An RFID Distance Bounding Protocol

(1)

An RFID Distance Bounding

Protocol

Gerhard P. Hancke and Markus G. Kuhn May 22, 2006

(2)

Distance bounding

Prover

d

Verifier

Places an upper bound on

physical distance

Does not provide absolute

location

Operates on physical

characteristics of the

communication medium.

Supplements existing security

mechanisms

(3)

RFID devices

Power Clock Token RFID RFID Reader Data

Various applications

Passive devices with low

resources

Limited range

Used to link an item or person

to a location

(4)

Relay attack

RFID Token Token Proxy Reader Proxy Data

Simple, well known attack

Circumvents application layer

security protocols

(5)

Relay attack demonstration

Proxy Token

14443 A/B test card circuit Signal processing with

discrete components

Proxy Reader

Commercial reader module Reprogrammed with our firmware

(6)

Relay attack detection

Delay

Could be reduced with complex hardware

Cannot be less than 3 ns/m

Physical layer

High-resolution timing

(7)

Our Protocol

Goals

Suited to RFID environment

Verifier handles demanding processing functions Prover performs simple functions

Provide same level of security as other distance bounding

protocols

Should not be worse because it has hardware constraints

Implementation

Suggest practical ideas on how to implement our protocol Protocol should supplement current RFID standards, not

(8)

Protocol assumptions

Security target

Places an upper bound on the distance between Verifier

and Prover

Does not provide non-repudiation of location to a third

party

The Prover does not collude with an attacker

Crypto primitives

(9)

Protocol assumptions (2)

Time base

Verifier is computationally strong

Perform accurate timing operations

Prover is computationally weak

Cannot determine accurate timing information

Uses external clock signal (received carrier)

Prover can detect large deviations in clock frequency

Communication channels

Low bandwidth error corrected channel

(10)

Protocol description

Secret key

K

Verifier (RFID reader)

Function

h

Generate nonce

N

V

N

V

Prover (RFID token)

Secret key

K

Function

h

(11)

Protocol description

Secret key

K

Generate random bits Function

h

C

1

, . . . , C

n

Generate nonce

N

V

N

V

Secret key

K

Calculate Split

R

=

R

₀

||R

₁ Function

h

(

K, N

V

) =

R

hC

i

= 01001100

1 0 0 1 1 0 1 1

←

R

0 0 1 1 1 0 1 1 0

←

R

1

(12)

Protocol description

Secret key

K

h

C

1

, . . . , C

n Generate nonce

N

V

hC

i

=

0 1001100

N

V

C

1

= 0

R

Ci i

= 1

_R

C₁ 1

= 1

Secret key

K

Calculate Split

R

=

R

₀

||R

₁ Function

h

1 0 0 1 1 0 1 1

←

R

0 0 0 1 1 0 1 1 0 1 1 1 0 1 1 0

←

R

1 1 1 1 0 1 1 0

h

(

K, N

V

) =

R

(13)

Protocol description

Secret key

K

h

C

1

, . . . , C

n

Generate nonce

N

V

N

V

Secret key

K

Calculate Split

R

=

R

₀

||R

₁ Function

h

(

K, N

V

) =

R

1 0 0 1 1 0 1 1

←

R

0 0 1 1 1 0 1 1 0

←

R

1

R

Ci i

= 11

C

2

= 1

R

C2 2

= 1

1 1 0 1 1 0 0 1 1 0 1 1

hC

i

= 0

1 001100

(14)

Protocol description

Secret key

K

h

C

1

, . . . , C

n

Generate nonce

N

V

N

V

Secret key

K

Calculate Split

R

=

R

₀

||R

₁ Function

h

(

K, N

V

) =

R

1 0 1 1 0

R

Ci i

= 110

C

3

= 0

R

C3 3

= 0

1 0 0 1 1 0 1 1

←

R

0 0 1 1 1 0 1 1 0

←

R

1 1 1 0 1 1

hC

i

= 01

0 01100

(15)

Protocol description

Secret key

K

h

C

1

, . . . , C

n

Generate nonce

N

V

N

V

Secret key

K

Calculate Split

R

=

R

₀

||R

₁ Function

h

(

K, N

V

) =

R

Ci i

= 1101

C

4

= 0

R

C4 4

= 1

0 1 1 0 1 0 1 1

hC

i

= 010

0 1100

1 0 0 1 1 0 1 1

←

R

0 0 1 1 1 0 1 1 0

←

R

1

(16)

