Security Analysis of Lightweight Authentication Protocol from WISTP ,2) P, Xiao FuP P, Chen Dan-weiP P, Wang Ru-chuanP

Size: px

Start display at page:

Download "Security Analysis of Lightweight Authentication Protocol from WISTP ,2) P, Xiao FuP P, Chen Dan-weiP P, Wang Ru-chuanP"

Hugh Webb
5 years ago
Views:

1 P P P Security Analysis of Lightweight Authentication Protocol from WISTP 23,2,3),2),2),2) Wang Shao-HuiP P, Xiao FuP P, hen Dan-weiP P, Wang Ru-chuanP P 2) ) P(ollege of omputer, Nanjing University of Posts and Telecommunications, Nanjing 223, hina) P(Jiangsu High Technology Research ey Laboratory for Wireless Sensor Networks, Nanjing 23, hina) 3) P( Network and Data Security ey Laboratory of Sichuan Province, hengdu 654, hina) Abstract One of the key problems in Radio Frequency Identification (RFID) is security and privacy. any RFID authentication protocols have been proposed to preserve security and privacy of the system. Nevertheless, most of these protocols are analyzed and it is shown that they can not provide security against some RFID attacks. In WISTP 23, a new lightweight authentication protocol using AES S-box and some special function is presented. The new protocol has a good implementation in resource constrained tags. In this paper, we give the security analysis on this new authentication protocol. After impersonating the valid reader to query the tag and collecting the responses, we can deduce all the secrets shared between the reader and tag through analyzing the messages. The attack utilizes the structure of the invertible function and the property of the special function introduced in the new protocol. ey words RFID; Lightweight Authentication; Privacy; Active Attack Introduction Radio Frequency Identification (RFID) systems are used for automated identification of objects and people. Applications that use RFID technology include warehouse management, logistics, railroad car tracking, product identification, library books check-in/check-out, asset tracking, passport and credit cards, etc. Privacy and security is one of the key problems in RFID, because the communication between the reader and the tag are more vulnerable to malicious adversaries. The possible security threats to RFID systems include denial of service (DoS), man in the middle (I), counterfeiting, spoofing, eavesdropping, traffic analysis, traceability, de-synchronization etc. An effective and flexible way to assure privacy and security is to adopt authentication protocols. The low cost deployment demand for RFID tags forces the lack of resources for performing true cryptographic operations to provide security. It is worthwhile to study ultra-lightweight authentication protocols which require tags to involve only simple bitwise operations such as bitwise XOR, bitwise OR, bitwise AND and rotation. However, providing lightweight security in RFID systems is not a trivial task. Several ultra-lightweight protocols have already been proposed. However, they all have certain flaws and vulnerabilities. Vajda and Buttyan [] have proposed a set of extremely lightweight challenge response authentication algorithms. These can be used for authenticating the tags, but they may be easily attacked by a powerful adversary. Juels [2] proposed a solution based on the use of pseudonyms, without using any hash function. But after a set of authentication sessions, the list of pseudonyms will need to be reused or updated through an out-of-band channel, which limits the practicality of this scheme. A family of ultralightweight mutual authentication protocols have been proposed, but later it

2 was reported that these protocols are vulnerable to variable attacks, such as passive attack, desynchronization attack and full-disclosure attack[3-3]. One of the reasons for the vulnerabilities of these protocols is the imbalance of some triangular operations like bitwise OR and bitwise AND, and the operations used can not provide good cryptographic property. Recently, Dusart and Traore proposed a lightweight authentication protocol for Low-ost RFID Tags(named D-T protocol) in the conference of WISTP 23[4]. The protocol utilizes the security qualities of the AES S-Boxes[5] to build a function, and the authors claim the new protocol can provide good Strict Avalanche property, and can resist many passive or active attacks. In this paper, we examine the security of D-T protocol. An active attack on D-T protocol is proposed, in which we first collect some authentication messages through impersonating valid reader to query the tag; then using the property of the f function introduced in D-T protocol, we can obtain all the secret key bytes. The number we need to query the tag is less than 248, so we conclude D-T can not provide privacy guarantee as claimed. The rest of the paper is organized as follows: We describe the D-T protocol in section 2, and the detail security analysis of D-T is presented in section 3, and show how to extract all the secrets shared by the reader and the tag; onclusion is given in section 4. 2 Description of D-T Protocol D-T protocol utilizes the challenge-response authentication model, which uses a noninvertible function h. In D-T protocol, to verify the identity of the tag, the reader R and the tag T shares secret key. D-T protocol is proceeded as follows: Step. The reader R generates and sends the challenge = (,,..., 5) to the tag T, where i are bytes randomly chosen. Step 2. The tag computes and sends t = ID h ( ), t2 = h ( ), where ID is the identity of the tag. Step 3. The reader polls all the secrets to compute h ( ), and retrieves the identity of the tag. Finally authentication of the tag can be verified by checking hid ( ). To provide mutual authentication, D-T protocol can be adapted with a slightly modification: In Step 2, a challenge ' is sent with the tag s response, and the reader should respond with the computation of h ( ) ' ID. Description of function h. Function h is composed of f Function and S function, and S function is chosen as the AES[5] SubBytes function. Let =,,..., 5 be a 6-byte vector, then S ( ) = (SubBytes( ),SubBytes( ),...,SubBytes( 5)). ID

