Permutation-based lightweight mutual authentication and key agreement protocol: A post-quantum secure design with IoD applicability

Password-based authentication protocols remain prevalent due to their simplicity and compatibility, yet they are increasingly vulnerable in modern and post-quantum threat models. This paper presents a lightweight mutual authentication and key agreement protocol leveraging permutation-based transformations. The protocol enables secure key establishment and mutual legitimacy checking in only three rounds, using a novel construction of session-dependent permutations over secret credentials. Our approach avoids transmitting passwords, incorporates timestamp validation, and resists a wide spectrum of attacks, including man-in-the-middle, relay, and offline guessing. We also demonstrate how the protocol applies to Internet of Drones (IoD) environments, where it supports secure and efficient UAV–GSS authentication. The protocol's security is formally proven through a reduction to the Hidden-Modulus problem, while its minimal 1192-bit communication cost ensures high efficiency for constrained systems.