With the rapid development of the Internet of Things (IoT), the widespread adoption of applications such as smart homes and industrial IoT has raised the demand for secure authentication and key agreement among resource-constrained devices over open communication channels. Traditional authentication protocols often rely on centralized servers for key distribution, which results in high communication overhead and exposes systems to single-point-of-failure risks. Moreover, IoT devices are typically constrained in computational resources and are vulnerable to hardware cloning. These limitations necessitate lightweight yet robust security mechanisms. To address these challenges, we propose a lightweight peer-to-peer authentication protocol based on Physically Unclonable Function (PUF) and Multiple Reference Fuzzy Extractor (MRFE). The proposed protocol enables direct mutual authentication and key agreement between IoT devices without the participation of a trusted third-party server. Formal security analysis, along with evaluations of computation and communication costs, demonstrates that the protocol achieves strong security guarantees while maintaining high efficiency. Therefore, the proposed protocol is well-suited for lightweight peer-to-peer authentication scenarios in IoT environments.
Gu et al. (Thu,) studied this question.