November 16, 2017 Gildas Avoine Loc Ferreira Rescuing LoRaWAN 1.0 - - PowerPoint PPT Presentation

▶
november 16 2017 gildas avoine lo c ferreira rescuing
SMART_READER_LITE
LIVE PREVIEW

November 16, 2017 Gildas Avoine Loc Ferreira Rescuing LoRaWAN 1.0 - - PowerPoint PPT Presentation

Jun 26, 2023 325 likes •567 views

November 16, 2017 Gildas Avoine Loc Ferreira Rescuing LoRaWAN 1.0 Workshop CRYPTACUS 1 Internet of Things 20 billion internet-connected things by 2020 [Gartner] Main domains smart home (Zigbee, Z-Wave, BLE, DECT ULE,

slide-1
SLIDE 1

1

Rescuing LoRaWAN 1.0

Workshop CRYPTACUS

November 16, 2017 Gildas Avoine Loïc Ferreira

slide-2
SLIDE 2

2

Internet of Things

  • 20 billion internet-connected things by 2020 [Gartner]
  • Main domains

– smart home (Zigbee, Z-Wave, BLE, DECT ULE, Thread, etc.) – eHealth – industrial IoT => allegedly the largest volume of things the most sensitive use cases

slide-3
SLIDE 3

3

Internet of Things

  • 20 billion internet-connected things by 2020 [Gartner]
  • Main domains

– smart home (Zigbee, Z-Wave, BLE, DECT ULE, Thread, etc.) – eHealth – industrial IoT => allegedly

  • A proposal for industrial IoT: LoRa (communication layer) & LoRaWAN (security layer)
  • Originally conceived by Semtech (Cycleo). Now promoted by LoRa Alliance.
  • Deployed in more than 50 countries worldwide: USA (100 cities), Japan, China (300 million people),

India (400 million people), France, Netherlands, South Africa, etc.

  • Use cases: temperature monitoring, presence detection, remote device on/off switch, etc.
  • Current deployed version: v1.0 (this talk).

the largest volume of things the most sensitive use cases

source: http://iot.semtech.com, 17/05/17 Ascoel, IR868LR - IRUS915LR nke Watteco, Smart Plug nke Watteco, Sens’O

slide-4
SLIDE 4

4

Architecture

Network Server End-devices Application Server Gateway

slide-5
SLIDE 5

5

Key exchange

Network Server (MK) Application Server End-device (MK) req ans

slide-6
SLIDE 6

6

1. rndC  {0,1}16 2. τC = MACMK(idAS | idC | rndC) 3. req = idAS | idC | rndC | τC

Key exchange

Network Server (MK) Application Server End-device (MK) req ans

slide-7
SLIDE 7

7

1. rndC  {0,1}16 2. τC = MACMK(idAS | idC | rndC) 3. req = idAS | idC | rndC | τC 4. check req 5. rndS  {0,1}24 6. τS = MACMK(rndS | idS | addr | prms) 7. ans = AES-1

MK(rndS | idS | addr | prms | τS)

Key exchange

Network Server (MK) Application Server End-device (MK) req ans

8. check ans

slide-8
SLIDE 8

8

1. rndC  {0,1}16 2. τC = MACMK(idAS | idC | rndC) 3. req = idAS | idC | rndC | τC 4. check req 5. rndS  {0,1}24 6. τS = MACMK(rndS | idS | addr | prms) 7. ans = AES-1

MK(rndS | idS | addr | prms | τS)

Key exchange

Network Server (MK) Application Server End-device (MK) req ans

Data encryption key Ke = ENCMK(01 | v) Data integrity key Ki = ENCMK(02 | v) with v = rndS | idS | rndC | 00..00 8. check ans

slide-9
SLIDE 9

9

Secure channel

Network Server (MK) Application Server End-device (MK) data confidentiality (Ke) data integrity (Ki) Ke, Ki Ke, Ki Ke

  • Application frame
  • Network frame

hdr [pld]Ke τ hdr [pld]Ki τ

Ki Ki

slide-10
SLIDE 10

10

  • Encryption: based on AES CCM

– Aj (16) = 01 | 00…00 | dir | addr (4) | cnt (4) | 00 | j (1) – Sj = AESK(Aj) with K = – ctxt = pld (S0 | .. | Sn-1)

Secure channel

Network Server (MK) Application Server End-device (MK) data confidentiality (Ke) data integrity (Ki) Ke, Ki Ke, Ki Ke

Ke if application data Ki if network data

  • Application frame
  • Network frame

hdr [pld]Ke τ hdr [pld]Ki τ

Ki Ki

slide-11
SLIDE 11

11

  • MAC: AES CMAC

– B0 (16) = 49 | 00…00 | dir | addr (4) | cnt (4) | 00 | len (1) – τ = MACKi(B0 | hdr | ctxt)

  • Message: hdr | [pld]K | τ
  • Encryption: based on AES CCM

– Aj (16) = 01 | 00…00 | dir | addr (4) | cnt (4) | 00 | j (1) – Sj = AESK(Aj) with K = – ctxt = pld (S0 | .. | Sn-1)

Secure channel

Network Server (MK) Application Server End-device (MK) data confidentiality (Ke) data integrity (Ki) Ke, Ki Ke, Ki Ke

Ke if application data Ki if network data

  • Application frame
  • Network frame

hdr [pld]Ke τ hdr [pld]Ki τ

Ki Ki

slide-12
SLIDE 12

12

Attack: end-device disconnection

Network Server (MK) End-device (MK) rndC = x rndS = y* rndC = x rndS = y

  • Ke* = ENCMK(01 | v*)

Ki* = ENCMK(02 | v*) with v* = y* | idS | x | 00..00

  • Ke = ENCMK(01 | v)

Ki = ENCMK(02 | v) with v = y | idS | x | 00..00

slide-13
SLIDE 13

13

Attack: end-device disconnection

Network Server (MK) End-device (MK) rndC = x rndS = y* rndC = x rndS = y

  • Ke* = ENCMK(01 | v*)

Ki* = ENCMK(02 | v*) with v* = y* | idS | x | 00..00

  • Ke = ENCMK(01 | v)

Ki = ENCMK(02 | v) with v = y | idS | x | 00..00

  • The end-device is “disconnected”.
  • The NS cannot initiate a new session.
  • The end-device may not expect replies

from the NS.

