Cryptanalysis on a Portable Privacy-Preserving Authentication and Access Control Protocol in VANETs

Recently, Yeh et al. proposed a portable privacy-preserving authentication and access control protocol, named PAACP, for non-safety applications in vehicular ad hoc networks. PAACP not only accomplishes authentication, key establishment and privacy preservation, but also considers the scalability and differentiated service access control issues in the protocol design. However, this causes some security flaws. Our results show that PAACP is insecure against privilege elevation attack. In this attack, any two or more vehicles can conspire to elevate access privileges for desired Internet services.