Optimal security limits of RFID distance bounding protocols

In this paper, we classify the RFID distance bounding protocols having bitwise fast phases and no final signature. We also give the theoretical security bounds for two specific classes, leaving the security bounds for the general case as an open problem. As for the classification, we introduce the notion of k-previous challenge dependent (k-PCD) protocols where each response bit depends on the current and k-previous challenges and there is no final signature. We treat the case k = 0, which means each response bit depends only on the current challenge, as a special case and define such protocols as current challenge dependent (CCD) protocols. In general, we construct a trade-off curve between the security levels of mafia and distance frauds by introducing two generic attack algorithms. This leads to the conclusion that CCD protocols cannot attain the ideal security against distance fraud, i.e. 1/2, for each challenge-response bit, without totally losing the security against mafia fraud. We extend the generic attacks to 1-PCD protocols and obtain a trade-off curve for 1-PCD protocols pointing out that 1-PCD protocols can provide better security than CCD protocols. Thereby, we propose a natural extension of a CCD protocol to a 1-PCD protocol in order to improve its security. As a study case, we give two natural extensions of Hancke and Kuhn protocol to show how to enhance the security against either mafia fraud or distance fraud without extra cost

A framework for analyzing RFID distance bounding protocols

Many distance bounding protocols appropriate for the RFID technology have been proposed recently. Unfortunately, they are commonly designed without any formal approach, which leads to inaccurate analyzes and unfair comparisons. Motivated by this need, we introduce a unied framework that aims to improve analysis and design of distance bounding protocols. Our framework includes a thorough terminology about the frauds, adversary, and prover, thus disambiguating many misleading terms. It also explores the adversary's capabilities and strategies, and addresses the impact of the prover's ability to tamper with his device. It thus introduces some new concepts in the distance bounding domain as the black-box and white-box models, and the relation between the frauds with respect to these models. The relevancy and impact of the framework is nally demonstrated on a study case: Munilla-Peinado distance bounding protocol

On selecting the nonce length in distance bounding protocols

Distance-bounding protocols form a family of challenge–response authentication protocols that have been introduced to thwart relay attacks. They enable a verifier to authenticate and to establish an upper bound on the physical distance to an untrusted prover.We provide a detailed security analysis of a family of such protocols. More precisely, we show that the secret key shared between the verifier and the prover can be leaked after a number of nonce repetitions. The leakage probability, while exponentially decreasing with the nonce length, is only weakly dependent on the key length. Our main contribution is a high probability bound on the number of sessions required for the attacker to discover the secret, and an experimental analysis of the attack under noisy conditions. Both of these show that the attack’s success probability mainly depends on the length of the used nonces rather than the length of the shared secret key. The theoretical bound could be used by practitioners to appropriately select their security parameters. While longer nonces can guard against this type of attack, we provide a possible countermeasure which successfully combats these attacks even when short nonces are use

Secure & Lightweight Distance-Bounding

Distance-bounding is a practical solution to be used in security-sensitive contexts, mainly to prevent relay attacks. The main challenge when designing such protocols is maintaining their inexpensive cryptographic nature, whilst being able to protect against as many, if not all, of the classical threats posed in their context. Moreover, in distance-bounding, some subtle security shortcomings related to the PRF (pseudorandom function) assumption and ingenious attack techniques based on observing verifiers' outputs have recently been put forward. Also, the recent terrorist-fraud by Hancke somehow recalls once more the need to account for noisy communications in the security analysis of distance-bounding. In this paper, we attempt to incorporate the lessons taught by these new developments in our distance-bounding protocol design. The result is a new class of protocols, with increasing levels of security, accommodating the latest advances; at the same time, we preserve the lightweight nature of the design throughout the whole class

On the Pseudorandom Function Assumption in (Secure) Distance-Bounding Protocols

In this paper, we show that many formal and informal security results on distance-bounding (DB) protocols are incorrect/incomplete. We identify that this inadequacy stems from the fact that the pseudorandom function (PRF) assumption alone, invoked in many security claims, is insufficient. To this end, we identify two distinct shortcomings of invoking the PRF assumption alone: one leads to distance-fraud attacks, whilst the other opens for man-in-the-middle (MiM) attacks. First, we describe –in a more unitary, formal fashion– why assuming that a family of functions classically used inside DB protocols is solely a PRF is unsatisfactory and what generic security flaws this leads to. Then, we present concrete constructions that disprove the PRF-based claimed security of several DB protocols in the literature; this is achieved by using some PRF programming techniques. Whilst our examples may be considered contrived, the overall message is clear: the PRF assumption should be strengthened in order to attain security against distance-fraud and MiM attacks in distance-bounding protocols

