Cryptanalysis of PiLike: An Impersonation Attack on the Lightweight Identity-Based Authenticated Key Exchange Protocol Using Bi-ISIS

The proliferation of Industrial Internet of Things (IIoT) devices, coupled with their computational constraints, has necessitated robust authenticated key exchange mechanisms to secure communications. To address this issue, Gupta recently introduced a lattice-based lightweight authenticated key exchange protocol, PiLike, in the IEEE Systems Journal. Despite rigorous security proofs being provided, our cryptanalysis unveils a critical vulnerability in their scheme which may cause impersonation attacks. Specifically, in the private key extraction phase, an adversary can leverage secret information obtained during registration to impersonate legitimate users, successfully negotiating session keys while evading detection. In addition to the theoretical analysis, a corresponding concrete experiment was also conducted, showing that the adversary has a 100% success rate in breaking the required security claimed in PiLike. Our findings underscore the urgency to address PiLike's vulnerabilities, ensuring its reliability in safeguarding IIoT communications against conventional and quantum threats.