RFID Authentication and Time-Memory Trade-Offs
Total Page:16
File Type:pdf, Size:1020Kb
RFID Authentication and Time-Memory Trade-offs Xavier Carpent Thesis submitted in partial fulfillment of the requirements for the Degree of Doctor in Engineering Sciences March 18, 2015 Institute of Information and Communication Technologies, Electronics and Applied Mathematics (ICTEAM) Louvain School of Engineering (EPL) Universit´ecatholique de Louvain (UCL) Louvain-la-Neuve Belgium Examining board Prof. Gildas Avoine, Supervisor UCL, Belgium Prof. Olivier Periera, Secretary UCL, Belgium Prof. Olivier Markowitch ULB, Belgium Prof. Bart Preneel KUL, Belgium Dr. Philippe Oechslin EPFL, Switzerland Prof. Peter Van Roy, Chair UCL/, Belgium Abstract Two areas have been explored during this thesis: RFID authentication, and cryptanalytic time- memory tradeoffs. Radio Frequency IDentification (or RFID) is a technology that allows identification and authen- tication of objects or persons through the use of wireless communication between tags and readers. RFID Tags are small devices that are comprised of an antenna (for receiving/transmitting data) and a chip. Although exceptions exist (e.g. passports, etc.), tags are generally inexpensive and moderately powerful in terms of computation, and most of the time rely on the electro-magnetic field provided by the reader for energy supply. Readers on the other hand are more expensive devices that have a computational power comparable to a PC. The RFID technology is very widespread nowadays, and it continues to grow rapidly. However, due to the high requirements (secure authentication, respect of privacy, speed of authentication, etc.) and specific constraints (asymmetric system, inexpensive tags, wireless communication, etc.), there are many challenges regarding its security. Mostly two have been studied in this thesis: ultralightweight authentication (authentication protocols dedicated to extremely low-end tags where classical crypto is deemed too expensive) and the complexity/privacy tradeoff (protecting privacy makes the task of read- ers very time-consuming). In the former, our results are mostly cryptanalytic, and in the latter where, it seems, no perfect solution exists, our results are mainly analytical and comparative (the OSK/AO protocol in particular achieves good privacy protection with reasonable complexity, and uses cryptanalytic time-memory tradeoffs that is the focus of the second part of the thesis). A cryptanalytic time-memory tradeoff is a generic tool to carry out brute force search for the pre-image of a one-way function efficiently. It forms a compromise between the online exhaustive search (no precomputation, searching through all the possibilities) and the lookup table (all pos- sibilities precomputed and stored, and then looking up when needed) approaches. In the former, no precomputation or memory is required, but the search is expensive, and in the latter, precom- putation and storage are expensive, but the search is nearly instant. In time-memory tradeoffs, precomputation is expensive, but both storage and online search time are reasonable. In this thesis, ways to improve the performance of existing techniques have been explored, among which finger- prints (in which stored information is slightly different than in classical time-memory tradeoffs, which results in a speedup in the online phase), storage optimization (which reduce the storage of time-memory tradeoffs), and interleaving (which is a way to accommodate the technique to non-uniformly distributed input). 3 4 Contents 1 Introduction 11 1.1 RFID in a Nutshell . 11 1.1.1 System Model . 11 1.1.2 Threats in RFID . 12 1.1.3 Challenges in RFID Authentication . 13 1.2 Results on RFID Authentication . 14 1.3 Introduction to Cryptanalytic Time-Memory Trade-offs . 15 1.3.1 Motivation . 15 1.3.2 Variants and Adaptations . 16 1.4 Results on Time-Memory Trade-offs . 16 1.5 Plan of the Manuscript . 17 2 Ultralightweight Authentication 19 2.1 Ultralightweight Protocols . 20 2.1.1 Tag Capabilities . 20 2.1.2 Attack Model . 20 2.1.3 SASI, a Typical Ultralightweight Protocol . 21 2.2 Statistics on the State of the Art . 29 2.3 Common Flaws . 31 2.3.1 Linearity and T-functions . 31 2.3.2 Biased Output . 32 2.3.3 Rotations . 33 2.3.4 Message Composition . 34 2.3.5 Knowledge Accumulation . 34 2.3.6 Desynchronization . 35 2.3.7 Vulnerability to Systematic Black-box Attacks . 35 2.4 Dubious Proofs of Security . 38 2.4.1 Randomness Tests . 38 2.4.2 BAN and GNY Logic . 40 2.4.3 Other Approaches . 41 2.5 Weaknesses in Recent Protocols . 41 2.5.1 Bilal and Martin . 41 2.5.2 Jeon and Yoon . 42 2.5.3 Ling and Shen . 44 2.6 Ultralightweight Building Blocks . 44 2.7 Conclusion . 45 3 Complexity and Privacy 47 3.1 Preliminaries . 47 3.2 Protocols with Limited Privacy . 49 3.3 Protocols with Shared Secrets . 50 3.3.1 Tree-based and Group-based Protocols . 50 3.3.2 Cheon, Hong, and Tsudik's Protocol . 51 3.3.3 Alomair, Clark, Cuellar, and Poovendran's Protocol . 55 5 6 Contents 3.3.4 Discussion . 57 3.4 Protocols Based on Hash-Chains . 57 3.4.1 OSK Protocol . 57 3.4.2 OSK/AO Protocol . 58 3.4.3 OSK/BF Protocol . 59 3.4.4 O-RAP Protocol . 60 3.4.5 Discussion . 61 3.5 Counter-Based Protocols . 61 3.5.1 YA-TRAP Family . 61 3.5.2 Discussion . 63 3.6 Comparison . 63 3.7 Conclusion . 66 4 The OSK/AO Protocol 67 4.1 Ohkubo, Suzuki, and Kinoshita's Protocol . 67 4.1.1 Description . 67 4.1.2 Real-life Applications . 69 4.2 OSK/AO . 70 4.2.1 Description . 70 4.2.2 Analysis . 70 4.2.3 Algorithms . 71 4.3 Experiments and Comparison . 73 4.3.1 Environment . 73 4.3.2 Parameters and Functions . 74 4.3.3 Precomputation of the Tables . 74 4.3.4 Experiments . 75 4.4 Conclusion . 75 5 Rainbow Tables with Fingerprints 77 5.1 Background on Cryptanalytic Time-Memory Trade-offs . 77 5.1.1 Hellman Tables . 77 5.1.2 Rainbow Tables . 78 5.1.3 Main Results on Rainbow Tables . 80 5.2 Fingerprints . 80 5.2.1 Rationale . 81 5.2.2 Description . 81 5.3 Analysis . 82 5.4 Algorithm for Finding Optimal Configurations . 86 5.4.1 Hill Climbing . 86 5.4.2 Application to Checkpoint Functions . 87 5.5 Theoretical and Experimental Results . 88 5.5.1 Theoretical Results . 88 5.5.2 Experimental Validation . 89 5.6 Conclusion . 90 6 Rainbow Tables Optimal Storage 91 6.1 Bound for Endpoint Storage . 91 6.2 Decomposition of the Endpoints in Prefix and Suffix . 92 6.2.1 Description . 92 6.2.2 Analysis and Optimality . 93 6.3 Compressed Delta Encoding of the Endpoints . 94 6.3.1 Description . 94 6.3.2 Analysis and Optimality . ..