Practical & Provably Secure Distance-Bounding

Distance-bounding is a practical solution to be used in security-sensitive contexts, to prevent relay attacks. Its applied cryptographic role is definitely spreading fast and it is clearly far reaching, extending from contactless payments to remote car unlocking. However, security models for distance-bounding are not well-established and, as far as we know, no existing protocol is proven to resist all classical attacks: distance-fraud, mafia-fraud, and terrorist-fraud. We herein amend the latter, whilst maintaining the lightweight nature that makes these protocols appropriate for concrete applications. Firstly, we develop a general formalism for distance-bounding protocols and their security requirements. In fact, we also propose specifications of generalised frauds, stemming from the (attack-prone) multi-party scenarios. This entails our incorporation of newly advanced threats, e.g., distance-hijacking. Recently, Boureanu et al. proposed the SKI protocol. We herein extend it and prove its security. To attain resistance to terrorist-fraud, we put forward the use of a leakage scheme and of secret sharing, which we specialise and reinforce with additional requirements. In view of resistance to generalised mafia-frauds (and terrorist frauds), we further introduce the notion of circular-keying for pseudorandom functions (PRFs); this notion models the employment of a PRF, with possible linear reuse of the key. We also identify the need of PRF masking to fix common mistakes in existing security proofs/claims of distance-fraud security. We then enhance our design such that we guarantee resistance to terrorist-fraud in the presence of noise. To our knowledge, all this gives rises the first practical and provably secure class of distance-bounding protocols, even when our protocols are run in noisy communications, which is indeed the real-life setting of deployed, time-critical cryptographic protocols

Practical and Provably Secure Distance-Bounding

From contactless payments to remote car unlocking, many applications are vulnerable to relay attacks. Distance bounding protocols are the main practical countermeasure against these attacks. In this paper, we present a formal analysis of SKI, which recently emerged as the first family of lightweight and provably secure distance bounding protocols. More precisely, we explicate a general formalism for distance-bounding protocols, which lead to this practical and provably secure class of protocols (and it could lead to others). We prove that SKI and its variants are provably secure, even under the real-life setting of noisy communications, against the main types of relay attacks: distance-fraud and generalised versions of mafia- and terrorist-fraud. To attain resistance to terrorist-fraud, we reinforce the idea of using secret sharing, combined with the new notion of a leakage scheme. In view of resistance to generalised mafia-frauds (and terrorist-frauds), we present the notion of circular-keying for pseudorandom functions (PRFs); this notion models the employment of a PRF, with possible linear reuse of the key. We also identify the need of PRF masking to fix common mistakes in existing security proofs/claims. Finally, we enhance our design to guarantee resistance to terrorist-fraud in the presence of noise

Desarrollo de un sistema exportable de confianza corporativa: Aplicación a entornos de trazabilidad de productos

