50 ways to break RFID privacy Ton van Deursen 1 University of - - PowerPoint PPT Presentation

▶
50 ways to break rfid privacy
SMART_READER_LITE
LIVE PREVIEW

50 ways to break RFID privacy Ton van Deursen 1 University of - - PowerPoint PPT Presentation

Mar 11, 2024 21 likes •425 views

50 ways to break RFID privacy Ton van Deursen 1 University of Luxembourg ton.vandeursen@uni.lu 1 Financial support received from the Fonds National de la Recherche (Luxembourg). Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu 50

slide-1
SLIDE 1

50 ways to break RFID privacy

Ton van Deursen1 University of Luxembourg ton.vandeursen@uni.lu

1Financial support received from the Fonds National de la Recherche (Luxembourg). Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 1 / 40

slide-2
SLIDE 2

Outline

Radio frequency identification (RFID) Privacy considerations in RFID RFID layered communication model

Physical layer Communication layer Application layer

Privacy attacks Correlation attack

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 2 / 40

slide-3
SLIDE 3

Radio frequency identification

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 3 / 40

slide-4
SLIDE 4

Radio frequency identification

Key properties of RFID: Wireless technology Cheap technology Unique identifiers No power source needed

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 4 / 40

slide-5
SLIDE 5

RFID in your pocket

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 5 / 40

slide-6
SLIDE 6

RFID in your underwear

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 6 / 40

slide-7
SLIDE 7

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 7 / 40

slide-8
SLIDE 8

RFID research

RFID security research mainly focuses on: Authenticity: is the tag who he claims to be? Proximity: is the tag in my vicinity? Privacy The adversary can Impersonate a reader Impersonate a tag Eavesdrop on messages Block messages Modify messages

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 8 / 40

slide-9
SLIDE 9

Privacy problems

Taken from Ari Juels: RFID Security and Privacy: A research Survey, IEEE Journal on Selected Areas in Communications 24 (2): 381-394 (2006) Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 9 / 40

slide-10
SLIDE 10

Plain identities

Item ID Message sent Wig W125 W125 Replacement hip H123 H123 Das Kapital DK234 DK234 500 euro note FH128 FH128 500 euro note FH129 FH129 500 euro note FH130 FH130 Lingerie L180 L180 Solution: encrypt the identity of the tag

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 10 / 40

slide-11
SLIDE 11

Encrypted identities

Item ID Message sent Wig W125 #5$a7X Replacement hip H123 rB91Ur7x Das Kapital DK234 T3tUM 500 euro note FH128 DX0mbvs 500 euro note FH129 pIFV2y 500 euro note FH130 rny5Lr Lingerie L180 PxXmhJ8uJ Solution: encrypt the identity of the tag

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 11 / 40

slide-12
SLIDE 12

Untraceability

#5$a7X c53Q8 #5$a7X #5$a7X ACD1& time

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 12 / 40

slide-13
SLIDE 13

Untraceability

#5$a7X c53Q8 #5$a7X #5$a7X ACD1& time

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 13 / 40

slide-14
SLIDE 14

Untraceability

#5$a7X c53Q8 #5$a7X #5$a7X ACD1& time

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 14 / 40

slide-15
SLIDE 15

Untraceability

#5$a7X c53Q8 #5$a7X #5$a7X ACD1& time

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 15 / 40

slide-16
SLIDE 16

Untraceability

We call an RFID system untraceable if an adversary cannot recognize a tag he has seen before Untraceability is sometimes called (strong) privacy, indistinguishability, or unlinkability.

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 16 / 40

slide-17
SLIDE 17

RFID stack

  • 3. Application
  • 2. Communication
  • 1. Physical

Tag Reader

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 17 / 40

slide-18
SLIDE 18

RFID communication layers

Physical layer: Transmission of bits

Modulation/demodulation protocols Anti-collision protocols

Communication layer: Cryptographic services

Identification/authentication protocols Key update protocols Distance-bounding protocols

Application layer: RFID application

Data access/interpretation protocols.

Photo on e-passport Building access privileges

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 18 / 40

slide-19
SLIDE 19

Physical layer: Fingerprinting RFIDs

“wake up” “I’m ready”

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 19 / 40

slide-20
SLIDE 20

Physical layer: Fingerprinting RFIDs

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 20 / 40

slide-21
SLIDE 21

Physical layer: Fingerprinting RFIDs

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 21 / 40

slide-22
SLIDE 22

Physical layer: Fingerprinting RFIDs

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 22 / 40

slide-23
SLIDE 23

Physical layer: Fingerprinting RFIDs

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 23 / 40

slide-24
SLIDE 24

Physical layer: Fingerprinting RFIDs

Fingerprinting RFIDs: Only possible in a controlled environment Expensive equipment needed Performance results (Danev et al. 2009): Sample size of 50 “identical” JCOP tags: correct identification in 95% of the cases. Sample size of 8 e-passports: correct identification in 100% of the cases.