Protocol description

Secret key

K

h

C

1

, . . . , C

n

Generate nonce

N

V

N

V

Secret key

K

Calculate Split

R

=

R

₀

||R

₁ Function

h

(

K, N

V

) =

R

C5 5

= 0

C

5

= 1

1 0 0 1 1 0 1 1

←

R

0 1 1 0 0 1 1 0 1 1 1 0 1 1 0

←

R

1

R

Ci i

= 11010

hC

i

= 0100

1

100

(17)

Protocol description

Secret key

K

h

C

1

, . . . , C

n

Generate nonce

N

V

N

V

Secret key

K

Calculate Split

R

=

R

₀

||R

₁ Function

h

(

K, N

V

) =

R

Ci i

= 110101

C

6

= 1

R

C6 6

= 1

1 0 1 1

hC

i

= 01001

1

00

1 0 0 1 1 0 1 1

←

R

0 0 1 1 1 0 1 1 0

←

R

1

(18)

Protocol description

Secret key

K

h

C

1

, . . . , C

n

Generate nonce

N

V

N

V

Secret key

K

Calculate Split

R

=

R

₀

||R

₁ Function

h

(

K, N

V

) =

R

Ci i

= 1101011

_R

C₇ 7

= 1

C

7

= 0

0 0 1 1 1 0 1 1 0

←

R

1 1 0 0 1 1 0 1 1

←

R

0 1

hC

i

= 010011

0

(19)

Protocol description

Secret key

K

h

C

1

, . . . , C

n

Generate nonce

N

V

N

V

Secret key

K

Calculate Split

R

=

R

₀

||R

₁ Function

h

(

K, N

V

) =

R

C8 8

= 1

C

8

= 0

R

Ci i

= 11010111

hC

i

= 0100110

0

0 1 1 1 0 1 1 0

←

R

1 1 0 0 1 1 0 1 1

←

R

0

(20)

Protocol description

Secret key

K

Function

h

N

V Secret key

K

Function

h

1 0 1 0 1 0 0 1

←

R

0 1 0 1 0 0 1 1 0

←

R

1

hC

i

= 01001100

C

i

R

Ci i Expected

R

_iCi

Received

R

C_i i

1 1 0 1 0 1 1 1 1 0 1 0 0 1 0 1 Verifier Attacker

(21)

Protocol description

Secret key

K

Function

h

N

V Secret key

K

Function

h

1 1 0 1 1 0 1 1

←

R

0 1 1 0 0 0 1 0 0

←

R

1

hC

i

= 01001100

Expected

R

_iCi

Received

R

C_i i

1 1 0 1 0 1 1 1 1 0 1 0 0 1 0 1 Verifier

C

i

R

Ci i Malicious Prover

Verifier

↔

Malicious Prover

(22)

Protocol description

Function

h

hC

i

= 01001100

Expected

R

_iCi

1 1 0 1 0 1 1 1 1 1 0 0 0 1 0 1 Verifier Secret key

K

N

V Received

R

C_i i

Secret key

K

Function

h

Attacker

N

V

R

Ci

C

i

A

C

R

AC Function

h

Secret key

K

h

(

K, N

V

) =

R

Prover 1 0 0 1 1 0 1 1

←

R

0 0 1 1 1 0 1 1 0

←

R

1 0 1 0 1 0 1 0 0

R

1 1 0 0 0 1 0 0 1

R

0

(23)

Protocol description

Function

h

hC

i

= 01001100

Expected

R

_iCi

1 1 0 1 0 1 1 1 1 1 0 1 0 1 1 1 Verifier Secret key

K

N

V Received

R

C_i i

Secret key

K

Function

h

Attacker

N

V

R

Ci i

C

i

A

C

R

AC

N

V

A

C¯

R

A_C¯ Function

h

Secret key

K

h

(

K, N

V

) =

R

Prover

h

(

K, N

V

) =

R

1 0 0 1 1 0 1 1

←

R

0 0 1 1 1 0 1 1 0

←

R

1 0 1 1 1 1 0 1 0

R

1 0 1 0 0 1 0 1 1

R

0 0 1 1 1 0 1 1 0

R

1 1 0 0 1 1 0 1 1

R

0 0 1 1 1 0 1 1 0

←

R

1 1 0 0 1 1 0 1 1

←

R

0

Overclocking attack

(24)

Protocol description

Secret key

K

Calculate

h

(

K, N

V

,

N

P

) =

R

Split

R

=

R

₀

||R

₁ Function

h

1 0 0 1 1 0 1 1

←

R

0 0 0 1 1 0 1 1 0 1 1 1 0 1 1 0

←

R

1 1 1 1 0 1 1 0 Generate nonce

N

P Secret key

K

h

C

1

, . . . , C

n Generate nonce

N

V

hC

i

=

0 1001100

N

V

N

P

C

1

= 0

R

Ci i

= 1

_R

C₁ 1

= 1

(25)

