5.4 TRACKER: Product Tracking by a Trusted Party
5.4.4 Security Analysis
In this section, we present the main security theorems regarding Tracker. Theorem 5.1. Tracker is complete.
Proof. We note that if a tag T went through a valid path Pvalidi, then T will store a state ST = (cID, cH, cσ) such that:
cID = Encpk(ID) cH = Encpk(H(ID))
cσ = Encpk(σPvalidi(ID)) = Encpk(H(ID)φ(Pvalidi))
When manager M decrypts the state ST, he obtains the tuple (ID, H(ID), σPvalidi(ID)). Now it is clear that for Ki = φ(P
validi), the equation H(ID)
Ki = σ
Pvalidi(ID) holds, leading the check function to output “1”.
Theorem 5.2. Tracker is sound under the CDH assumption in G in the random oracle model.
Proof. Assume there is an adversary A who breaks the security of Tracker with a non- negligible advantage ǫ, we build an adversary B that uses A as a subroutine to break the CDH assumption with a non-negligible advantage ǫ′.
Let OCDH be an oracle that selects randomly x, y ∈ Fq, and returns g, gx, gy ∈ G.
Proof overview. If adversaryA has a non-negligible advantage ǫ in breaking the security of Tracker, then adversary A will be able to output a challenge tag Tc that stores an encrypted state STc, such that:
5.4 TRACKER: Product Tracking by a Trusted Party
i.) Check(STc, M ) = 1, i.e., there is a valid path Pvalidi that corresponds to Tc’s state; ii.) ∃ vk ∈ Pvalidi such that step vk is not corrupted by adversaryA;
iii.) Tc did not go through step vk.
To break the CDH assumption, adversaryB simulates a Tracker system for A where he creates a step vkin the supply chain such that Seck= (x0, gx) instead of Seck = (x0, ak). Without loss of generality, we assume in the rest of the proof that vk = v0 and that adversaryA corrupts all readers in the supply chain.
Now, adversaryB must convince adversary A that v0 is associated with secret coefficient a0 = x that corresponds to gx received from the oracleOCDH. That is, adversaryB has to be able to compute H(ID)x only by knowing gx. To this end, adversary B simulates a random oracle H to compute the hash function H.
WhenH is queried in the learning phase with identifier IDj,B picks a random number rj and computes H(IDj) = grj.
When adversaryA queries the random oracle H with the identifier IDcof the challenge tag Tc, adversaryB simulates H by picking a random number rc and computing H(IDc) = gyrc.
In the challenge phase, adversaryA returns the challenge tag Tc to B.
As adversary A has a non-negligible advantage in winning the soundness game, it fol- lows that the challenge tag Tc stores an encrypted valid state that corresponds to the tuple (IDc, H(IDc), σc) such that σc = H(IDc)φ(Pvalidi), while Tc did not go through the step v0.
We assume that tag Tc stores a state STc that corresponds to the valid path Pvalidi = −−−−−→
v0Pvalid′ i, and we denote l the length of pathPvalidi. By definition, φ(Pvalidi) = a0x
l
0 + φ(Pvalid′ i) = xx l
0 + φ(Pvalid′ i), and given σc and the encoding φ(Pvalid′ i) of the sub-pathP
′
validi, adversary B computes: σc H(IDc)φ(P ′ validi) = H(IDc) φ(Pvalidi) H(IDc)φ(P ′ validi) = H(IDc)xx l 0 H(IDc)x = ! σc H(IDc)φ(P ′ validi) #1 xl 0
Adversary B thus has access to H(IDc)x = (gyrc)x = gxyrc, and he can compute (gxyrc) 1 rc = gxy. This breaks the CDH assumption leading to a contradiction.
Simulation of the random oracle H. To respond to the queries of the random oracle H, the adversary B keeps a table TH of tuples (IDj, rj, coin(IDj), H(IDj)) as explained below.
On a query H(IDi), adversaryB replies as follows:
1. If there is a tuple (IDi, ri, coin(IDi), H(IDi)) that corresponds to IDi, then B returns H(IDi).
5. RFID-BASED PRODUCT TRACKING IN SUPPLY CHAINS
2. If IDi has never been queried before, then B picks a random number ri ∈ Fq and flips a random coin coin(IDi) ∈ {0, 1} such that: coin(IDi) = 1 with probability p, and it equals to 0 with probability 1− p. If coin(IDi) = 0, then B answers with H(IDi) = gri. Otherwise, he answers with H(IDi) = (gy)ri. Finally, he stores the tuple (IDi, ri, coin(IDi), H(IDi)) in table TH.
Construction. First, adversaryB queries OCDH to receive g, gx, gy ∈ G. Then, adversary B simulates the challenger C:
• Adversary B generates a pair of matching Elgamal public and secret keys (sk, pk). Then, he generates η random coefficients ak.
