  The large number of Electronic Control Units (ECUs) mounted on modern cars
and their expansive communication capabilities create a substantial attack
surface for potential exploitation. Despite the evolution of automotive
technology, the continued use of the originally insecure Controller Area
Network (CAN) bus leaves in-vehicle communications inherently non-secure. In
response to the absence of standardized authentication protocols within the
automotive domain, researchers propose diverse solutions, each with unique
strengths and vulnerabilities. However, the continuous influx of new protocols
and potential oversights in meeting security requirements and essential
operational features further complicate the implementability of these
protocols. This paper comprehensively reviews and compares the 15 most
prominent authentication protocols for the CAN bus. Our analysis emphasizes
their strengths and weaknesses, evaluating their alignment with critical
security requirements for automotive authentication. Additionally, we evaluate
protocols based on essential operational criteria that contribute to ease of
implementation in predefined infrastructures, enhancing overall reliability and
reducing the probability of successful attacks. Our study reveals a prevalent
focus on defending against external attackers in existing protocols, exposing
vulnerabilities to internal threats. Notably, authentication protocols
employing hash chains, Mixed Message Authentication Codes, and asymmetric
encryption techniques emerge as the most effective approaches. Through our
comparative study, we classify the considered protocols based on their security
attributes and suitability for implementation, providing valuable insights for
future developments in the field.