Noise

Bit errors will probably occur on the rapid exchange channel

Accept if at least

k

bits out of

n

are correct

False accept: pFA = n X i₌k n i · 3 4 i · 1 4 n₋i False reject: pFR = k₋₁ X i₌₀ n i · (1 − ǫ)i · ǫn−i

(26)

Noise (2)

Example of parameter tradeoffs in the presence of noise

10−5 100 E E R — 100 200 300 400 k – –

(27)

Related work

t

m

= 2

· t

p

+

t

d

=

v

p

· t

m

−

t

d

2 t

m

=

round trip time

t

p

=

one-way propagation time

t

d

=

processing delay

d

=

distance

v

p

=

signal propagation speed

Distance Bounding Protocols

Beth and Desmedt (1991)

Brands and Chaum (1993)

(28)

Brands and Chaum

C

i

Ri

commit(

m

)

Generate random bits

C

1

, . . . , C

n

open commit sign(

M

) Verify sign(

M

)

Verify commit

m

1

, . . . , m

n

R

i

=

C

i

⊕

m

i

message

M

=

C

i

|R

i

|

. . .

|C

n

|

R

n

(29)

Brands and Chaum

C

i

Ri

commit(

m

)

C

1

, . . . , C

n

open commit sign(

M

),

C

,

R

Verify sign(

M

)

Verify commit

m

1

, . . . , m

n

R

i

=

C

i

⊕

m

i

message

M

=

C

i

|R

i

|

. . .

|C

n

|

R

n

Additional commit and sign operations

Additional bits on slow channel

(30)

Performance vs Brands and Chaum

For EER = 10−4 and ǫ = 0.1

Assume bit exchange rate = fcarrier/4

Standard

Time (B and C)

Time (Our protocol)

n

= 70

n

= 360

15693 ‘fast’

5.3237 ms

0.1062 ms

26.4 kbp/s, 13.56 MHz

15693 ‘long’

21.1687 ms

0.1062 ms

(31)

Performance vs Brands and Chaum (2)

For EER = 10−10 and ǫ = 0.05

Assume bit exchange rate = fcarrier/4

Standard

Time (B and C)

Time (Our protocol)

n

= 125

n

= 440

15693 ‘fast’

9.5066 ms

0.1298 ms

26.4 kbp/s, 13.56 MHz

15693 ‘long’

37.8012 ms

0.1298 ms

6.62 kbp/s, 13.56 MHz

14443 A/B

2.3954 ms

0.1298 ms

106 kbp/s, 13.56 MHz

(32)

Positioning technology

Positioning Technology used today

Radio Frequency

Secure but complex

Ultrasound

Appear closer by relaying data with faster RF link

Received Signal Strength

(33)

Resolution

Estimate

r

≈

_Bc

, where

B

is the channel bandwidth

RFID communication inadequate

e.g. for ISO 14443 at 106 kbp/s, r ≈ 3 km

Ultra Wideband Pulses

Higher bandwidth equals better resolution

RFID implementation issues

Error free operation requires high resources e.g. synchronization, bit placement

Crude implementation possible but would allow bit errors Sufficient for bit exchange channel

(34)

Proposed bit exchange channel

Carrier wave

Use carrier for loose synchronization

e.g. Zero crossing

(35)

Proposed bit exchange channel

t

p

Carrier wave

Challenge pulse

C

i

t

r

Reader (Verifier) adjusts

t

to match sampling delay

t

r

in

(36)

Proposed bit exchange channel

t

p Carrier wave Response pulse

R

C_i i Challenge pulse

C

i

t

d

t

r

(37)

Proposed bit exchange channel

t

p

t

p Carrier wave Response pulse

R

C_i i Challenge pulse

C

i

t

s

t

d

t

r

d

=

c

· (

t

s

−

t

−

t

d

)

/

2

(38)

Conclusion

Few more bit exchanges to achieve same cryptographic

security

Chance of attacker guessing correct response 3₄ vs 1₂

Faster operation

Extra bits transmitted on faster bit exchange channel

Much less data transmitted on slow error corrected channel

Practical implementation suited for RFID

Low power and processing requirements for Prover

(39)

Future work

Practical implementation

Pseudorandom functions suited for RFID device Rapid bit exchange channel

UWB antennas for card form factor

Mutual distance bounding protocol

For applications where illegitimate reading attempts are more common e.g e-Passports