots +a_{n-1}^2}$ and ${\Vert a\Vert }_{\infty }=max\left\{\right|a_i\left|\right\}$.

Definition 1.

If we are given a basis $B\in {\mathbb{Z}}^{M\times M}$ of some lattice, then the problem is to find a nonzero lattice point $B·y$ ($y\in {\mathbb{Z}}^M\setminus \left\{0\right\}$) satisfying for all $x\in {\mathbb{Z}}^M\setminus \left\{0\right\}$:

$$\parallel B·y\parallel \le \parallel B·x\parallel .$$

(1)

Example 1.

Given

$$B=\left[\begin{array}{cc}3& 1\\ 1& 2\end{array}\right],$$

(2)

one finds the shortest nonzero lattice point by computing the norms:

$$\parallel B·y\parallel =min\{\sqrt{10},\sqrt{5},\sqrt{5}\}=\sqrt{5}.$$

(3)

Definition 2

(Closest Vector Problem (CVP)). Given a target point $t\in {\mathbb{Z}}^M$ and a basis $B\in {\mathbb{Z}}^{M\times M}$ for a lattice, the problem is to find $y\in {\mathbb{Z}}^M$ satisfying

$$\parallel B·y-t\parallel \le \parallel B·x-t\parallel ,\forall x\in {\mathbb{Z}}^M.$$

(4)

Example 2.

Given

$$t=\left[\begin{array}{c}4\\ 7\end{array}\right],B=\left[\begin{array}{cc}2& 1\\ 1& 2\end{array}\right],$$

(5)

one computes the closest lattice point and finds

$$y=\left[\begin{array}{c}2\\ 1\end{array}\right],B·y=\left[\begin{array}{c}5\\ 4\end{array}\right],\mathit{distance}\sqrt{10}.$$

(6)

Definition 3

(Ring Learning With Error (RLWE) Assumption). Given $(a,b)\in R_q\times R_q$, where $a=a_0+a_{1}x+\cdots +a_{n-1}{x}^{n-1}\in R_q$ is sampled uniformly and $b=a·s+e$ with $s,e\leftarrow Sample\left({\mathcal{D}}_{\beta }^n\right)$, it is computationally hard to recover s given $(a,b)$.

Definition 4

(Decision Ring Learning With Error (DRLWE) Assumption). Let $R_q={\displaystyle \frac{{\mathbb{Z}}_q\left[x\right]}{\langle f\left(x\right)\rangle }}$, where q is prime and $f\left(x\right)$ has degree n. Given a pair $(a,b)\in R_q\times R_q$, the task is to distinguish between:

• $(a,b=a·s+e)$ for $s,e\leftarrow Sample\left({\mathcal{D}}_{\beta }^n\right)$, and
• uniformly random $(a^{*},b^{*})\in R_q\times R_q$.

Let

$${\mathbb{Z}}_q=\left\{-{\displaystyle \frac{q-1}{2}},\dots ,{\displaystyle \frac{q-1}{2}}\right\},E=\left\{-⌊{\displaystyle \frac{q}{4}}⌋,\dots ,⌊{\displaystyle \frac{q}{4}}⌋\right\}.$$

(7)

We define the signal function $Cha(·)$ (also called the characteristic function) [20]:

$$Cha\left(v\right)=\left\{\begin{array}{cc}0,\hfill & v\in E,\hfill \\ 1,\hfill & \mathrm{otherwise}.\hfill \end{array}\right.$$

(8)

Another function $Mo{d}_2:{\mathbb{Z}}_q\times \{0,1\}\to \{0,1\}$ is defined as

$$Mo{d}_2(v,w)=v+w·{\displaystyle \frac{q-1}{2}}.$$

(9)

If $v\in {\mathbb{Z}}_q$ and $w=Cha\left(v\right)$, then for $u=v+2e$, where e is a small error vector,

$$Mo{d}_2(v,w)=Mo{d}_2(u,w).$$

(10)

Definition 5.

Consider q an odd prime, and $u,v\in R_q$ with $u=v+2e$, $e\leftarrow {\mathcal{D}}_{\beta }^n$ such that $\parallel u-v\parallel <q/8$, and $w\leftarrow Cha\left(v\right)$. Then

$$Mo{d}_2(v,w)=Mo{d}_2(u,w).$$

(11)

The $Cha(·)$ function can be extended component-wise to elements in $R_q$:

$$v=v_0+v_{1}x+\cdots +v_{n-1}{x}^{n-1}\Rightarrow Cha\left(v\right)=(Cha\left(v_0\right),\dots ,Cha\left(v_{n-1}\right)).$$

(12)

Similarly, $Mo{d}_2(·)$ can be applied component-wise in $R_q$.

6. Statement and Cryptanalysis of Moony et al.’s Protocol [13]

A forward secure mutual authentication protocol ensures that even if long-term private keys are compromised, previously established session keys or authentication transcripts still remain secure. This is an important property in secure communications, especially in long-term deployments such as IoT, healthcare, or vehicular networks. In the reference of mutual authentication protocols, forward secrecy can be maintained by ensuring that session keys are not computed directly from long-term private keys of the server. We have tried to explain how the authentication protocol [13] is not maintained with forward secrecy. In the protocol in [13], the user sends $PI{D}_i,X_i,W_i,{\sum }_i$ to the server over a public networking channel. Therefore, if we assume the server’s master secret key is compromised, then the probabilistic polynomial times adversary easily computes any of the older session keys by executing these steps: (1) The adversary takes information $PI{D}_i,X_i,W_i,{\sum }_i$ from the public channel and master secret s, then computes $t_i^{\prime }=X_i.s$, $K_i^{\prime }={\psi }_2(t_i^{\prime },W_i)$. Further, it computes real identity $ide{n}_i^{\prime }=PI{D}_i\oplus H(K_i^{\prime },X_i,W_i)$, $B_i^{\prime }=H(ide{n}_i^{\prime },s)$, and finally computes session key $S{k}_s=H(ide{n}_i,PI{D}_i,K_i^{\prime },B_i^{\prime })$.

6.1. Key Mismatch Attack on Moony et al.’s Scheme

To execute a key mismatch attack on the Moony et al. protocol [13], an adversary $\mathcal{A}$ initiates different sessions with the server to obtain information and recover the master secret s of the server. A brief overview of the protocol [13] is given in

Table 3. Prototype [13] susceptible to key mismatch attack.

User	Server
Public Key: $P_U=\alpha ·s_U+2e_U$	Public Key:     $P_S=\alpha ·s_S+2e_S$
Secret Key: $s_U\in {\mathbb{R}}_p$	Secret Key: $s_S\in {\mathbb{R}}_p$
where $s_U,e_U\leftarrow {\chi }_{\xi }$	where $s_S,e_S\leftarrow {\chi }_{\rho }$
$\stackrel{P_U}{\to }$
$k_S=P_U·s_S$
${\omega }_S=\mathrm{Ch}\left(k_S\right)$
$\stackrel{P_S,{\omega }_S}{\leftarrow }$
$k_U=P_S·s_U$
${\mathrm{sk}}_S={\sigma }_S=M_2(k_S,{\omega }_S)$
${\mathrm{sk}}_U={\sigma }_U=M_2(k_U,{\omega }_S)$

. To execute this attack, $\mathcal{A}$ sets public key $x_i$ as below:

• $\mathcal{A}$ computes key:

  $$x_i=\alpha ·f_i+2g_i,$$

  where $f_i,g_i\leftarrow {\mathcal{D}}_{\xi }$ are random samples.
• $\mathcal{A}$ fixes $f_i=\mathbf{0}$ and $g_i=\mathbf{0}$ for i, except

  $$f_i[m-1-i]=1,g_i[m-1-j]=r,$$

  where $r\in {\mathbb{Z}}_p$ is chosen by $\mathcal{A}$.
• $\mathcal{A}$ computes the value j satisfying $s\left[j\right]=\pm 1$ (as described in Section 5.4 of [13]).
• Then $\mathcal{A}$ computes:

  $$k_i=f_i·P=0,\mathrm{since}{f}_i=\mathbf{0}$$
• The characteristic function outputs:

  $${\omega }_i=\mathrm{Ch}\left(k_i\right)=\mathrm{Ch}\left(0\right)=0$$
• The modular reconciliation function outputs:

  $$t_i=M_2(k_i,{\omega }_i)=M_2(0,0)=0$$
• $\mathcal{A}$ mounts attack as below:

  (a)

  An honest $\mathcal{A}$ conducts the procedure, purposely switching ${\omega }_i[m-1]$ to 1 such that $t_i[m-1]$ can assist and infer $s\left[i\right]$ for some $i\in [0,m-1]$.

