Wide Strong Private RF IDentification based on Zero-Knowledge Roel - PowerPoint PPT Presentation

Wide Strong Private RF IDentification based on Zero-Knowledge Roel Peeters and Jens Hermans Provable Privacy Workshop, 10 July 2012

RFID Privacy Wig model #4456 (cheap polyester) Replacement hip medical part #459382 Das Kapital and Communist-party handbook 500 Euros in wallet Serial numbers: 597387,389473… 30 items of lingerie

RFID Privacy 41126751 Wig model #4456 (cheap polyester) 93479122 Replacement hip medical part #459382 Das Kapital and 54872164 Communist-party handbook 500 Euros in wallet 55542390 Serial numbers: 09840921 597387,389473… 30 items of lingerie

RFID Privacy Model Weak Adversary DrawTag SendTag SendReader FreeTag ! Result

RFID Privacy Model Forward Adversary DrawTag SendTag SendReader Corrupt FreeTag ! Result

RFID Privacy Model Forward Adversary Secret

RFID Privacy Model Strong Adversary DrawTag SendTag SendReader Corrupt FreeTag ! Result

RFID Privacy Model Strong Adversary DrawTag SendTag SendReader Secret FreeTag ! Result

Private Identification Protocol ! Requirements } ! Correct Should not be neglected ! ! Sound ! Private Not sound Not correct

Design Goals ! RFID Identification protocol that is: ! Secure ! Wide-strong private ! Efficient ! Compact hardware

Design Goals ! Secure, wide-strong private protocols require Public Key Cryptography ! Elliptic Curve Cryptography coprocessor can be implemented on RFID [LBSV’07] [WH’11] ! Limit the number of cryptographic building blocks, e.g. ideally no hash functions

Secure, wide-strong protocols ! Two known protocols: ! Vaudenay’s Public Key Encryption ! Canard et al.’s Hashed ElGamal ! Both based on (variant) IND-CCA2

Vaudenay’s Public Key Encryption Tag ( ID, K, PK ) Reader ( sk, DB ) a DHIES 2 EC mult IND-CCA2 1 Hash b = ENC PK (ID !! K !! a) 1 MAC 1 symm enc ID* !! K* !! a* = DEC sk (b) a* == a " (ID*, K*) # DB ?

Canard et al.’s Hashed ElGamal Tag ( ID, K, Y ) Reader ( y, DB ) a 2 EC mult T 0 = MAC K (a !! b) 1 Hash T 1 = (T 0 !! ID !! b) $ H(rY) 1 MAC T 2 = rP T 1 , T 2 T 0 * !! ID* !! b* = T 1 $ H(rT 2 ) ID* # DB ? T 0 = MAC K* (a !! b*)?

Randomized Schnorr Tag ( x, Y ) Reader ( y, DB ) R 1 = r 1 P, R 2 = r 2 Y e s = ex + r 1 + r 2 X* = e -1 (sP - R 1 - y -1 R 2 ) # DB ?

Randomized Schnorr not wide-weak Tag ( x, Y ) Reader ( y, DB ) R 1 , R 2 , e, s R 1 = r 1 P, R 2 = r 2 Y R 1 + R 1 , R 2 + R 2 e - e e s = (e - e)x + r 1 + r 2 s + s = ex + r 1 + r 1 + r 2 + r 2 X* = e -1 (s*P - R 1 * - y -1 R 2 *) # DB ? result

Randomized Hashed GPS Tag ( x, Y ) Reader ( y, DB ) R 1 = r 1 P, R 2 = r 2 Y h = H(R 1 ,R 2 ) e R 1 , R 2 , s = ex + r 1 + r 2 h = H(R 1 ,R 2 ) " X* = e -1 (sP - R 1 - y -1 R 2 ) # DB ?

Randomized Hashed GPS not wide-strong Tag ( x, Y ) Reader ( y, DB ) x h = H(R 1 ,R 2 ) h e - 1 e R 1 , R 2 , s = (e-1)x + r 1 + r 2 R 1 , R 2 , s + x = ex + r 1 + r 2 h = H(R 1 ,R 2 ) " X* = e -1 (sP - R 1 - y -1 R 2 ) # DB ? result

New Protocol Tag ( x, Y ) Reader ( y, DB ) R 1 = r 1 P, R 2 = r 2 P e d = x-coord(x-coord( r 2 Y ) P ) s = dx + er 1 d* = x-coord(x-coord( yR 2 ) P ) X* = d* -1 (sP - eR 1 ) # DB ?

New Protocol Tag ( x, Y ) Reader ( y, DB ) R 1 = r 1 P, R 2 = r 2 P e One More Discrete Logarithm, just like Schnorr d = x-coord(x-coord( r 2 Y ) P ) s = dx + er 1 d* = x-coord(x-coord( yR 2 ) P ) X* = d* -1 (sP - eR 1 ) # DB ?

New Protocol Tag ( x, Y ) Reader ( y, DB ) R 1 = r 1 P, R 2 = r 2 P e Diffie Hellman One More Discrete Logarithm, just like Schnorr d = x-coord(x-coord( r 2 Y ) P ) s = dx + er 1 d* = x-coord(x-coord( yR 2 ) P ) X* = d* -1 (sP - eR 1 ) # DB ?

New Protocol Tag ( x, Y ) Reader ( y, DB ) R 1 = r 1 P, R 2 = r 2 P e Diffie Hellman One More Discrete Logarithm, just like Schnorr d = x-coord(x-coord( r 2 Y ) P ) s = dx + er 1 Oracle Diffie Hellman d* = x-coord(x-coord( yR 2 ) P ) ECC-based, no hash to X* = d* -1 (sP - eR 1 ) # DB ? keep HW design compact

More Efficient Variant Tag ( x, Y ) Reader ( y, DB ) R = rP e d = x-coord( rY ) s = dx + er d* = x-coord( yR ) X* = d* -1 (sP - eR) # DB ?

Conclusions ! Proven security and wide-strong privacy ! Efficient : only 2 EC multiplications ! Compact HW: no hash function

Full paper on ePrint ! http://eprint.iacr.org/2012/389