Cada vez es más habitual que en los procesos de fabricación participen diversos fabricantes y empresas. Por otro lado, una característica de los productos muy valorada hoy en día por los consumidores, es la calidad. Ya no es suficiente con producir barato, sino que cada vez es más importante producir con calidad, siendo ésta un factor diferenciador de las manufacturas que se realizan bajo las diversas marcas. La calidad se está integrando cada vez más en las empresas y en sus procesos productivos y de gestión, como un valor añadido y diferenciador del producto. Es habitual encontrar diversos controles de calidad a lo largo de los procesos de fabricación. Lo que ya no es tan habitual es que se pueda identificar a los operarios encargados del control de calidad. A lo sumo, el encargado del control de calidad final deja algún tipo de identificación (por ejemplo un pequeño adhesivo o etiqueta con un número impreso), pero esta identificación carece de sentido en cuanto el producto entra en otra cadena de producción o llega al comprador. En este escenario, aparece otro factor importante como es la confianza. En los actuales sistemas productivos se deben establecer relaciones de confianza entre las empresas encargadas de las diferentes fases de producción (todas esperan que las demás hagan su trabajo según lo acordado). Además, los agentes designados para verificar la adecuación de los productos a lo esperado en las diversas fases de producción, son depositarios de la confianza de la empresa a la que pertenecen. El objetivo principal de la tesis es el desarrollo de un modelo de confianza corporativa exportable, que sea sencillo y económico de implementar. Para ello, se ha propuesto un sistema confiable de identidad digital de los productos. Es decir, cada producto posee un conjunto de atributos que definen su identidad digital, que lo hace único, pero además, cada uno de estos atributos está avalado por el agente de control que lo verificó, por tanto se puede afirmar que es una identidad de calidad. Con este planteamiento, y con una infraestructura mínima, se pueden integrar en el sistema todos los procesos y compañías involucrados en la cadena de producción, bajo un sello de calidad común: la identidad de calidad del producto. Para comprobar la validez de esta propuesta, se ha realizado una prueba de concepto, integrando este sistema de identidad de calidad en un entorno de trazabilidad alimentaria basada en RFID (identificación por radiofrecuencia). Este prototipo, que sirve para securizar la trazabilidad de un producto cárnico elaborado, se ha realizado sobre la tecnología de etiquetado basada en RFID. Con esta tecnología, y para las condiciones ambientales donde se ha desarrollado el proceso de producción de las piezas a controlar en este caso concreto, el tipo de etiquetas idóneo dispone de una cantidad de memoria extremadamente reducida. Además, debido a que anualmente deben utilizarse cientos de miles de etiquetas, el coste de estas etiquetas debe ser sumamente bajo, por lo que sólo es posible utilizar etiquetas muy sencillas (y por tanto sin capacidades de cálculo). Para poder utilizar este tipo de etiquetas, se ha planteado que las operaciones criptográficas no sean realizadas en la etiqueta, sino en un sistema externo basado en una Infraestructura de Clave Pública (PKI), de manera que la etiqueta sólo sirve como soporte de datos en texto plano (sin cifrar), pero firmados electrónicamente. Para resolver el problema del poco espacio de memoria disponible para las firmas de los diferentes agentes de control, se ha recurrido a la utilización de firmas agregadas. Además, al trabajar con criptografía de curvas elípticas, el tamaño de la firma es notablemente menor, para un mismo nivel de seguridad, que el de otros sistemas. Adicionalmente, el sistema propuesto permite transferir la confianza entre las compañías implicadas en un proceso de producción (basta compartir las claves públicas de los firmantes y sus nombres), y se adapta a cualquier entorno productivo. Por todo ello, el sistema propuesto resuelve de forma eficaz la integración de diversas empresas en el proceso de fabricación de un producto, con escaso coste, y permitiendo una verificación de la identidad digital en cualquier parte del proceso, incluida la fase de comercialización

Secure Neighbor Discovery and Ranging in Wireless Networks

This thesis addresses the security of two fundamental elements of wireless networking: neighbor discovery and ranging. Neighbor discovery consists in discovering devices available for direct communication or in physical proximity. Ranging, or distance bounding, consists in measuring the distance between devices, or providing an upper bound on this distance. Both elements serve as building blocks for a variety of services and applications, notably routing, physical access control, tracking and localization. However, the open nature of wireless networks makes it easy to abuse neighbor discovery and ranging, and thereby compromise overlying services and applications. To prevent this, numerous works proposed protocols that secure these building blocks. But two aspects crucial for the security of such protocols have received relatively little attention: formal verification and attacks on the physical-communication-layer. They are precisely the focus of this thesis. In the first part of the thesis, we contribute a formal analysis of secure communication neighbor discovery protocols. We build a formal model that captures salient characteristics of wireless systems such as node location, message propagation time and link variability, and we provide a specification of secure communication neighbor discovery. Then, we derive an impossibility result for a general class of protocols we term "time-based protocols", stating that no such protocol can provide secure communication neighbor discovery. We also identify the conditions under which the impossibility result is lifted. We then prove that specific protocols in the time-based class (under additional conditions) and specific protocols in a class we term "time- and location-based protocols," satisfy the neighbor discovery specification. We reinforce these results by mechanizing the model and the proofs in the theorem prover Isabelle. In the second part of the thesis, we explore physical-communication-layer attacks that can seemingly decrease the message arrival time without modifying its content. Thus, they can circumvent time-based neighbor discovery protocols and distance bounding protocols. (Indeed, they violate the assumptions necessary to prove protocol correctness in the first part of the thesis.) We focus on Impulse Radio Ultra-Wideband, a physical layer technology particularly well suited for implementing distance bounding, thanks to its ability to perform accurate indoor ranging. First, we adapt physical layer attacks reported in prior work to IEEE 802.15.4a, the de facto standard for Impulse Radio, and evaluate their performance. We show that an adversary can achieve a distance-decrease of up to hundreds of meters with an arbitrarily high probability of success, with only a minor cost in terms of transmission power (few dB). Next, we demonstrate a new attack vector that disrupts time-of-arrival estimation algorithms, in particular those designed to be precise. The distance-decrease achievable by this attack vector is in the order of the channel spread (order of 10 meters in indoor environments). This attack vector can be used in previously reported physical layer attacks, but it also creates a new type of external attack based on malicious interference. We demonstrate that variants of the malicious interference attack are much easier to mount than the previously reported external attack. We also provide design guidelines for modulation schemes and devise receiver algorithms that mitigate physical layer attacks. These countermeasures allow the system designer to trade off security, ranging precision and cost in terms of transmission power and packet length