  (b)

  The server S receives $(x_i,{\omega }_i)$ from $\mathcal{A}$ along with the necessary parameters.

• After receiving $(x_i,{\omega }_i)$, the server computes:

  $$\begin{array}{cc}\hfill k_i^{\prime }& =x_i·s=(\alpha f_i+2g_i)·s\hfill \\ \hfill k_i^{\prime }[m-1]& =x_i·s[m-1]=2g_i·s[m-1]\hfill \end{array}$$

  (13)

  $$\begin{array}{cc}\hfill & =2s\left[i\right]+2r\hfill \end{array}$$

  (14)
  Since $\mathcal{A}$ changes ${\omega }_i[m-1]=1$, then the reconciliation function outputs:

  $$\begin{array}{c}\hfill t_i^{\prime }[m-1]=M_2(k_i^{\prime },{\omega }_i)[m-1]\\ \hfill =M_2(k_i^{\prime }[m-1],{\omega }_i[m-1])\\ \hfill =\left(k_i^{\prime }[m-1]+{\displaystyle \frac{p-1}{2}}\right)modpmod2\\ \hfill =\left(2s\left[i\right]+2r+{\displaystyle \frac{p-1}{2}}\right)modpmod2\end{array}$$

  (15)
• $\mathcal{A}$ constructs accessible $\mathcal{O}$ that observes the server S. The oracle $\mathcal{O}$ executes the following steps:
  • Gets $({\mathrm{pid}}_i,{\omega }_i,x_i,{\beta }_i)$
  • Computes $k_i^{\prime }=x_i·s$
  • Computes $t_i^{\prime }=M_2(k_i^{\prime },{\omega }_i)$
  • Computes masked value:

    $${\mathrm{id}}_a^{\prime }={\mathrm{pid}}_i\oplus H(t_i^{\prime },x_i,{\omega }_i)$$
  • Computes:

    $$V_i^{\prime }=H({\mathrm{id}}_a^{\prime },V_i,t_i^{\prime }),{\beta }_i^{\prime }=H({\mathrm{id}}_a^{\prime },V_i,t_i^{\prime })$$
  • Returns:

    $$\mathcal{O}({\mathrm{pid}}_i,{\omega }_i,x_i,{\beta }_i)=\left\{\begin{array}{cc}1,\hfill & \mathrm{if}{\beta }_i={\beta }_i^{\prime }\hfill \\ 0,\hfill & \mathrm{Else}\hfill \end{array}\right.$$
• Since $r=0$ is set by $\mathcal{A}$, $x_i=2g_i$. The result of querying $x_i$ to the oracle $\mathcal{O}$ with $\mathcal{A}$ is:

  $$k_i^{\prime }[m-1]=2s\left[i\right]+2r$$

  from Equation. The sign of $k_i^{\prime }[m-1]$ is the outcome that imitates $s\left[i\right]$’s sign. Therefore:
  • If $\mathcal{O}$ outputs 1, $\mathcal{A}$ concludes $\mathrm{sign}\left(s\right[i\left]\right)<0$.
  • If $\mathcal{O}$ outputs 0, $\mathcal{A}$ concludes $\mathrm{sign}\left(s\right[i\left]\right)>0$.
• The output is 1 when $s\left[i\right]=0$; then $\mathcal{A}$ executes another query with $g_i[m-1-i]=-1$:

  $$k_i^{\prime }[m-1]=-2s\left[i\right]$$
  If $g_i[m-1-i]=1$ and $-1$, then it returns 1, and $\mathcal{A}$ outputs $s\left[i\right]=0$.
• To get the sign:
  • $\mathcal{A}$ takes the help of $g_i[m-1-j]=r$ to check negative $s\left[i\right]$.
  • $\mathcal{A}$ takes the help of $g_i[m-1-j]=-r$ to check positive $s\left[i\right]$.
  From the above computations for k, if $t_i^{\prime }[m-1]=0$, then:

  $$s\left[i\right]+k\equiv 0(modp)\Rightarrow s\left[i\right]\equiv -k(modp)$$
  Thus, $\mathcal{A}$ guesses the correct $s\left[i\right]$, and recovers master secret s.

6.2. Unlinkability in Mishra et al.’s Scheme [29]

Mishra et al. [29] proposed a quantum enhanced authentication and key agreement protocol for autonomous vehicles, but this protocol does not support unlinkability. In this scheme, the vehicle user sends the message $<PI{D}_i,x_i,{\Sigma }_i>$ which contains no repeating $PI{D}_i$, and it helps to link older messages with the new message coming.

6.3. Unlinkability and Problem with Error Distribution in Pursharthi et al. [15]

Pursharthi et al. [15] proposed a quantum-safe authenticated key agreement scheme for mobile devices, but their protocol does not provide unlinkability. One can observe that user $U_i$ sends information $\{PI{D}_i,x_i,T_i,{\sum }_i\}$ to the server over a public channel. In the message $\{PI{D}_i,x_i,T_i,{\sum }_i\}$, the value $PI{D}_i$ is chosen by the server, and it is a fixed value for each of the sessions; therefore, this protocol cannot provide unlinkability. Moreover, this protocol uses learning with error multiple times on the same component $k_j=(x_i.s_j+2c)d+2e^{\prime }$ that will increase the error added from the Gaussian; therefore, this is mathematically incorrect. These findings underscore the urgent need for carefully designed lattice-based protocols that offer strong security properties such as unlinkability, key control, and resilience against side-channel and guessing attacks while maintaining correctness and efficiency under practical constraints.

7. Proposed Two-Party Key Establishment and Key Transport Protocols for Mobile Devices

7.1. Setup Phase

The Setup Phase for Registration establishes the foundation for secure communication between users, devices, or entities in a cryptographic system. This phase is typically executed once by a trusted authority (TA) to initialize system parameters and register legitimate users or devices.

• The website server ($S_j$) selects three security parameters: $n=2^i$ is an integer, a prime q of $2n+1$ type, and n-dimensional discrete Gaussian ${\mathcal{D}}_{\delta }^n$ over finite ring $R_q$ with standard deviation $\delta$.
• The server $S_j$ chooses $a\leftarrow R_q$, and it samples $s,e\leftarrow {\mathcal{D}}_{\delta }^n$ randomly and computes public key $b=a.s+2e$; here s is the master secret of the server.
• The server $S_j$ also chooses a secure collision resistant hashing function $\mathcal{H}$ that outputs 256 bits, publishes $n,q,{\mathcal{D}}_{\beta }^n,a,b,\mathcal{H}(.)$ in the public domain, and keeps “s” secret.

7.2. Registration Phase

The Registration Phase is responsible for securely enrolling a user or device into the system. This phase ensures that only legitimate and authorized participants can obtain valid credentials from the trusted authority (TA), enabling secure authentication, communication, and cryptographic operations.

• The device user $U_i$ chooses arbitrary strings as identity ($i{d}_i$), password ($p{w}_i$), and random integer ${\varrho }_i\in Z_q$ and computes ${\vartheta }_i=\mathcal{H}(i{d}_i\left|\right|\mathcal{H}(p{w}_i\left|\right|{\varrho }_i\left)\right)$. Further, $U_i$ sends ${\vartheta }_i,i{d}_i$ to the server $S_j$.
• The server receives $\{{\vartheta }_i,i{d}_i\}$, computes masked identity $psi{d}_i=\mathcal{H}(i{d}_i\left|\right|s)$, and $d_i=psi{d}_i\oplus {\vartheta }_i$, and sends the message ${\vartheta }_i,d_i$ to the user ($U_i$).
• The user $U_i$ receives ${\vartheta }_i,d_i$ from the server $S_j$, computes ${\vartheta }_i=\mathcal{H}(i{d}_i\left|\right|\mathcal{H}(p{w}_i\left|\right|{\varrho }_i\left)\right)$, and recovers masked identity $d_i\oplus {\vartheta }_i=psi{d}_i$, and a verification factor $v_i=\mathcal{H}(i{d}_i\left|\right|p{w}_i\left|\right|psi{d}_i\left|\right|{\varrho }_i)$. Finally, the user ($U_i$) computes the verification value ${\varrho }_i^{*}={\varrho }_i\oplus \mathcal{H}\left(\mathcal{H}\right(i{d}_i\left|\right|\mathcal{H}\left(p{w}_i\right)\left)mod\left(p\right)\right)$, where p is a suitable prime number, and stores $\{{\varrho }_i^{*},v_i,\mathcal{H}(.)\}$ in the device.

