UCAM-CL-TR-709 Technical Report ISSN 1476-2986 Number 709 Computer Laboratory Protocols and technologies for security in pervasive computing and communications Ford Long Wong January 2008 15 JJ Thomson Avenue Cambridge CB3 0FD United Kingdom phone +44 1223 763500 http://www.cl.cam.ac.uk/ c 2008 Ford Long Wong This technical report is based on a dissertation submitted August 2007 by the author for the degree of Doctor of Philosophy to the University of Cambridge, Girton College. Technical reports published by the University of Cambridge Computer Laboratory are freely available via the Internet: http://www.cl.cam.ac.uk/techreports/ ISSN 1476-2986 Abstract As the state-of-the-art edges towards Mark Weiser’s vision of ubiquitous computing (ubi- comp), we found that we have to revise some previous assumptions about security engineer- ing for this domain. Ubicomp devices have to be networked together to be able to realize their promise. To communicate securely amongst themselves, they have to establish secret session keys, but this is a difficult problem when this is done primarily over radio in an ad- hoc scenario, i.e. without the aid of an infrastructure (such as a PKI), and when it is assumed that the devices are resource-constrained and cannot perform complex calculations. Sec- ondly, when ubicomp devices are carried by users as personal items, their permanent iden- tifiers inadvertently allow the users to be tracked, to the detriment of user privacy. Unless there are deliberate improvements in designing for location privacy, ubicomp devices can be trivially detected, and linked to individual users, with discomfiting echoes of a surveil- lance society. Our findings and contributions are thus as follow. In considering session key establishment, we learnt that asymmetric cryptography is not axiomatically infeasible, and may in fact be essential, to counter possible attackers, for some of the more computationally capable (and important) devices. We next found existing attacker models to be inadequate, along with existing models of bootstrapping security associations, in ubicomp. We address the inadequacies with a contribution which we call: ‘multi-channel security protocols’, by leveraging on multiple channels, with different properties, existing in the said environment. We gained an appreciation of the fact that location privacy is really a multi-layer problem, particularly so in ubicomp, where an attacker often may have access to different layers. Our contributions in this area are to advance the design for location privacy by introducing a MAC-layer proposal with stronger unlinkability, and a physical-layer proposal with stronger unobservability. Acknowledgements There are many people to whom I owe thanks for the completion of this PhD dissertation. First and foremost, I thank my supervisor, Frank Stajano, for his supervision, guidance, encouragement, feedback, editing, ideas, suggestions and other unnamed contributions. Secondly, I thank my advisor, Prof. Andy Hopper, for his encouragement, support, advice and for providing an innovation-driven and practical-oriented environment in the Digital Technology Group (DTG, previously named Laboratory of Communication Engineering or LCE). Next, I record my thanks to my colleagues in both the DTG and the Security Group, who provided collegiality, entertainment, and a spur and a sounding board for my research; and including Prof. Ross Anderson for his organising of the stimulating atmosphere in the Secu- rity Group, and his feedback. In particular, I thank my collaborators: Jolyon Clulow, Hoon Wei Lim, Min Lin, Shishir Nagaraja and Ian Wassell. The following colleagues/friends: Øistein Andersen, Demetres Christofides, Saar Drimer, Feng Hao, Joon Woong Kim, Francisco Monteiro, Tyler Moore, Steven Murdoch and Piotr Zielinski,´ are also much appreciated for various fruitful discus- sions and help, and some of them for their proofreading of the whole or parts of this disser- tation (though the responsibility for any errors is mine). I am grateful to the Department of Engineering, and the Computer Laboratory, for their financial support of part of my conference travel costs. I thank my parents for raising me and their forbearance of an absent son, and my sister and brother-in-law for family warmth. I gratefully acknowledge sponsorship from DSO Singapore, especially support from the management, which enabled me to undertake my studies. My deep appreciation also goes to my thesis examiners: Professor Bruce Christianson and Dr David Greaves, for their patient reading of the dissertation, and their invaluable sugges- tions for improvements/corrections. Contents 1 Introduction 13 2 Password-based Device Pairing 19 2.1 Outline ........................................... 