SLIDE 1 Ton van Deursen (1/12)
Insider attacks and RFID Privacy models
Ton van Deursen and Saša Radomirovi´ c
{ton.vandeursen, sasa.radomirovic}@uni.lu University of Luxembourg Financial support received from the Fonds National de la Recherche (Luxembourg)
SLIDE 2
Ton van Deursen (2/12)
Overview
In an insider attack the adversary uses a tag that is fully under his control. His goal is to break the privacy/security of some other tag. Insider attacks are relevant in public-key based proto- cols.
SLIDE 3
Ton van Deursen (3/12)
Randomized Schnorr protocol
y, P, xP R x, P, yP T a, b ∈R Z c ∈R Z aP, byP c r = a + b + x · c find xP
xP = (rP − aP − byP · y−1)c−1
SLIDE 4
Ton van Deursen (4/12)
Man-in-the-middle attack
y, P, xP R E x, P, yP T a, b ∈R Z c ∈R Z aP, byP aP + Ma, byP + Mb c c r = a + b + x · c r = a + b + x · c + Mr find xP
SLIDE 5 Ton van Deursen (5/12)
Man-in-the-middle attack
Adversarial strategy:
■ Observe two runs of a protocol for tags x and x′: aP, byP, c, r
and a′P, b′yP, c′, r′.
■ Compute Ma, Mb and Mr. ■ Perform man-in-the-middle attack: if the reader accepts the tag
x = x′ otherwise x = x′. Ma, Mb and Mr need to satisfy:
■ Ma = ca′P + c′aP ■ Mb = c′byP + cb′yP ■ Mr = c′r − cr′ = (c′a − ca′) + (c′b − cb′) + (xcc′ − x′c′c)
SLIDE 6
Ton van Deursen (6/12)
Why does this work?
RFID security requires that the reader accepts a legit- imate tag only if the reader and tag have a matching conversation. The randomized Schnorr protocol does not satisfy se- curity.
SLIDE 7
Ton van Deursen (7/12)
Randomized Schnorr protocol (hardened)
y, P, xP R x, P, yP T a, b ∈R Z c ∈R Z aP byP c r = a + b + x · c h(aP, byP, c, r, xyP) find xP
SLIDE 8
Ton van Deursen (8/12)
Randomized Schnorr protocol (hardened)
The hardened randomized Schnorr protocol satisfies security due to the hash function. The man-in-the-middle attack is no longer possible since the attacker does not know xyP. An insider can compute the hash and can therefore still perform the attack.
SLIDE 9
Ton van Deursen (9/12)
Implications
Vaudenay’s adversary classes: w-strong ⇒ w-destructive ⇒ w-forward ⇒ w-weak ⇓ ⇓ ⇓ ⇓ n-strong ⇒ n-destructive ⇒ n-forward ⇒ n-weak A wide attacker can observe whether a protocol run ended successfully.
SLIDE 10 Ton van Deursen (10/12)
Implications
Vaudenay’s lemma (2007) still holds:
■ Narrow-weak privacy + security ⇒ wide-weak. ■ Narrow-forward privacy + security ⇒ wide-forward.
Ng et al’s theorems (2008) no longer hold:
■ Narrow-destructive privacy + security ⇒ wide-destructive. ■ Narrow-strong privacy + security ⇒ wide-strong.
SLIDE 11 Ton van Deursen (11/12)
Conclusions
Conclusions:
■ There exist protocols that are vulnerable to insider attacks. ■ Insider attacks are only relevant for public-key protocols.
Future work:
■ Adapt privacy models for insider attacks. ■ Find minimal conditions for absence of insider attacks.
SLIDE 12
Ton van Deursen (12/12)
Thank you!
http://satoss.uni.lu/ton/