7.3. Login and Authenticated Key Establishment Phase (Figure 1)

Authenticated Key Establishment (AKE) protocols enable two or more parties to mutually derive a shared secret key over an insecure channel, ensuring that the key is known only to the legitimate participants. Unlike unauthenticated key exchange mechanisms that are susceptible to man-in-the-middle (MitM) attacks, AKE protocols incorporate authentication mechanisms such as digital signatures, certificates, or message authentication codes (MACs) to confirm the identity of communicating parties. These protocols are widely used in internet security protocols such as TLS, IPsec, and SSH, and are especially important in scenarios requiring forward secrecy, where compromise of long-term keys does not affect past session keys. With the advent of quantum computing, classical AKE protocols based on discrete logarithms and elliptic curves are being reconsidered in favor of post-quantum AKE schemes, particularly those based on lattice problems, code-based, or hash-based cryptography.

• The user $U_i$ inputs $i{d}_i$, $p{w}_i$, and computes ${\varrho }_i={\varrho }_i^{*}\oplus \mathcal{H}\left(\mathcal{H}\right(i{d}_i\left|\right|\mathcal{H}\left(p{w}_i\right)\left)mod\left(p\right)\right)$, ${\vartheta }_i=\mathcal{H}(i{d}_i\left|\right|\mathcal{H}(p{w}_i\left|\right|{\varrho }_i\left)\right)$, and masked identity $psi{d}_i=\mathcal{H}(i{d}_i\left|\right|s)=d_i\oplus {\vartheta }_i$, checks $v_i=?\mathcal{H}(i{d}_i\left|\right|p{w}_i\left|\right|psi{d}_i\left|\right|{\varrho }_i)$, and gives permission to be logged into the device.
• The $U_i$ samples random $r_i,f_i\leftarrow {\mathcal{D}}_{\beta }^n$ from the n-dimensional Gaussian, and computes $x_i=a.r_i+2.f_i$, ${\kappa }_i=r_i.b$, $w_i=Cha\left({\kappa }_i\right)$, ${\sigma }_i=Mo{d}_2({\kappa }_i,w_i)$, and a verification factor ${\alpha }_i=\mathcal{H}(x_i\left|\right|{\sigma }_i\left|\right|psi{d}_i)$. Finally, the user $U_i$ sends $\{x_i,w_i,i{d}_i,{\alpha }_i\}$ to the server over a public channel.
• The server $S_j$ receives the message $\{x_i,w_i,i{d}_i,{\alpha }_i\}$, samples $r_s,f_s\leftarrow {\mathcal{D}}_{\delta }^n$, and computes $x_s=a.r_s+2.f_s$, ${\kappa }_i^{\prime }=x_i.s$, ${\sigma }_i^{\prime }=Mo{d}_2({\kappa }_i^{\prime },w_i)$, and the masked identity $psi{d}_i^{\prime }=\mathcal{H}(i{d}_i^{\prime }\left|\right|s)$. Furthers, it verifies ${\alpha }_i=\mathcal{H}(x_i\left|\right|{\sigma }_i^{\prime }\left|\right|psi{d}_i^{\prime })$, and computes ${\kappa }_s=x_i.r_s$, $w_s=Cha\left({\kappa }_s\right)$, ${\sigma }_s=Mo{d}_2({\kappa }_s,w_s)$, and session key $sk=\mathcal{H}(x_i||{\sigma }_i||x_s||{\sigma }_s||i{d}_i||i{d}_s||psi{d}_i)$. Finally, it computes a verification factor ${\alpha }_s=\mathcal{H}(x_i\left|\right|{\sigma }_i\left|\right|x_s\left|\right|{\sigma }_s\left|\right|psi{d}_i\left|\right|sk)$, and sends the message $\{x_s,w_s,{\alpha }_s\}$ to the corresponding user.
• The $U_i$ receives the message $\{x_s,w_s,{\alpha }_s\}$, and computes ${\kappa }_s^{\prime }=r_i.x_s$, ${\sigma }_s^{\prime }=Mo{d}_2({\kappa }_s,w_s)$, session key $s{k}^{\prime }=\mathcal{H}(x_i\left|\right|{\sigma }_i\left|\right|x_s\left|\right|{\sigma }_s^{\prime }\left|\right|i{d}_i\left|\right|i{d}_s\left|\right|psi{d}_i)$. Finally, the user verifies the correctness of the session key by ${\alpha }_s=\mathcal{H}(x_i\left|\right|{\sigma }_i\left|\right|x_s\left|\right|{\sigma }_s^{\prime }\left|\right|psi{d}_i\left|\right|s{k}^{\prime })$.

Figure 1. Mutual authentication and key establishment protocol overview.

Figure 1. Mutual authentication and key establishment protocol overview.

7.4. Login and Authenticated Key Transport Phase (Figure 2)

• The user $U_i$ inputs $i{d}_i$, $p{w}_i$, and computes ${\varrho }_i={\varrho }_i^{*}\oplus \mathcal{H}\left(\mathcal{H}\right(i{d}_i\left|\right|\mathcal{H}\left(p{w}_i\right)\left)mod\left(p\right)\right)$, a masked value ${\vartheta }_i=\mathcal{H}(i{d}_i\left|\right|\mathcal{H}(p{w}_i\left|\right|{\varrho }_i\left)\right)$, masked identity $psi{d}_i=\mathcal{H}(i{d}_i\left|\right|s)=d_i\oplus {\vartheta }_i$, and it checks $v_i=?\mathcal{H}(i{d}_i\left|\right|p{w}_i\left|\right|psi{d}_i\left|\right|{\varrho }_i)$, and gives permission to be logged into the device (see Figure 2).
• The user chooses random sample $r_i,f_i\leftarrow {\mathcal{D}}_{\delta }^n$, and computes $x_i=a.r_i+2.f_i$, ${\kappa }_i=r_i.b$, $w_i=Cha\left({\kappa }_i\right)$, and ${\sigma }_i=Mo{d}_2({\kappa }_i,w_i)$. Now, the user computes masked dynamic identity $ai{d}_i=(i{d}_i\left|\right|i{d}_s\left|\right|\varrho )\oplus \mathcal{H}(x_i\left|\right|{\sigma }_i)$, ${\alpha }_i=\mathcal{H}(x_i\left|\right|{\sigma }_i\left|\right|ai{d}_i\left|\right|psi{d}_i\left|\right|\varrho )$, and sends $\{x_i,w_i,ai{d}_i,{\alpha }_i\}$ to the server.
• The server receives the information $\{x_i,w_i,ai{d}_i,{\alpha }_i\}$ from $U_i$, and computes ${\kappa }_i^{\prime }=x_i.s$, ${\sigma }_i^{\prime }=Mo{d}_2({\kappa }_i^{\prime },w_i)$, $(i{d}_i\left|\right|i{d}_s\left|\right|\varrho )=ai{d}_i\oplus \mathcal{H}(x_i\left|\right|{\sigma }_i^{\prime })$, and $psi{d}_i^{\prime }=\mathcal{H}(i{d}_i^{\prime }\left|\right|s)$. Now, the server verifies whether ${\alpha }_i=\mathcal{H}(x_i\left|\right|{\sigma }_i^{\prime }\left|\right|ai{d}_i\left|\right|psi{d}_i\left|\right|\varrho )$ holds or not. If the information received is correct, then the server computes and chooses the random session key $sk\in {\{0,1\}}^{256}$, encrypts it to obtain $s{k}^{*}=e_{\varrho }\left(sk\right)$, and computes ${\alpha }_s=\mathcal{H}(x_i\left|\right|{\sigma }_i\left|\right|x_s\left|\right|{\sigma }_s\left|\right|psi{d}_i\left|\right|sk)$, then sends $\{s{k}^{*},{\alpha }_s\}$ to the user.
• The $U_i$ receives the information $\{s{k}^{*},{\alpha }_s\}$ from the server, decrypts $d_{\varrho }\left(s{k}^{*}\right)=s{k}^{\prime }$, and obtains the session key. Finally, the user verifies the session key with ${\alpha }_s=\mathcal{H}(x_i\left|\right|{\sigma }_i\left|\right|x_s\left|\right|{\sigma }_s^{\prime }\left|\right|psi{d}_i\left|\right|s{k}^{\prime })$, and stores the session key for current communication.