3 f function takes two input bytes, and produces one byte output f : F256 F256 F256 : f( x, y) = [[ x ((255 y) << )] + 6 [((255 x) ( y >> )) mod6]]mod 256 where is the bitwise Exclusive Or, + represents the classical integer addition, n >> divides n by 2, n << multiplies n by 2. Let i,,...,5 be a vector index and j,2,3,4 a round index, and =,,..., 5 is a vector of 6 bytes. The following functions is defined: F ( ) = f(, ) and F j ( ) = ( F j ( ), F j ( ),..., F j 5( )) j i i j ( i+ 2 )mod6 To compute h ( ), First the challenge is Xored to the key, and we can obtain D= = (,..., ). The first state 5 5 Then, the following values are calculated: is initialized by = SD ( ). =, =, 2 2 SF ( ( )) SF ( ( )) = SF = SF ( ( )), ( ( )). Finally, the function h ( ) is denoted as h ( ) = = (,,..., 5). 3 Security Analysis of D-T Protocol Suppose the secret key is = (,,..., 5), in this section we give a security analysis of the D-T protocol and show how to deduce the secret key from h ( ). 3. Analysis of the D-T Protocol We first give some observations about the f function and S function. Observation. As to f function, given y, f ( x, y) f( x, y) for any different x and x ; while given x and y, there exists a unique y ' satisfying f ( xy, ) = f( xy, '). Observation 2. As to S function, SubBytes is a bijective function mapping F 256 to F 256. From the description of D-T protocol, we know 4 is calculated as figure shows. Here 2k is obtained from 2k and + ( k =,,...,7 ): 2k

4 Fig. calculation of 4 From the above observation, we can obtain the following conclusion: onclusion. Given the challenge = (,,..., 5), we denote h ( ) as (,,..., ). Then we poll the second byte over the field F 256, and the other 4 4 4,,,5 bytes unchanged, we can get another unique challenge = (,,..., ) satisfying 5 =. 4 4,, Proof. From the observation and observation 2, we know there must exist satisfying =. ombined with the calculation of,,, we know 4 =. In addition, we 4 4,, know the value is unique, because if, we also know,, and 2 2,, because of observation, thus 3 3,,. 4 4,, Using the conclusion, we present the following algorithm to deduce the second key byte from h ( ). Algorithm Recovery of the second key byte Step. A random challenge = (,,..., 5) is chosen, and we obtain (,,..., ) 4 4 4,,,5 Step 2. Try all the other challenge ' = (, ',..., 5), where the second value ' is polled from to 255, and the other values are the same as, this step will stop if we find satisfying. Now we get (, ) and 4 4,, (, ), which have =.,, Step 3. we try all the possible and, and output the pairs satisfying: f(subbytes( ),SubBytes( )) = f(subbytes( ),SubBytes( ))