LoRaWAN 1.0.2 specification, §4.3.1.1, p. 17

slide-14
SLIDE 14

14

  • Ke = ENCMK(01 | v)

Ki = ENCMK(02 | v) with v = rndS | idS | rndC | 00..00

  • Aj (16) = 01 | 00…00 | dir | addr (4) | cnt (4) | 00 | j (1)

Sj = AESK(Aj) ctxt = pld (S0 | .. | Sn-1)

  • B0 (16) = 49 | 00…00 | dir | addr (4) | cnt (4) | 00 | len (1)

τ = MACKi(B0 | hdr | ctxt)

Attack: replay or decrypt

1. Replay of ans = AES-1

MK(rndS | idS | addr | prms | τS)

2. Reuse of rndC => Reuse of Ke, Ki, Aj, B0

slide-15
SLIDE 15

15

Attack: replay or decrypt

  • Consequences

– (downlink) frame replay – (uplink) frame decryption: ctxt = pld S ctxt’ = pld’ S ctxt ctxt’ = pld pld’

slide-16
SLIDE 16

16

Attack: replay or decrypt

  • Pr[hit] = 2-16
  • With n previous ans messages, Pr[hit] ≈ n.2-16 = p
  • The attacker iterates k times: Pr[success] = 1 – (1 – p)k ≈ k.p
  • Complexity: k ≈ 216/n to get Pr[success] ≈ 1
  • 8 s/key exchange => 9.1 hours (with n = 16)
  • Consequences

– (downlink) frame replay – (uplink) frame decryption: ctxt = pld S ctxt’ = pld’ S ctxt ctxt’ = pld pld’

End-device (MK) rndC = x0, x1, …, xk rndS = *, *, …, yk

slide-17
SLIDE 17

17

Attack: replay or decrypt

  • Pr[hit] = 2-16
  • With n previous ans messages, Pr[hit] ≈ n.2-16 = p
  • The attacker iterates k times: Pr[success] = 1 – (1 – p)k ≈ k.p
  • Complexity: k ≈ 216/n to get Pr[success] ≈ 1
  • 8 s/key exchange => 9.1 hours (with n = 16)
  • Consequences

– (downlink) frame replay – (uplink) frame decryption: ctxt = pld S ctxt’ = pld’ S ctxt ctxt’ = pld pld’

End-device (MK) rndC = x0, x1, …, xk rndS = *, *, …, yk

  • Remark on the duty cycle

– Not a security mechanism – Not applied in all countries – Not verified through the LoRa Alliance certification process

LoRa Alliance End Device Certification Requirements for EU 868MHz ISM Band Devices,

  • D. Hunt, N. Jouko, M. Ridder, v1.2, 2016
slide-18
SLIDE 18

18

Attack: targetting the NS

  • Disconnection and “replay or decrypt” doable against the NS.
  • Disconnection

– The NS must keep track of a “certain number” of previous req messages. => Use of “forgotten” or “unknown” req messages.

  • “Replay or decrypt”

– |rndS| = 24 bits => Pr[hit] ≈ 2-24 – addr is “arbitrarily” generated => Pr[hit] ≈ 2-49 – The attacker chooses rndC first (then the NS replies). – Use of n req messages: Pr[success] ≈ n/224 (if addr is unchanged)

  • Consequences

– (uplink) frame replay – (downlin) frame decryption

Network Server (MK) req ans [matches with req?]

slide-19
SLIDE 19

19

Lack of data integrity

  • Encryption in CTR mode

– Change plaintext by flipping ciphertext bits => end-device or AS is deceived – Truncate encrypted payload => hide information from end-device or AS – Possible payload decryption under assumptions (easier in uplink direction)

Network Server Application Server End-device data confidentiality data integrity no data integrity no data integrity MQTT server

slide-20
SLIDE 20

20

Recommendations

  • Constraints: keep interoperability between patched and unmodified equipment
  • rndS replaced with 24-bit counter (1 counter per end-device)
  • addr = H(rndC | rndS | idC)
  • Key confirmation by NS (using an existing LoRaWAN command)
  • Provide end-to-end data integrity (application layer)
slide-21
SLIDE 21

21

Conclusion

  • Low cost security => low power attacks
  • LoRaWAN 1.0 published without security analysis
  • Upcoming version: v1.1 (includes some recommendations related to v1.0)
  • LoRa Alliance: call for a public review of LoRaWAN 1.1 from the academic community
slide-22
SLIDE 22

22

Thank you

slide-23
SLIDE 23

23

References [LoRaWAN1.0] N. Sornin, M. Luis, T. Eirich, T. Kramp, O. Hersent. LoRaWAN Specification (Jul 2016),

LoRa Alliance, version 1.0.2 [Gartner] Mark Hung (ed.). Leading the IoT – Gartner Insights on How to Lead in a Connected World, Gartner, 2017. https://www.gartner.com/imagesrv/books/iot/iotEbook_digital.pdf