Figure 2. Key transport protocol overview.

Figure 2. Key transport protocol overview.

7.5. Proof of Correctness

To provide a mathematical proof of correctness for an authentication protocol, we aim to formally show that if all parties follow the protocol honestly, and no adversary interferes, then the authentication between entities succeeds correctly, i.e., the intended parties are authenticated and session keys match.

Theorem 1.

If both user ($U_i$) and server ($S_j$) shared a common session key $sk$, then we need to show that for user ($U_i$) and server ($S_j$), if $|k_i-k_i^{\prime }| <{\displaystyle \frac{q}{8}}$, then mathematical correctness holds.

Proof. 

If we can show that $|k_i-k_i^{\prime }| <{\displaystyle \frac{q}{8}}$, then mathematical correctness will hold obviously. For this reason, a researcher computes the error difference

$$\begin{array}{cc}\hfill |k_i-k_i^{\prime }|& =|r_i.b-x_i.s|\hfill \\ \hfill & =\left|r_i(as+2e)-(a{r}_i+2f_i)s\right|\hfill \\ \hfill & =\left|2e·r_i-2s·f_i\right|\hfill \end{array}$$

and

$$\begin{array}{cc}\hfill {∥2e·r_i-2s·f_i∥}_2& \le {∥e·r_i∥}_2+{∥s·f_i∥}_2\hfill \\ \hfill & \le \sqrt{m}{∥r_i∥}_2{∥e∥}_2+\sqrt{m}{∥f_i∥}_2{∥s∥}_2\hfill \\ \hfill & < 2\sqrt{m}\gamma ·\sqrt{m}\gamma ·\sqrt{m}\hfill \\ \hfill & = 2m^{3/2}{\gamma }^2<{\displaystyle \frac{q}{8}}\hfill \end{array}$$

Hence, the result follows Definition 5.

□

8. Informal Security Analysis

An informal security analysis helps identify potential vulnerabilities in a two-party key establishment protocol without going into deep formal proofs. Below is a sample informal security analysis of such a protocol, typically involving parties A and B, aiming to establish a shared session key $sK$ over an insecure channel.