19 2.2 RelatedWork ........................................ 19 2.3 Ubicomp Environment - Lack of an Infrastructure . ....... 20 2.4 ThePrivateChannel-Passwords . ....... 21 2.4.1 ChannelProperties ................................. 22 2.4.2 Limitations of Passwords . 22 2.5 A Vulnerable Symmetric-Key Two-Party Password-Based Key Agreement Protocol . 23 2.5.1 Bluetooth Pairing - Our Implemented Attack . 25 2.5.2 Performance of Attack . 27 2.5.3 Re-Keying as a Short-Term Remedy . 27 2.6 Secure Asymmetric-Key Two-Party Password-Based Key Agreement Protocols . 29 2.6.1 Required Security Properties . 29 2.6.2 Use of Diffie-Hellman . 31 2.6.2.1 Diffie-Hellman over Multiplicative Groups . 31 2.6.2.2 Diffie-Hellman over Elliptic Curve Groups . 32 2.6.2.3 Implementation . 33 2.6.3 Key Derivation and Key Confirmation . 35 2.6.3.1 Key Derivation . 35 2.6.3.2 Key Confirmation . 36 2.6.4 Implementation Results . 36 2.6.4.1 Performance - Laptop . 36 2.6.4.2 Performance - Handphone . 37 2.7 Comments on Provable Security . 37 2.8 Future Directions . 39 2.9 Summary .......................................... 39 3 Inter-Domain Password-Authenticated Identity-Based Key Agreement 41 3.1 Outline ........................................... 41 3.2 RelatedWork ........................................ 42 3.3 Security Requirements . 43 3.4 Identity-Based Cryptography . ..... 44 3.4.1 Pairings....................................... 44 3.4.2 Boneh-Franklin IBE Scheme . 45 3.5 Architecture........................................ 46 3.5.1 Tier1........................................ 46 3.5.2 Tier2........................................ 46 3.5.3 Tier3........................................ 47 3.6 ProposedProtocol.................................. .... 47 3.7 Security Analysis . 50 3.8 Comparisons ........................................ 53 3.8.1 PKI-Kerberos.................................... 53 3.8.2 Yeh-SunKAAP/KTAP............................... 53 3.8.3 Three 2-party Key Agreements . 54 3.8.4 Comparison Metrics . 56 3.9 Future Directions . 57 3.10Summary .......................................... 57 4 Multi-Channel Security Protocols 59 4.1 Outline ........................................... 59 4.2 RelatedWork ........................................ 60 4.3 Multiple Channels: open insecure channel and auxiliary channel . .......... 61 4.3.1 Inadequacy of Open Insecure Channel . ...... 61 4.3.2 Auxiliary Channel with (Data-Origin) Authenticity . 63 4.3.3 Some Attacks on Protocols under Different Attacker Models . .... 63 4.3.3.1 Attack against Short Check Codes exchanged over Auxiliary Channel . 63 4.3.3.2 Attack against Key Fingerprints exchanged over Auxiliary Channel . 65 4.3.3.3 Eavesdropping Attack on Non-Confidential Auxiliary Channel . 66 4.4 Types and Properties of Channels . ...... 68 4.4.1 DifferencesofChannels ............................. 68 4.4.1.1 Authenticity . 68 4.4.1.2 Bandwidth . 69 4.4.1.3 Input or Output or Input/Output . 69 4.4.1.4 Human-mediation . 70 4.4.1.5 Comparison of Channels . 70 4.4.2 Multi-Channel Attacker Model . 71 4.5 Multiple Channels for Two-Party Key Agreement . ..... 72 4.5.1 Security Requirements . 72 4.5.2 Multi-Channel Security Protocol Proposal . .... 73 4.5.2.1 Protocol with Bidirectional Auxiliary Channels . 73 4.5.2.2 Protocol with Unidirectional Auxiliary Channel Restrictions . 77 4.5.3 Security Analysis . 79 4.5.3.1 Attack I - Solving Diffie-Hellman Problem by Passive Attacker . 79 4.5.3.2 Attack II - One-Shot Guess by Active Attacker . 80 4.5.3.3 Attack III - Brute-Forcing Commitments (and Nonces) . 80 4.6 Implementations . 81 4.6.1 Computing time . 81 4.6.2 VisualChannel ................................... 81 4.6.3 Melodic Audio . 83 4.7 Future Directions . 84 4.8 Summary .......................................... 85 5 Group Key Agreement using Multi-Channel Security Protocols 87 5.1 Outline ........................................... 87 5.2 RelatedWork ........................................ 88 5.3 Security Requirements . 88 5.4 A Straightforward Multi-Party Extension of Two-Party Diffie-Hellman Protocol: Cliques 89 5.4.1 Some Generic Attacks on Group Key Agreement Protocol Cliques . .... 91 5.5 Multi-Channel Security Protocol for Group Key Agreement I . ......... 92 5.5.1 Costs ........................................ 94 5.5.2 Augmented Group Operations . 95 5.6 Arbitrary Topologies . .. 95 5.6.1 Star......................................... 95 5.6.2 Hypercube ..................................... 95 5.6.3 Octopus....................................... 95 5.6.4 Tree......................................... 96 5.6.5 Topology Constraints . 96 5.7 Efficiency and Usability Considerations . .... 96 5.8 Multi-Channel Security Protocol for Group Key Agreement II . ......... 96 5.8.1 Advantages - Efficiency