SLIDE 1
Pervasive Devices
- Pervasive Devices:
- Low memory, few gates
- Low power, no clock, little state
- Low computational power
- Billions of pervasive devices are deployed.
- Billions on the way.
Pervasive Devices Pervasive Devices: Low memory, few gates Low - - PowerPoint PPT Presentation
Pervasive Devices Pervasive Devices: Low memory, few gates Low - - PowerPoint PPT Presentation
Authenticating Pervasive Devices with Human Protocols Ari Juels Stephen A. Weis RSA Laboratories MIT CSAIL Pervasive Devices Pervasive Devices: Low memory, few gates Low power, no clock, little state Low computational power
SLIDE 2
SLIDE 3
Example Technologies
SLIDE 4
“Billions and Billions...”
- Supply chain management, inventory control
- Payment systems, building access
- Prescription drug shipments
- Retail checkout
- Luxury goods
- Currency
Authenticating devices is a growing concern.
SLIDE 5
Attacks
- Skimming: Reading legitimate tag data to
produce fraudulent clones.
- Swapping: Steal RFID-tagged products
then replace with counterfeit-tagged decoys.
- Denial of Service: Seeding a system with
fake, but authentic acting tags.
SLIDE 6
Related Work
- Low-Cost Access Control:
[SWE02], [WSRE03], [OSK04]
- Pervasive Privacy:
[JP03], [JRS03], [Avoine04], [MW04]
- Human Authentication: [HB01]
SLIDE 7
Our Contribution
- A new authentication protocol that handles
active malicious attacks.
- Extremely hardware-efficient
- Secure under same assumption as [HB01]
SLIDE 8
Hopper-Blum Authentication
Bob(x,η) Computer(x) ν ∈R {0,1} z=(a⋅x)? a ∈ {0,1}k
Challenge
z=(a⋅x)⊕ν
Response
Repeat for q rounds. Authenticate Bob if he passes > (1-η)q rounds.
SLIDE 9
Security Against Bad Bob
Adversary Computer(x) a ∈ {0,1}k
Challenge Guess Response
z=(a⋅?)
SLIDE 10
Security Against Passive Eavesdroppers
Bob(x,η) Computer(x) ν ∈R {0,1} (a0,z0), (a1,z1), ..., (aq,zq)
Eavesdropper
Find an x’ that allows you to answer a (1-η) fraction of a challenges
SLIDE 11
- Crypto and learning problems: [BFKL93]
- LPN algorithm: [BKW03]
- Shortest
Vector Problem reduction: [Regev05]
Learning Parity with Noise (LPN)
O(2
k lg k )
SLIDE 12
Concrete Security
Key Size (k) Best Attack 64 235 128 256 192 272 224 280 256 288 288 296
Obligatory grain of salt →□
SLIDE 13
Active Attack against HB
Bob(x,η) z0=(a’⋅x)⊕ν0 a’ = 000...001 zn=(a’⋅x)⊕νn a’
...
Adversary takes majority of zi values to get noise-free parity bit
Adversary
SLIDE 14
ν ∈R {0,1}
Our New Protocol: HB+
z=(a⋅x)⊕(b⋅y)⊕ν z=(a⋅x)⊕(b⋅y)? a ∈ {0,1}k Tag(x, y,η) Reader(x, y) b ∈ {0,1}k
Challenge Response Blinding Factor
SLIDE 15
Security Against Bad Bob
Adversary Reader(x, y) z=(a⋅?)⊕(b’⋅?) a b’
Challenge Guess Response Malicious Blinding Factor
SLIDE 16
ν ∈ {0,1}
Security against Active Attacks
z=(a’⋅x)⊕(b⋅y)⊕ν a’ Tag(x, y,η) b
Malicious Challenge Response Blinding Factor
Adversary
SLIDE 17
Skewing Randomness
What if the adversary can skew a tag’s random number generator? All bets are off!
Tag Adversary
SLIDE 18
Future Work
- Two-round or parallel HB+
- Random Number Generation
- Underlying hardness of LPN
- Adapting other HumanAuth protocols
(Rump Session)
SLIDE 19
Questions?
Ari Juels ajuels@rsasecurity.com www.ari-juels.com Stephen Weis sweis@mit.edu crypto.csail.mit.edu/~sweis
SLIDE 20
Detection Security Model
Adversary Reader
Failed Authentications