• Anonymity: An anonymous protocol is a type of communication protocol designed to protect the identity of the participants involved. These protocols are widely used in privacy-preserving applications such as secure messaging, anonymous voting, electronic cash systems, and privacy-preserving authentication in networking systems. In this protocol, the user $U_i$ samples random $r_i,f_i\leftarrow {\mathcal{D}}_{\delta }^n$, computes $x_i=a.r_i+2.f_i$, ${\kappa }_i=r_i.\xi$, $w_i=Cha\left({\kappa }_i\right)$, ${\sigma }_i=Mo{d}_2({\kappa }_i,w_i)$, and masks the real identity as $ai{d}_i=(i{d}_i||i{d}_s||\varrho )\oplus \mathcal{H}(x_i||{\sigma }_i)$. Finally, $U_i$ computes verification factor ${\alpha }_i=\mathcal{H}(x_i||{\sigma }_i||ai{d}_i||psi{d}_i||\varrho )$, and sends $\{x_i,w_i,ai{d}_i,{\alpha }_i\}$ to the $S_j$. Since the real identity is masked during communication over a public channel, it is hard for the adversary ($\mathcal{A}$) to guess the real identity of the user.
• Session key freshness: Session key freshness refers to the guarantee that a newly generated session key is unique and has not been used in any previous communication session. It ensures that each session between parties uses a fresh (i.e., previously unused and unpredictable) key, which is crucial for maintaining confidentiality, forward secrecy, and resistance to replay attacks. In this protocol, the user $U_i$ samples random $r_i,f_i\leftarrow {\mathcal{D}}_{\delta }^n$, computes $x_i=a.r_i+2.f_i$, ${\kappa }_i=r_i.\xi$, $w_i=Cha\left({\kappa }_i\right)$, ${\sigma }_i=Mo{d}_2({\kappa }_i,w_i)$, and masks the real identity as $ai{d}_i=(i{d}_i||i{d}_s||\varrho )\oplus \mathcal{H}(x_i||{\sigma }_i)$. Finally, $U_i$ computes verification factor ${\alpha }_i=\mathcal{H}(x_i||{\sigma }_i||ai{d}_i||psi{d}_i||\varrho )$, and sends $\{x_i,w_i,ai{d}_i,{\alpha }_i\}$ to the $S_j$. The server receives the message $\{x_i,w_i,ai{d}_i,{\alpha }_i\}$, computes ${\kappa }_i^{\prime }=x_i.s$, ${\sigma }_i^{\prime }=Mo{d}_2({\kappa }_i^{\prime },w_i)$, and recovers real identities $(i{d}_i||i{d}_s||\varrho )=ai{d}_i\oplus \mathcal{H}(x_i||{\sigma }_i)$. Further, it computes $psi{d}_i^{\prime }=\mathcal{H}(i{d}_i^{\prime }||s)$, and verifies the information received from the public channel by ${\alpha }_i=\mathcal{H}(x_i||{\sigma }_i^{\prime }||ai{d}_i||psi{d}_i||\varrho )$. Finally, the server chooses a random session key $sk\in {\{0,1\}}^{256}$, and transports it to the corresponding user. Since the session key is chosen randomly, and is new for each session, it concludes the freshness.
• Forward Secure: A forward secure protocol (also called forward secrecy or perfect forward secrecy) is a cryptographic protocol designed to ensure that compromise of long-term secret keys does not compromise past session keys. In this protocol, the user $U_i$ samples random $r_i,f_i\leftarrow {\mathcal{D}}_{\delta }^n$, computes $x_i=a.r_i+2.f_i$, ${\kappa }_i=r_i.\xi$, $w_i=Cha\left({\kappa }_i\right)$, ${\sigma }_i=Mo{d}_2({\kappa }_i,w_i)$, and masks real identity as $ai{d}_i=(i{d}_i||i{d}_s||\varrho )\oplus \mathcal{H}(x_i||{\sigma }_i)$. Finally, $U_i$ computes verification factor ${\alpha }_i=\mathcal{H}(x_i||{\sigma }_i||ai{d}_i||psi{d}_i||\varrho )$, and sends $\{x_i,w_i,ai{d}_i,{\alpha }_i\}$ to the $S_j$. The server receives the message $\{x_i,w_i,ai{d}_i,{\alpha }_i\}$, computes ${\kappa }_i^{\prime }=x_i.s$, ${\sigma }_i^{\prime }=Mo{d}_2({\kappa }_i^{\prime },w_i)$, and recovers real identities $(i{d}_i||i{d}_s||\varrho )=ai{d}_i\oplus \mathcal{H}(x_i||{\sigma }_i)$. Further, it computes $psi{d}_i^{\prime }=\mathcal{H}(i{d}_i^{\prime }||s)$, and verifies the information received from the public channel by ${\alpha }_i=\mathcal{H}(x_i||{\sigma }_i^{\prime }||ai{d}_i||psi{d}_i||\varrho )$. Finally, the server chooses a random session key $sk\in {\{0,1\}}^{256}$, and transports it to the corresponding user. The session key is dependent on the particular session and is different for other sessions. Therefore, it is not possible to recover previous session keys even if the current session key is compromised.
• Replay Attack: A replay attack occurs when an adversary intercepts and retransmits a previously sent message to trick the receiver into performing an action again or unauthorizedly, without knowing the actual message content or context. An adversary records a valid message exchange between two parties and replays the same message later to impersonate a legitimate user or repeat an operation. In this protocol, the user $U_i$ samples random $r_i,f_i\leftarrow {\mathcal{D}}_{\delta }^n$, computes $x_i=a.r_i+2.f_i$, ${\kappa }_i=r_i.\xi$, $w_i=Cha\left({\kappa }_i\right)$, ${\sigma }_i=Mo{d}_2({\kappa }_i,w_i)$, and masks the real identity as $ai{d}_i=(i{d}_i||i{d}_s||\varrho )\oplus \mathcal{H}(x_i||{\sigma }_i)$ along with a random number. Finally, $U_i$ computes verification factor ${\alpha }_i=\mathcal{H}(x_i||{\sigma }_i||ai{d}_i||psi{d}_i||\varrho )$, and sends $\{x_i,w_i,ai{d}_i,{\alpha }_i\}$ to the $S_j$. The server receives the message $\{x_i,w_i,ai{d}_i,{\alpha }_i\}$, computes ${\kappa }_i^{\prime }=x_i.s$, ${\sigma }_i^{\prime }=Mo{d}_2({\kappa }_i^{\prime },w_i)$, and recovers real identities $(i{d}_i||i{d}_s||\varrho )=ai{d}_i\oplus \mathcal{H}(x_i||{\sigma }_i)$. Further, it computes $psi{d}_i^{\prime }=\mathcal{H}(i{d}_i^{\prime }||s)$, and verifies the information received from the public channel by ${\alpha }_i=\mathcal{H}(x_i||{\sigma }_i^{\prime }||ai{d}_i||psi{d}_i||\varrho )$. Finally, the server chooses a random session key $sk\in {\{0,1\}}^{256}$, and encrypts it with a random number sent by the user. Therefore, it is not possible to replay older messages.
• Impersonation Attack: An impersonation attack occurs when an adversary pretends to be a legitimate user or entity in a communication protocol to deceive another party, without actually possessing the user’s credentials or secrets. In an impersonation attack, the attacker mimics the identity of a legitimate party (e.g., Alice) and communicates with another party (e.g., Bob) to gain unauthorized access, establish a session, or steal sensitive data. In this protocol, the user $U_i$ samples random $r_i,f_i\leftarrow {\mathcal{D}}_{\delta }^n$, computes $x_i=a.r_i+2.f_i$, ${\kappa }_i=r_i.\xi$, $w_i=Cha\left({\kappa }_i\right)$, ${\sigma }_i=Mo{d}_2({\kappa }_i,w_i)$, and masks the real identity as $ai{d}_i=(i{d}_i||i{d}_s||\varrho )\oplus \mathcal{H}(x_i||{\sigma }_i)$. Finally, $U_i$ computes verification factor ${\alpha }_i=\mathcal{H}(x_i||{\sigma }_i||ai{d}_i||psi{d}_i||\varrho )$, and sends $\{x_i,w_i,ai{d}_i,{\alpha }_i\}$ to the $S_j$. The server receives the message $\{x_i,w_i,ai{d}_i,{\alpha }_i\}$, computes ${\kappa }_i^{\prime }=x_i.s$, ${\sigma }_i^{\prime }=Mo{d}_2({\kappa }_i^{\prime },w_i)$, and recovers real identities $(i{d}_i||i{d}_s||\varrho )=ai{d}_i\oplus \mathcal{H}(x_i||{\sigma }_i)$. Further, it computes $psi{d}_i^{\prime }=\mathcal{H}(i{d}_i^{\prime }||s)$, and inserts it in the verification factor ${\alpha }_i=\mathcal{H}(x_i||{\sigma }_i^{\prime }||ai{d}_i||psi{d}_i||\varrho )$. Thus, it is not possible to impersonate the user or server.
• Man-in-the-Middle (MITM) attack: A protocol is said to be resistant to a Man-in-the-Middle (MITM) attack if it can detect and prevent an adversary from secretly intercepting and altering the communication between two parties without being detected. In an MITM attack, an adversary (Eve) places herself between two parties (Alice and Bob) and modifies, drops, or replaces their messages, often establishing two separate connections:
  In this protocol, the user $U_i$ samples random $r_i,f_i\leftarrow {\mathcal{D}}_{\delta }^n$, computes $x_i=a.r_i+2.f_i$, ${\kappa }_i=r_i.\xi$, $w_i=Cha\left({\kappa }_i\right)$, ${\sigma }_i=Mo{d}_2({\kappa }_i,w_i)$, and masks the real identity as $ai{d}_i=(i{d}_i||i{d}_s||\varrho )\oplus \mathcal{H}(x_i||{\sigma }_i)$. Finally, $U_i$ computes verification factor ${\alpha }_i=\mathcal{H}(x_i||{\sigma }_i||ai{d}_i||psi{d}_i||\varrho )$, and sends $\{x_i,w_i,ai{d}_i,{\alpha }_i\}$ to the $S_j$. The server receives the message $\{x_i,w_i,ai{d}_i,{\alpha }_i\}$, computes ${\kappa }_i^{\prime }=x_i.s$, ${\sigma }_i^{\prime }=Mo{d}_2({\kappa }_i^{\prime },w_i)$, and recovers real identities $(i{d}_i||i{d}_s||\varrho )=ai{d}_i\oplus \mathcal{H}(x_i||{\sigma }_i)$. Further, it computes $psi{d}_i^{\prime }=\mathcal{H}(i{d}_i^{\prime }||s)$, and inserts it in the verification factor ${\alpha }_i=\mathcal{H}(x_i||{\sigma }_i^{\prime }||ai{d}_i||psi{d}_i||\varrho )$. Finally, the server chooses a random session key $sk\in {\{0,1\}}^{256}$, and encrypts it with a random number sent by the user. Therefore, a man-in-the-middle attack is not possible.
• Authenticated key establishment and key transport schemes resist key mismatch attacks: The $U_i$ generates

  $$x_i=\alpha f_i+2g_i\mathrm{with}{f}_i=0\in R_q$$

  and transmits to the server $S_j$. Now, if an adversary ${\mathcal{A}}_i$ has information about the protocol and the ability to submit polynomial times queries to ${\mathcal{A}}_i$, then it is easy to execute key mismatch attacks to guess the secret key s [13].
  To get $jth$ coefficient $s\left[j\right]$, the adversary ${\mathcal{A}}_i$ chooses $g_i$ satisfying:

  $$g_i\left[j\right]=0\forall j=0\mathrm{to}n-1\mathrm{except}j=n-1-j,n-1-\eta$$

  $$g_i[n-1-j]=1,g_i[n-1-\eta ]=k$$
  Then, ${\mathcal{A}}_i$ runs this protocol and tries to flip the bit $(n-1)$ of ${\omega }_i$ and send it to the server. It is essential to choose $\eta$ satisfying $s\left[\eta \right]=\pm 1$. Further, ${\mathcal{A}}_i$ guesses the sign of $s\left[j\right]$, and submits queries. If the sign received is positive, then

  $$k_i[n-1]=2s\left[j\right]-2k$$
  It is interesting to see that this value flips from positive to negative, increasing k whenever $k>s\left[j\right]$, and $S{k}_s[n-1]=1$ whenever $k_i[n-1]>0$.
  In this protocol, the multiplication of $s\left[j\right]$ is performed with random samples $f_i$ and $g_i$ to get $k_i[j-1]$, where ${\mathcal{A}}_i$ controls $f_i$ only, and server $S_j$ controls $g_i$. Thus, ${\mathcal{A}}_i$ has no control over changing $g_i$. Therefore,

  $$k_i[n-1]=2s\left[j\right]g+2k_s\left[\eta \right]g_i+2g_i{f}_i+2g_i=2s\left[j\right]g_i+2k_i{g}_i+2f_i{g}_i+2g_i$$
  If ${\mathcal{A}}_i$ guesses the sign of $s\left[j\right]$ is positive, it increases $k>0$ and observes changes from 1 to 0; this flip is not there if:

  $$|2s\left[j\right]g_i+2f_i{g}_i+2g_i|\le 2g_i$$
  Due to this condition, the proposed protocol resists key mismatch attacks.

9. Formal Security Proof

This section illustrates a structured and academically appropriate Formal Security Proof outline for a lattice-based key agreement protocol based on the Ring Learning With Errors (RLWE) problem [2,30]. The proof follows the Bellare–Rogaway model under the random oracle model (ROM) and assumes the hardness of RLWE. We have provided a detailed formal security proof for a lattice-based key agreement protocol based on the Ring Learning With Errors (RLWE) assumption. The proof is constructed within the Bellare–Rogaway (BR) model and under the random oracle model (ROM) [31].

