Table 1 Protocol description

1

u ₁

s ₁

u₂, BS, r

2

u ₂

s ₂

u₁, BS, r

3

u ₁

$-s_2^{\ast }$

BS

4

u ₂

$s_1^{\ast }$

BS

5

r

s₁ ⊕ s₂

BS