With the advent of the internet, Voice over Internet Protocol (VoIP) has obtained a considerable amount of attention due to its low cost, and ease of implementation. Similar to other emerging technologies, VoIP faces several challenges, including security in terms of confidentiality, integrity, and authenticity. Specifically, there is a need for secure and efficient authentication and key agreement scheme to address the security requirements of communications over VoIP networks. Recently, Ravanbakhsh et al. have presented an authentication and key agreement protocol for VoIP networks. Here, in this article, we first prove that Ravanbakhsh et al.’s scheme cannot provide perfect forward secrecy. Next, we present an elliptic curve cryptography- based secure two-factor authentication and key agreement scheme. We analyze the security of the proposed scheme informally, and demonstrate that the proposed scheme can provide different security features, including perfect forward secrecy, and is robust against security attacks such as the impersonation attack, the replay attack, and the stolen-verifier attack. Furthermore, we simulate the protocol and analyze its security formally using Scyther tool. The results show its robustness against different attacks, and its ability to provide perfect forward secrecy. We compare the computation cost of the proposed scheme with the related schemes. Results show that the proposed scheme achieves a satisfiable performance comparable to other ECC-based methods.

Keywords