9.1. Security Model

The security of the proposed protocol is analyzed under the BR model, where multiple users may participate in many concurrent sessions. The adversary $\mathcal{A}$ is modeled as a probabilistic polynomial time (PPT) algorithm capable of issuing the following queries [31]:

• Send$(U_i,m)$ — Sends a message m to user $U_i$ and receives the response.
• Reveal$\left(s\right)$ — Reveals the session key of completed session s.
• Corrupt$\left(U_i\right)$ — Reveals the long-term secret of user $U_i$.
• Test$\left(s^{*}\right)$ — The challenge query. A random bit b is chosen. If $b=0$, the real session key is returned; if $b=1$, a random string is returned. $\mathcal{A}$ outputs a guess $b^{\prime }$.

9.2. Assumptions

• Hardness of RLWE: Let $R={\mathbb{Z}}_q\left[x\right]/\left(f\left(x\right)\right)$ be a cyclotomic ring. Given samples $(a,a·s+e)$ for uniformly random $a\in R_q$, secret $s\in R_q$, and error e sampled from a discrete Gaussian, no PPT adversary can distinguish these from uniform with non-negligible advantage.
• Hash functions used in the protocol are modeled as random oracles.

9.3. Game-Based Proof

We define a sequence of games, $G_0,G_1,G_2,G_3$, where $G_0$ represents the real attack scenario and $G_3$ is the ideal game with zero advantage.

9.3.1. Game $G_0$

This is the real execution of the protocol. The adversary interacts with the honest parties and eventually issues a Test query.

$$Pr\left[\mathcal{A}\mathrm{wins}\mathrm{in}{G}_0\right]={\mathrm{Adv}}_{\mathcal{A}}^{\mathrm{AKE}}\left(\lambda \right)$$

9.3.2. Game $G_1$

In this game, the session key is no longer derived from the actual shared secret but from a randomly chosen value. Since the key derivation uses a random oracle, the output is indistinguishable.

$$|Pr\left[G_0\right]-Pr\left[G_1\right]|\le \mathrm{negl}\left(\lambda \right)$$

9.3.3. Game $G_2$

Here, the RLWE shared secret is replaced with a uniform random value in $R_q$. By the hardness of RLWE, the adversary cannot distinguish this change:

$$|Pr\left[G_1\right]-Pr\left[G_2\right]| \le {ϵ}_{\mathrm{RLWE}}\left(\lambda \right)$$

9.3.4. Game $G_3$

In this ideal game, the session key is uniformly random and independent of the adversary’s view. Therefore, the adversary’s success probability is exactly $1/2$.

$$Pr\left[G_3\right]={\displaystyle \frac{1}{2}}$$

9.4. Advantage Bound

By the hybrid argument, we have:

$${\mathrm{Adv}}_{\mathcal{A}}^{\mathrm{AKE}}\left(\lambda \right)=|Pr\left[G_0\right]-Pr\left[G_3\right]|\le {ϵ}_{\mathrm{RLWE}}\left(\lambda \right)+\mathrm{negl}\left(\lambda \right)$$

Thus, the adversary’s advantage is negligible, proving the protocol is secure under the RLWE assumption.

9.4.1. Game 0: Real Protocol Execution

This game represents the real protocol. The adversary $\mathcal{E}$ interacts with the protocol participants and receives the real shared secret k derived using the parties’ private and public keys. The adversary’s advantage in distinguishing k from a random string is denoted as:

$${\mathrm{Adv}}_{\mathcal{E}}^{\mathrm{Game}0}=Pr\left[\mathcal{E}\mathrm{distinguishes}k\mathrm{from}\mathrm{random}\right]-{\displaystyle \frac{1}{2}}.$$

9.4.2. Game 1: Replace Secret with a Random Value

In this game, the shared secret k is replaced with a random string r of the same length. The adversary interacts with the protocol as before. The change from Game 0 to Game 1 is indistinguishable if the shared secret k is computationally secure.

Reduction: Assume there exists a PPT adversary $\mathcal{E}$ that distinguishes Game 0 from Game 1 with non-negligible advantage $ϵ$. We construct a reduction $\mathcal{R}$ that uses $\mathcal{E}$ to solve the underlying post-quantum problem:

• $\mathcal{R}$ is given a challenge instance of the hard problem.
• $\mathcal{R}$ embeds the challenge into the public key $p{k}_A$ or $p{k}_B$.
• $\mathcal{R}$ simulates the protocol for $\mathcal{E}$ and uses $\mathcal{E}$’s output to solve the hard problem.

If $\mathcal{E}$ has non-negligible advantage $ϵ$, then $\mathcal{R}$ solves the hard problem with non-negligible probability, contradicting the hardness assumption.

Thus:

$${\mathrm{Adv}}_{\mathcal{E}}^{\mathrm{Game}1}={\mathrm{Adv}}_{\mathcal{E}}^{\mathrm{Game}0}-ϵ.$$

9.4.3. Game 2: Random Oracle Simulation

In this game, the hash function is replaced with a random oracle. The adversary cannot distinguish this change due to the random oracle model assumption. Thus:

$${\mathrm{Adv}}_{\mathcal{E}}^{\mathrm{Game}2}={\mathrm{Adv}}_{\mathcal{E}}^{\mathrm{Game}1}.$$

9.5. Conclusions

In Game 2, the shared secret is computationally indistinguishable from a random value. Therefore:

$${\mathrm{Adv}}_{\mathcal{E}}^{\mathrm{Game}2}=0.$$

Combining the results of all games:

$${\mathrm{Adv}}_{\mathcal{E}}^{\mathrm{Game}0}\le ϵ.$$

Since $ϵ$ is negligible, the protocol is secure in the ROR model.

Theorem 2.

Let ${\mathrm{Adv}}_{\mathrm{Proposed}}^A\left(t\right)$ represent the probability that A successfully compromises the semantic security of the session key and achieves mutual authentication between $U_i$ and $U_j$ within a polynomial time bound t in the proposed protocol. Suppose that ${\mathit{Adv}}_{\mathit{RLWE}}^A\left(t^{\prime }\right)$ denotes the advantage that A has in solving an RLWE problem instance within a polynomial time limit $t^{\prime }$. The adversary A can make at most $q_{H_i}$ (for $i=1,2,3$), $q_{\mathrm{se}}$, and $q_{\mathrm{ex}}$ queries to the hash function $H_i$, Send oracle, and Execute oracle, respectively. Let $T_{\mathit{smul}}$ be the time needed for one component-wise multiplication with a scalar in ${\mathbb{R}}_q$. Then, the following inequality holds:

$${\mathit{Adv}}_{\mathit{Proposed}}^A\left(t\right)\le {\displaystyle \frac{q_{H_1}^2}{2l}}+{\displaystyle \frac{q_{H_2}^2}{2l}}+{\displaystyle \frac{{(q_{\mathrm{ex}}+q_{\mathrm{se}})}^2}{2^l}}+{\displaystyle \frac{q_{H_3}^2}{2^l}}+(q_{\mathit{ex}}+q_{\mathit{se}})·{\mathit{Adv}}_{\mathit{RLWE}}^A\left(t^{\prime }\right),$$

(16)

where

$$t^{\prime }\le t+(2q_{\mathit{ex}}+4q_{\mathit{sc}}+2q_{H_1}+2q_{H_2}+1)·T_{\mathit{smul}}.$$

(17)

Proof. 

Suppose that an adversary A can compromise the semantic security of the session key in the proposed protocol. In such a scenario, a challenger C, executing a PPT algorithm, would be capable of solving an instance of the RLWE problem in $R_q\times R_q$. To demonstrate this, we consider a series of games, ${\mathrm{Game}}_i$ ($0\le i\le 4$), where ${\mathrm{Game}}_0$ represents the real attack [10]. Each ${\mathrm{Game}}_i$ is an interactive simulation between A and C, where C uses a PPT algorithm to correctly respond to oracle queries.