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 24 / 40

slide-25
SLIDE 25

Physical layer: UIDs

Anti-collision: Before running communication-layer protocols, the reader and tags performs an anti-collision protocol Anti-collision singles out one tag for communication Tags assume anti-collision identifiers: UIDs (unique identifiers) Unique identifiers are almost always static. And can be read out by anybody with an RFID reader.

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 25 / 40

slide-26
SLIDE 26

RFID reader

Available at www.touchatag.com for EUR 30/$40.

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 26 / 40

slide-27
SLIDE 27

Communication layer: Unique attribute attacks

y, P, x1P, x2P R x1, x2, P, Y = yP T nonce r2 r2 r2 = 0 nonce r1 T1 := r1P T2 := (r1 + x1)Y v := r1x1 + r2x2 T1, T2, v find x1P = y−1T2 − T1 (vP − x1T1)r−1

2

= x2P

Authentication protocol (Lee et al. 2008) Challenge response structure Public-key based Randomized tag responses Design goals: Authentication Untraceability

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 27 / 40

slide-28
SLIDE 28

Communication layer: Unique attribute attacks

y, P, x1P, x2P R x1, x2, P, Y = yP T nonce r2 r2 r2 = 0 nonce r1 T1 := r1P T2 := (r1 + x1)Y v := r1x1 + r2x2 T1, T2, v find x1P = y−1T2 − T1 (vP − x1T1)r−1

2

= x2P

Reader computes: y−1T2 − T1 = (r1 + x1)P − r1P = x1P And verifies: (vP − x1T1)r−1

2

= r1x1P − r1x1P + r2r−1

2 x2P

= x2P

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 28 / 40

slide-29
SLIDE 29

Communication layer: Unique attribute attacks

R T r2 T1, T2, v R T ′ r2 T ′

1, T ′ 2, v′

Question: T

?

= T ′

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 29 / 40

slide-30
SLIDE 30

Communication layer: Unique attribute attacks

R T r2 T1, T2, v R T ′ r2 T ′

1, T ′ 2, v′

T1−T ′

1

v−v′ = (r1−r′

1)P

(r1−r′

1)x1 = x−1

1 P

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 30 / 40

slide-31
SLIDE 31

Communication layer: e-passports

Basic access control protocol

k, k′ reader k, k′ passport GetChallenge nonce NP NP nonce NR, KR r = {NR, NP, KR}k r, MACk′(r) verify MAC and r

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 31 / 40

slide-32
SLIDE 32

Communication layer: e-passports

The passport first verifies the MAC Then it verifies the encryption Verification of the MAC and the encryption takes time.

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 32 / 40

slide-33
SLIDE 33

Communication layer: e-passport

The attacker can (Chothia/Smirnov, 2010): Record a message of a person with passport P he wants to trace Replay that message later to any passport P′ in his vicinity For a passport P = P′ the MAC and encryption will not verify correctly For passport P the MAC will verify correctly, but the encryption will not Therefore, the passport P will take longer to respond with an error message than any other passport P′ = P.

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 33 / 40

slide-34
SLIDE 34

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 34 / 40

slide-35
SLIDE 35

Even if all layers maintain privacy...

Assume all layers are properly protected. And a single tag is not traceable. An attacker can still find out which protocols a tag runs. And figure out the type and brand of a tag

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 35 / 40

slide-36
SLIDE 36

Even if all layers maintain privacy...

Scenario: A store wants to trace their customers Installs an RFID reader at the store entrance Then the store owner can see the amount and types of all tags one carries The following two customers can be easily distinguished: Customer 1’s set of tags: {A, BB, CCCCC, DDD}. Customer 2’s set of tags: {AA, C}.

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 36 / 40

slide-37
SLIDE 37

Even if all layers maintain privacy...

Effectiveness: Increases if the number of tags people carry on them increases Increases if the number of different tags increases Very effective against people with ‘rare’ tags Very hard to counter Question: How does one analyze the privacy loss in this situation?

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 37 / 40

slide-38
SLIDE 38

Conclusion

Summary: RFID layered communication model Taxonomy of traceability attacks

Physical layer:

Fingerprinting RFIDs Unique identities: UIDs

Communication layer:

Unique attribute attacks Passport tracing

Application layer

Correlation attack

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 38 / 40

slide-39
SLIDE 39

Future work

Future work: Analyze privacy loss under correlation attack Find minimal conditions to maintain privacy

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 39 / 40

slide-40
SLIDE 40

. Thank you! http://satoss.uni.lu/ton

Ton van Deursen University of Luxembourg ton.vandeursen@uni.lu () 50 ways to break RFID privacy 40 / 40