5 Step 4. Usually, there are many possible outputs of the Step 3, we can change the first and second bytes of the challenge in Step, then proceed Step 2 and Step 3 to filter out the wrong possible values. 3.2 Experiment Results and complexity analysis We give an experiment as appendix shows, here = xa7, = x92; we first take = x37 and = xb7, and we can get another = 2. The number of the possible pairs (, ) is 52, and possible values of are 67 and 46; Then we change the first and second byte of challenge as = xa6 and = x79, and = 8, and possible values of are 57 and 46. So we can deduce the value of is 46. In our attack, we can not obtain the value of the first secret byte, and the number of the possible value of the second byte is always 2. So after trying the algorithm two times, we can obtain the value of. Using the same method, we can deduce all the bytes of the secret. When attacking the RFID D-T authentication protocol using algorithm, the attack complexity is coming from the number to query the tag. As the experiment shows, to obtain, we query the tag about = 2 times, so we almost have to query the tag = 2 times to obtain all the secret. To reduce the query number, we can get the remaining 32 bits in brute force way after obtaining 2 bytes secrets, and the query number is about = 644. In fact, we can reduce the query number as the way of birthday attack. We query the tag challenge = (,,..., 5), where is randomly chosen and the other values are constant. From the birthday attack, we know after query 3 challenges, we must have at least 2 pairs of = (,,..., ), = (,,..., ) and = (,,..., ), = (,,..., ) satisfying what we need, then the total number we need is about = 2 (32=56 if brute force attack considered). 4 onclusion In this paper, we give the active attack on the new proposed lightweight authentication protocol at WISTP 23. We first impersonate the valid reader to query the tag, and send some special challenges and collect the corresponding responses. Utilizing the structure of the h

6 function and the property of the f function, we can deduce all the secrets shared between the reader and the tag. The attack complexity is to query the tag about 2 times, and in the real attack, the number is much shorter than this value. So we conclude the new protocol is not secure enough to use in reality. How to reduce the analysis complexity and analyze the protocol theoretically will be considered in the future work. Acknowledgments This work is supported by the Priority Academic Program Development of Jiangsu Higher Education Institutions(PAPD), National Natural Science Funds (Grant No.6938) and Nanjing University of Post and Telecommunication Funds (Grant No. NY264). References [] Vajda I, Buttyan, L (23) Lightweight authentication protocols for low-cost RFID tags. In: the Second Workshop on Security in Ubiquitous omputing. Seattle, Washington. [2] Juels, A (25) inimalist ryptography for Low-ost RFID Tags (Extended Abstract). In: Fourth onference on Security in ommunication Network. Amalfi. [3] Peris-Lopez P, Hernandez-astro J, Tapiador JE, Ribagorda A (26) LAP: a real lightweight mutual authentication protocol for low-cost RFID tags. In: Workshop on RFID Security 26. Graz, Austria. [4] Peris-Lopez P, Hernandez-astro J, Tapiador JE, Ribagorda A (26) 2AP: a minimalist mutual-authentication protocol for lowcost RFID tags. In: 26 International onference on Ubiquitous Intelligence and omputing. Wuhan, hina. [5] hien HY (27) SASI: A New Ultralightweight RFID Authentication Protocol Providing Strong Authentication and Strong Integrity. IEEE Transactions on Dependable and Secure omputing 4(4): [6] Sadighian A, Jalili, R (29) AFAP: Anonymous forward-secure mutual authentication protocols for RFID systems. In: Third IEEE International onference on Emerging Security Information, Systems and Technologies. Athens, Glyfada. [7] Sadighian A, Jalili, R (28) FLAP: A fast lightweight mutual authentication protocol for RFID systems. In: 6th IEEE International onference on Networks. New Delhi, India. [8] Peris-Lopez P, Hernandez-astro J, Tapiador JE, Ribagorda A (28) Advances in ultralightweight cryptography for low-cost RFID tags: Gossamer protocol. In: 9th International Workshop on Information Security Applications. Jeju Island, orea. [9] Li T, Wang G (27) Security analysis of two ultra-lightweight RFID authentication protocols. In: 22nd International Information Security onference. Sandton, South Africa. [] Safkhani, Naderi, Bagher N (2) ryptanalysis of AFAP. IEIE Electronics Express 7(7): [] Bárász, Boros B, Ligeti P, Lója, Nagy D (27) Passive Attack Against the 2AP utual Authentication Protocol for RFID Tags. In: First International EURASIP Workshop on RFID Technology. Vienna, Austria. [2] Phan RW (29) ryptanalysis of a new ultralightweight RFID authenticaion protocol SASI. IEEE Transactions on Dependable and Secure omputing 6(4): [3] Avoine G, arpent X, artin B (2) Strong authentication and strong integrity (SASI) is not that strong. In: Workshop on RFID Security - RFIDSec'. Istanbul. [4] Dusart P, Traore s. Lightweight Authentication Protocolfor Low-ost RFID Tags. L. avallaro and D. Gollmann (Eds.): WISTP 23, LNS 7886, pp , 23. [5] Daemen, J., Rijmen, V.: The Design of Rijndael: AES - The Advanced Encryption Standard. Springer (22). Appendix. #include<stdio.h> void main()