For each game, ${\mathrm{Game}}_i$, an event $X_i$ is defined such that $X_i$ corresponds to A successfully breaching the semantic security of the session key in ${\mathrm{Game}}_i$. Let an event E, independent of $X_i$, occur during the protocol simulation and be detectable by C. The games ${\mathrm{Game}}_i$ and ${\mathrm{Game}}_{i+1}$ are indistinguishable unless event E occurs. Therefore:

$$|Pr\left[X_{i+1}\right]-Pr\left[X_i\right]|\le Pr\left[E\right].$$

(18)

Game 0: This game represents the real attack on the LB-2PAKA protocol in the random oracle model (ROM). In this simulation, A interacts with the protocol oracles as in an actual execution, and the users $P\in U$ execute the protocol as the real execution of the LB-2PAKA protocol in the ROM. Thus:

$${\mathrm{Adv}}_{\mathrm{Proposed}}^A\left(t\right)=\left|Pr\left[X_0\right]-\frac{1}{2}\right|.$$

(19)

Game 1: This game differs from ${\mathrm{Game}}_0$ only in how hash queries are handled. C maintains initially empty hash lists $H_{\mathrm{list}}^j$ ($j=1,2,3$) for tuples $(x,y)$, where x is the hash input, and y is the output. If A queries a hash with input x, C checks $H_{\mathrm{list}}^j$. If x exists, C returns the corresponding y; otherwise, C selects $y\in {\mathbb{Z}}_q$ randomly, updates $H_{\mathrm{list}}^j$, and returns y. The simulations of other oracles remain identical to those in ${\mathrm{Game}}_0$. Hence:

$$Pr\left[X_1\right]=Pr\left[X_0\right].$$

(20)

Game 2: This game differs from ${\mathrm{Game}}_1$ by aborting if collisions are detected in the simulation of $\langle i{d}_i,x_i,w_{i_1},{\alpha }_{i_1}\rangle$, $\langle i{d}_j,x_j,w_{j_1},{\alpha }_{j_1}\rangle$, and $\langle i{d}_j,w_{j_2},{\alpha }_{j_2}\rangle$. By the birthday paradox, the probabilities of collisions in the outputs of oracles $H_1$, $H_2$, and $H_3$ are at most $\frac{q_{H_1}^2}{2l}$, $\frac{q_{H_2}^2}{2l}$, and $\frac{{(q_{\mathrm{sc}}+q_{\mathrm{ex}})}^2}{2^l}$, respectively. Thus:

$$|Pr\left[X_2\right]-Pr\left[X_1\right]|\le {\displaystyle \frac{q_{H_1}^2}{2l}}+{\displaystyle \frac{q_{H_2}^2}{2l}}+{\displaystyle \frac{{(q_{\mathrm{se}}+q_{\mathrm{ex}})}^2}{2^l}}.$$

(21)

Game 3: In this game, A queries $H_3$ with inputs of the form $(\mathrm{sid},{\sigma }_{i_1},{\sigma }_{i_2},{\sigma }_{j_1}^{\prime },{\sigma }_{j_2}^{\prime })$. The probability of correctly guessing the bit b chosen in the Test query of oracle $H_3$ is at most $\frac{q_{H_3}^2}{2^l}$. Thus:

$$|Pr\left[X_3\right]-Pr\left[X_2\right]|\le {\displaystyle \frac{q_{H_3}^2}{2^l}}.$$

(22)

Game 4: This game considers offline guessing attacks, where A attempts to compute the session key $SK$ without interacting with $H_3$. According to the protocol,

$$SK=H_3(\mathrm{sid},{\sigma }_{i_1},{\sigma }_{i_2},{\sigma }_{j_1}^{\prime },{\sigma }_{j_2}^{\prime }),$$

where

$$\mathrm{sid}=(i{d}_i,i{d}_j,x_i,x_j,w_{i_1},w_{j_1},{\alpha }_{i_1},{\alpha }_{j_1}),$$

$${\sigma }_{i_1}={\mathrm{Mod}}_2(t_{i_1},w_{i_1}),{\sigma }_{j_1}^{\prime }={\mathrm{Mod}}_2(t_{j_1},w_{j_1}),$$

$${\sigma }_{i_2}={\mathrm{Mod}}_2(t_{i_2},w_{i_2}),{\sigma }_{j_2}^{\prime }={\mathrm{Mod}}_2(t_{j_2},w_{j_2}).$$

If A can successfully predict $SK$, they solve an RLWE instance in time $t^{\prime }$. Therefore:

$$|Pr\left[X_4\right]-Pr\left[X_3\right]|\le (q_{\mathrm{ex}}+q_{\mathrm{se}})·{\mathrm{Adv}}_{\mathrm{RLWE}}^A\left(t^{\prime }\right).$$

(23)

If A fails to simulate $H_3$ correctly, they gain no advantage in distinguishing the real and random session keys:

$$Pr\left[X_4\right]=\frac{1}{2}.$$

(24)

From the above equations, we have:

$$\begin{array}{cc}\hfill {\mathrm{Adv}}_{\mathrm{Proposed}}^A\left(t\right)& =\left|Pr\left[X_0\right]-\frac{1}{2}\right|=\left|Pr\left[X_0\right]-Pr\left[X_4\right]\right|\hfill \\ \hfill & \le {\displaystyle \frac{q_{H_1}^2}{2l}}+{\displaystyle \frac{q_{H_2}^2}{2l}}+{\displaystyle \frac{{(q_{\mathrm{ex}}+q_{\mathrm{se}})}^2}{2^l}}+{\displaystyle \frac{q_{H_3}^2}{2^l}}+(q_{\mathrm{ex}}+q_{\mathrm{se}})·{\mathrm{Adv}}_{\mathrm{RLWE}}^A\left(t^{\prime }\right).\hfill \end{array}$$

(25)

□

10. Performance Analysis

The efficiency and practicality of the proposed key agreement protocol are crucial for its adoption in real-world post-quantum secure applications. Performance is analyzed in terms of computational cost, communication overhead, and implementation feasibility, particularly on resource-constrained devices such as mobile platforms. This section contains details of various components such as the processor, system type, operating system, and RAM used to analyze the performance of the proposed and relevant protocols. These attributes are very important to derive the computation cost of existing and proposed protocols. A comprehensive performance analysis of the proposed scheme with other relevant schemes is given in

Table 4. Device configuration.

Components	Details
Operating System	Android 13, MIUI 14
Android Version	13 TKQ1.221114.001
CPU	Snapdragon 680, Octa-core Max 2.40GHz
Model	2201117TI
RAM	6.0+2.0 GB
Kernel Version	4.19.157-perf-gcb1ffc010755
Cores	8

. We have considered an ideal-lattice, $n=1024$ bits, Gaussian $log\delta =17.01$, and a large random odd prime $q>2$. This scheme was executed using C/C++ with multi-threading or parallel processing. This analysis has also taken help from some libraries, such as lattice Crypto and MIRACLE, where the server-side laptop’s components are an Intel(R) Core(TM) i5-1035G1 CPU @ 1.00GHz, system x64-based pc, Graphics, NVIDIA GeForce RTX 2060, RAM 8GB, Clock speed 1.00 GHz, Crypto Libraries Miracle, Charm-crypto, NumPy, hash lib, environment Python 3.9.0, Cores 8, and Operating System Linux (ubuntu) (Table 3). The user-side mobile phone’s components are Android 13, MIUI 14, Android Version 13 TKQ1.221114.001, CPU Snapdragon 680, Octa-core Max 2.40GHz, Model 2201117TI, RAM 6.0+2.0 GB, Kernel Version, 4.19.157-perf-gcb1ffc010755, and Cores (8) (

Table 5. Server configuration.

Components	Details
Processor	Intel(R) Core(TM) i5-1035G1 CPU @ 1.00GHz
System Type	x64-based pc
Graphics	NVIDIA GeForce RTX 2060
RAM	8gb
Clock Speed	1.00 GHz
Crypto Libraries	Miracle, Charm-crypto, NumPy, hash lib
Environment	Python 3.9.0
Cores	8
Operating System	Linux(ubuntu)

).