• Next, he provides each reader Rk in Tracker with the pair Seck= (x0, ak). • He provides the issuer I with the pair (x0, gx), as if a0= x.
• Instead of computing the verification keys Ki as the encoding of valid paths in the supply chain φ(Pvalidi), adversaryB computes K
i = gφ(Pvalidi).
Without loss of generality, a valid pathPvalidi in the supply chain could be represented as Pvalidi =
−−−−−→
v0Pvalid′ i. Thus, g
φ(Pvalidi) = gxxl
0+φ(Pvalidi′ ), where l is the length of path Pvalidi.
Once Ki are computed for all the valid paths in the supply chain,B provides the pairs (Ki, steps) to the manager M .
• B simulates the issuer I and creates n tags Tj of Tracker. For each tag Tj,B selects randomly IDj ∈ G and simulates the random oracle H to get the tuple (IDj, rj, coin(IDj), H(IDj)).
If coin(IDj) = 1, i.e., H(IDj) = gyrj, then B cannot compute H(IDj)x = gxyrj as he does not know both x and y. Consequently, B stops the soundness game.
Otherwise, using rj, adversary B computes H(IDj)x= (gx)rj.
Finally, adversary B encrypts the tuple (IDj, H(IDj), σv0(IDj)) using the public key pk of Elgamal cryptosystem. B stores the resulting ciphertexts (c0IDj, c
0 Hj, c
0
σj) into tag Tj.
Learning phase. B then calls adversary A and simulates the challenger C as follows.
• Adversary B simulates the oracle OCorruptR forA. For ease of understanding, we assume that adversaryA corrupts all readers Rk in the supply chain.
• Adversary B simulates readers Rkalong the supply chain. Let Tj be a tag which arrives at step vk. B updates the state of tag Tj using the secret coefficient ak and Elgamal public key pk.
5.4 TRACKER: Product Tracking by a Trusted Party
• Adversary B simulates the oracle OCheck. Let Tj be a tag that went through some path P in the supply chain. Tag Tj stores a state STj = (cIDj, cHj, cσj).
B first decrypts the state of tag Tj and gets a tuple of points (IDj, gj′, ˜σj). He then looks up IDj in TH to retrieve (IDj, rj, coin(IDj), H(IDj)), verifies whether H(IDj) = gj′, and finally, checks whether there is a valid path Pvalidi in the supply chain such that ˜
σj = (Ki)rj and Ki = gφ(Pvalidi).
Note. Here, we assume that coin(IDj) = 0 for ease of understanding. Otherwise, adversary B has to stop the soundness game whenever coin(IDj) = 1, as he cannot verify the validity of the path that tag Tj took.
Challenge phase. AdversaryA outputs a tag Tc.
Since adversaryA has a non-negligible advantage in the soundness game, it follows that i.) Check(STc, M ) = 1, and ii.) Tc did not go through step v0.
Without loss of generality, we assume that the state of tag Tc corresponds to the tuple (IDc, H(IDc), σc), and that Tc’s path signature σc corresponds to path Pvalidi =
−−−−−→ v0Pvalid′ i. First,B checks whether coin(IDc) = 1 or not.
If coin(IDc) = 0, then B stops the game. Notice that if H(IDc) = grc,B will not be able to break the CDH assumption.
If coin(IDc) = 1, i.e., H(IDc) = gyrc, then B continues the game, and computes gxy. Let l denote the length of pathPvalidi. Accordingly,
φ(Pvalidi) = a0x l 0+ φ(Pvalid′ i) = xx l 0+ φ(Pvalid′ i) H(IDc)xx l 0 = σc H(IDc)φ(P ′ validi) = H(IDc) φ(Pvalidi) H(IDc)φ(P ′ validi) H(IDc)x = ! σc H(IDc) φ(P′ validi) #1 xl0 = (gyrc)x= gxyrc
Provided with the random number rc, adversaryB finally computes gxy.
Here we compute the advantage ǫ′ofB. We indicate that without knowing the value of x, adversaryB cannot identify the valid path that the state of the challenge tag Tc encodes. As a result, B picks randomly a valid path Pvalidi from his set of ν valid paths, and he succeeds in breaking the CDH assumption only if, 1.) his guess of the valid path that the state of tag Tc encodes is correct and if 2.) he does not stop the soundness game.
1.) AdversaryB makes a correct guess of the valid path that the state of tag Tc encodes with probability 1
ν.
2.) Adversary B stops the soundness game in the learning phase, if during the initialization phase of the n tags in Tracker, there is a tag Tj with identifier IDj such that coin(IDj) =
5. RFID-BASED PRODUCT TRACKING IN SUPPLY CHAINS
1. This event occurs with probability p. Hence, the probability that B does not stop the soundness game in the learning phase is: (1− p)n.
3.) Adversary B does not stop the game during the challenge phase, if coin(IDc) = 1, which occurs with probability p.