7 int x,y,z,z2,z,z2,z,z,x,y,k,k,i,j,k; k=xa7; k=x92; x=x37; y=xb7; int number=; int sbox[256] = // A B D E F x63, x7c, x77, x7b, xf2, x6b, x6f, xc5, x3, x, x67, x2b, xfe, xd7, xab, x76, // xca, x82, xc9, x7d, xfa, x59, x47, xf, xad, xd4, xa2, xaf, x9c, xa4, x72, xc, // xb7, xfd, x93, x26, x36, x3f, xf7, xcc, x34, xa5, xe5, xf, x7, xd8, x3, x5, //2 x4, xc7, x23, xc3, x8, x96, x5, x9a, x7, x2, x8, xe2, xeb, x27, xb2, x75, //3 x9, x83, x2c, xa, xb, x6e, x5a, xa, x52, x3b, xd6, xb3, x29, xe3, x2f, x84, //4 x53, xd, x, xed, x2, xfc, xb, x5b, x6a, xcb, xbe, x39, x4a, x4c, x58, xcf, //5 xd, xef, xaa, xfb, x43, x4d, x33, x85, x45, xf9, x2, x7f, x5, x3c, x9f, xa8, //6 x5, xa3, x4, x8f, x92, x9d, x38, xf5, xbc, xb6, xda, x2, x, xff, xf3, xd2, //7 xcd, xc, x3, xec, x5f, x97, x44, x7, xc4, xa7, x7e, x3d, x64, x5d, x9, x73, //8 x6, x8, x4f, xdc, x22, x2a, x9, x88, x46, xee, xb8, x4, xde, x5e, xb, xdb, //9 xe, x32, x3a, xa, x49, x6, x24, x5c, xc2, xd3, xac, x62, x9, x95, xe4, x79, //A xe7, xc8, x37, x6d, x8d, xd5, x4e, xa9, x6c, x56, xf4, xea, x65, x7a, xae, x8, //B xba, x78, x25, x2e, xc, xa6, xb4, xc6, xe8, xdd, x74, xf, x4b, xbd, x8b, x8a, // x7, x3e, xb5, x66, x48, x3, xf6, xe, x6, x35, x57, xb9, x86, xc, xd, x9e, //D xe, xf8, x98, x, x69, xd9, x8e, x94, x9b, xe, x87, xe9, xce, x55, x28, xdf, //E x8c, xa, x89, xd, xbf, xe6, x42, x68, x4, x99, x2d, xf, xb, x54, xbb, x6 ; //F x=sbox[x^k]; y=sbox[y^k]; z=x^((255-y)<<); z2=6(((255-x)^(y>>))%6); z=(z+z2)%256; printf("%d,",z); for(i=;i<256;i++) y=sbox[i^k]; z=x^((255-y)<<); z2=6(((255-x)^(y>>))%6); z=(z+z2)%256; if(z==z) printf("%d,",i);

8 printf("\n"); for(j=;j<256;j++) for(k=;k<256;k++) x=sbox[x37^j]; y=sbox[2^k]; y=sbox[83^k]; z=x^((255-y)<<); z2=6(((255-x)^(y>>))%6); z=(z+z2)%256; z=x^((255-y)<<); z2=6(((255-x)^(y>>))%6); z=(z+z2)%256; if(z==z) printf("%d,%d number++; printf("\n%d,",number); ",j,k);

Chapter 2: Secret Key

Chapter 2: Secret Key Basics Block or Stream? Secret Key Methods Salting AES Key Entropy Prof Bill Buchanan OBE http://asecuritysite.com/crypto02 http://asecuritysite.com/encryption Conclusion Encryption