In the context of a cryptographic protocol, the notation of the execution cost typically refers to the computational resources required to execute the protocol, such as time, memory, and communication overhead. Here are some common notations used to denote the execution cost on the server side: ${\tau }_h\approx 13.4577\mathrm{ns}$ for hashing, ${\tau }_{ecca}\approx 10\mathrm{ns}$ for the cost of ECC point addition, ${\tau }_{ecpm}\approx 405\mathrm{ns}$ for the cost of ECC point multiplication, ${\tau }_{Ge}\approx 72.50\mathrm{ns},{\tau }_{smul}\approx 0.2597\mathrm{ns},{\tau }_{pmul}\approx 0.2908\mathrm{ns},{\tau }_{pma}\approx 2.3455\mathrm{ns},{\tau }_{cha}\approx 0.6455\mathrm{ns}$, and ${\tau }_{fe}\approx 405\mathrm{ns}$ for Gaussian sampling, scalar multiplication under $Q_q$, component-wise multiplications under $Q_q$, component-wise multiplications and additions under $Q_q$, and computing the hashing.

Here are some common notations used to denote the execution costs on the user side: ${\tau }_h\approx 178.37\mathrm{ns}$ for hashing, ${\tau }_{ecca}\approx 72\mathrm{ns}$ for the cost of ECC point addition, ${\tau }_{ecpm}\approx 3363\mathrm{ns}$ for the cost of ECC point multiplication, ${\tau }_{Ge}\approx 540.86\mathrm{ns},{\tau }_{smul}\approx 6.3434\mathrm{ns},{\tau }_{pmul}\approx 12.087\mathrm{ns},{\tau }_{pma}\approx 29.7645\mathrm{ns},{\tau }_{cha}\approx 33.3456\mathrm{ns}$, and ${\tau }_{fe}\approx 3363\mathrm{ns}$ for Gaussian sampling, scalar multiplication under $Q_q$, component-wise multiplications under $Q_q$, component-wise multiplications and additions under $Q_q$, and computing the hashing.

As shown in

Table 6. Proposed and relevant scheme’s comparison for computation costs.

Schemes	User Side	Server Side
	Computation Cost	Computation Cost
$\left[A\right]$ [10] Islam et al.	$8{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}$	$4{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}$
$\left[B\right]$ [24] Rana et al.	$7{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}$	$5{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}$
$\left[C\right]$ [32] Dharminder et al.	$8{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}$	$4{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}$
$\left[D\right]$ [7] Feng et al.	$6{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}$	$5{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}$
$\left[E\right]$ [9] Dabra et al.	$8{\tau }_h+3{\tau }_{Ge}+{\tau }_{pmul}+3{\tau }_{pma}+2{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}$	$8{\tau }_h+3{\tau }_{Ge}+{\tau }_{pmul}+3{\tau }_{pma}+2{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}$
$\left[F\right]$ [26] Wang et al.	$8{\tau }_h+3{\tau }_{Ge}+{\tau }_{pmul}+3{\tau }_{pma}+2{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}$	$8{\tau }_h+3{\tau }_{Ge}+{\tau }_{pmul}+3{\tau }_{pma}+2{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}$
$\left[G\right]$ [13] Moony et al.	$4{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}$	$5{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}$
$\left[H\right]$ [14] Seyhan et al.	$4{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}$	$5{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}$
$\left[I\right]$ [15] Pursharthi et al.	$4{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}$	$5{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}$
$\left[J\right]$ [18] Pursharthi et al.	$4{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}$	$5{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}$
$\left[K\right]$ Proposed scheme	$4{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}$	$5{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}$

, we have analyzed that the scheme denoted $\left[A\right]$[10] by Islam et al. takes an execution cost of $8{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}\approx 2824.0939$ on the user side, and $4{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}\approx 220.0092$ on the server side. The scheme denoted by $\left[B\right]$ Rana et al. [24] takes an execution cost of $7{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}\approx 2822.0938$ on the user side, and $5{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}\approx 219.0072$ on the server side. The scheme $\left[C\right]$[32] by Dharminder et al. takes an execution cost of $8{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}\approx 2824.0939$ on the user side, and $4{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}\approx 220.0092$ on the server side. The scheme denoted by $\left[D\right]$ Feng et al. [7] takes an execution cost of $6{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}\approx 2645.7243$ on the user side, and $5{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}\approx 220.0092$ on the server side. The scheme denoted by $\left[E\right]$ Dabra et al. [9] takes an execution cost of $8{\tau }_h+3{\tau }_{Ge}+{\tau }_{pmul}+3{\tau }_{pma}+2{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}\approx 3597.1134$ on the user side, and $8{\tau }_h+3{\tau }_{Ge}+{\tau }_{pmul}+3{\tau }_{pma}+2{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}\approx 337.546$ on the server side. The scheme denoted by $\left[F\right]$ Wang et al. [26] takes an execution cost of $8{\tau }_h+3{\tau }_{Ge}+{\tau }_{pmul}+3{\tau }_{pma}+2{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}\approx 3597.1138$ on the user side, and $8{\tau }_h+3{\tau }_{Ge}+{\tau }_{pmul}+3{\tau }_{pma}+2{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}\approx 337.546$ on the server side. Finally, the scheme denoted by $\left[G\right]$[13] takes the execution cost of $4{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}2288.9851$ on the user side and $5{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}\approx 220.0092$ on the server side. The scheme denoted by $\left[H\right]$[14] Seyhan et al. takes an execution cost of $4{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}\approx 2624.0939$ on the user-side, and $5{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}\approx 220.0092$ on the server side. The scheme $\left[I\right]$[15] takes an execution cost of $4{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}2288.9851$ on the user side, and $5{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}\approx 220.0092$ on the server side. The scheme $\left[J\right]$[18] takes an execution cost of $4{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+2{\tau }_{pma}+{\tau }_{smul}+2{\tau }_{cha}+2{\tau }_{mod}2288.9851$ on the user side, and $5{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}\approx 220.0092$ on the server side. The proposed scheme denoted by $\left[K\right]$ (proposed scheme) takes an execution cost of $4{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}2288.9851$ on the user side, and $5{\tau }_h+2{\tau }_{Ge}+2{\tau }_{pmul}+{\tau }_{pma}+{\tau }_{smul}+{\tau }_{cha}+2{\tau }_{mod}\approx 220.0092$ on the server side (see Figure 3). To compute communication costs (see Figure 4), we have considered the password, and identified each of 128 bits, SHA2-256 bits, and 256 bits for reconciliation. Therefore, we have the communication costs for the proposed as $|x_i|+|w_i|+|ai{d}_i|+|{\alpha }_i|+|x_s|+|w_s|+|{\alpha }_s|=1024+256+256+256+1024+256+256=3328$ bits, and those of $\left[A\right]$ Islam et al. [10], $\left[B\right]$ Rana et al. [24]$\left[C\right]$ Dharminder et al. [32], $\left[D\right]$ Feng et al. [7]$\left[E\right]$ Dabra et al. [9]$\left[F\right]$ Wang et al. [26]$\left[G\right]$[13], $\left[H\right]$ Seyhan et al. [14], $\left[I\right]$[15], [J] [18], and $\left[K\right]$ (proposed scheme) are 3840, 3840, 3840, 3584, 3584, 3840, 3584, 3328, 3428, and 3328 bits, respectively.

11. Conclusions/Future Directions

In the modern landscape of cryptographic security, traditional protocols are increasingly inadequate in the face of emerging quantum threats. The advanced technology forces researchers to shift toward lattice-based cryptographic primitives, which offer strong post-quantum security based on hard mathematical assumptions such as Learning With Errors (LWE) and Short Integer Solution (SIS). This work contains a deep analysis and construction of two-party authenticated key establishment (AKE) and authenticated key transport protocols under lattice-based paradigm. These protocols enable secure and authenticated session key generation between two parties over a public network, while ensuring essential properties such as mutual authentication, forward secrecy, and resistance to man-in-the-middle and key compromise impersonation attacks. Additionally, this technique uses an error reconciliation mechanism and facilitates error-tolerant key agreement and secure key transport. In conclusion, lattice-based authenticated key agreement and transport serve a robust foundation for quantum-secure communication, and their efficiency makes them highly suitable for deployment to secure mobile communications, IoT networks, and mission-critical cyber–physical systems. Despite their robustness, lattice-based protocols still face challenges related to key size, computational overhead, and latency. Future work should target the design of optimized primitives and reconciliation techniques to support real-time communication in bandwidth-limited or low-power environments.