Let E denote the event: B does not stop the soundness game.
Let E1 denote the event: B does not stop the soundness game in the learning phase, P r(E1) = (1− p)n.
Let E2 denote the event: B does not stop the soundness game in the challenge phase, P r(E2) = p. Hence,
π = P r(E) = P r(E1)P r(E2) = p(1− p)n
Now, if adversary A has a non-negligible advantage ǫ in breaking the security of Tracker, then adversary B can break the CDH assumption with a non-negligible advantage ǫ′ = π
νǫ, leading to a contradiction.
Note that π is maximal when p = 1
n and πmax= 1−n1n n ≃ 1 en. 5.4.5 Privacy Analysis
In this section, we prove that Tracker ensures tag unlinkability under the DDH assumption (see Definition 2.29).
Theorem 5.3 (Tag Unlinkability). Tracker ensures tag unlinkability under the DDH as- sumption.
Proof. Assume there is an adversary A whose advantage ǫ in winning the tag unlinkability game is non-negligible. We below construct a new adversary B that executes A and breaks the DDH assumption in G =hgi with a non-negligible advantage ǫ′.
LetODDH be an oracle that when queried selects two random elements x, y∈ Fq and flips a fair coin b∈ {0, 1}. If b = 1, then ODDH sets z = xy; otherwise it randomly selects z from Fq. Finally, it returns the tuple (g, gx, gy, gz).
To break the DDH assumption in G, adversary B proceeds as follows:
He queries the oracleODDHand gets the tuple (g, gx, gy, gz). Then, he simulates challenger C and creates a supply chain for the Tracker protocol where the public key of Elgamal is defined as pk = (g, ˜g = gx).
Learning phase. He calls adversary A who enters the learning phase of the tag unlinka- bility game.
5.4 TRACKER: Product Tracking by a Trusted Party
• Adversary A queries the oracle OCorruptR with the identity of r readers Rk in the supply chain. B simulates the oracle OCorruptRand returns to adversaryA the secret information of readers Rk defined as Seck= (x0, ak).
• Simulating the oracle OTag, adversaryB supplies adversary A with two challenge tags T0 and T1 that have just been issued by issuer I (i.e., T0 and T1 have just entered the supply chain).
• Adversary A iterates the supply chain ρ times. Before each iteration j of the supply chain:
1.) A reads and writes into tags T0 and T1.
2.) Simulating the oracleOStep, adversaryB provides A with the next step of tags T0 and T1.
3.) B simulates the oracles OTag andOStep and suppliesA with s tags T(i,j) together with their next step vT(i,j) in the supply chain.
Challenge phase.
• Adversary B simulates the oracles OStep and provides adversaryA with the next steps of tags T0 and T1. Then, he iterates the supply chain for tags T0 and T1 outside the range of adversary A, updates the path signature and re-encrypts the states of tags T0 and T1 according to Tracker. Finally, adversaryB simulates the oracle OFlip as follows.
1.) He first picks randomly b ∈ {0, 1} and returns tag Tb from the pair of tags T0 and T1. We assume that Tb at this point of the game stores the state STb = (cIDb, cHb, cσb).
2.) He re-encrypts the state STb = (cIDb, cHb, cσb) using (g
y, gz) to obtain a new state ST′ b = (c ′ IDb, c ′ Hb, c ′ σb): c′ID b = (u ′ IDb, v ′ IDb) = (g yrIDu IDb, g zrIDv IDb) c′H b = (u ′ Hb, v ′ Hb) = (g yrHu Hb, g zrHv Hb) c′σb = (u′σb, vσ′b) = (gyrσu σb, g zrσv σb)
• Now, adversary B returns tag Tb to adversary A.
Notice that if z = xy, then the state ST′b is a correct re-encryption of the state STb, i.e., ST′b is a valid state that corresponds to tag Tb. Consequently, the simulation of Tracker by adversaryB does not differ from an actual Tracker system, and adversary A can output a correct guess b′ for the value of b with a non-negligible advantage ǫ.
5. RFID-BASED PRODUCT TRACKING IN SUPPLY CHAINS
If z 6= xy, then the state ST′
b does not correspond to tag Tb, and adversaryA’s view of the tag unlinkability game is independent of b. Therefore, adversaryA has only a negligible advantage in outputting a correct guess b′ for the bit b.
This leads to a statistical distinguisher between the two distributions (g, gx, gy, gxy) and (g, gx, gy, gz), x, y, z ∈ Fq, breaking hereby the DDH assumption in G.
If adversary A outputs b′ = b, then adversaryB outputs z = xy; otherwise adversary B outputs z6= xy.
In conclusion, if there is an adversary A(r, s, ρ, ǫ) who breaks the tag unlinkability of Tracker, then there is an adversaryB who breaks the DDH assumption in G with a non- negligible advantage ǫ′= ǫ.