A framework for analyzing RFID distance bounding protocols

Journal of Computer Security

Volumn 19, Issue 2, 2011, Pages 289-317

  Avoine, Gildas ^a   Bingöl, Muhammed Ali ^b,c   Kardaş, Süleyman ^b,d   Lauradoux, Cédric ^e   Martin, Benjamin ^a  

^a UNIVERSITÉ CATHOLIQUE DE LOUVAIN   (Belgium)

^b SCIENTIFIC AND TECHNOLOGICAL RESEARCH COUNCIL OF TURKEY   (Turkey)

^c ISTANBUL TECHNICAL UNIVERSITY   (Turkey)

^d SABANCI UNIVERSITY   (Turkey)

^e UNIVERSITÉ DE LYON   (France)

Author keywords

authentication; distance bounding; proximity check; RFID

Indexed keywords

ANALYSIS AND DESIGN; BLACK BOXES; DISTANCE BOUNDING; FORMAL APPROACH; PROXIMITY CHECK; RFID; RFID TECHNOLOGY; STUDY CASE; UNIFIED FRAMEWORK; WHITE-BOX MODELS;

AUTHENTICATION; CRYPTOGRAPHY;

RADIO FREQUENCY IDENTIFICATION (RFID);

EID: 79952975500     PISSN: 0926227X     EISSN: None     Source Type: Journal    
DOI: 10.3233/JCS-2010-0408     Document Type: Conference Paper

References (61)

1. A. Alkassar, C. Stúble and A.-R. Sadeghi, Secure object identification-or: solving the chess grandmaster problem, in: Proceedings of the 2003 Workshop on New Security Paradigms, Ascona, Switzerland, August 2003, ACM, pp. 77-85. (Pubitemid 40557284)
2. R.J. Anderson, Security Engineering: A Guide to Building Dependable Distributed Systems, Wiley, New York, 2001, Chapter 2.
3. R.J. Anderson, Position statement in RFID S&P panel: RFID and the middleman, in: Financial Cryptography, Scarborough, Trinidad and Tobago, February 2007, Lecture Notes in Computer Science, Vol. 4886, Springer-Verlag, pp. 46-49.
4. G. Avoine, C. Floerkemeier and B. Martin, RFID distance bounding multistate enhancement, in: Proceedings of the 10th International Conference on Cryptology in India - Indocrypt 2009, New Delhi, India, December 2009, Lecture Notes in Computer Science, Vol. 5922, Springer-Verlag, pp. 290-307.
5. G. Avoine and A. Tchamkerten, An efficient distance bounding RFID authentication protocol: Balancing false-acceptance rate and memory requirement, in: Information Security Conference - ISC'09, Pisa, Italy, September 2009, Lecture Notes in Computer Science, Vol. 5735, Springer- Verlag, pp. 250-261.
6. S. Bengio, G. Brassard, Y. Desmedt, C. Goutier and J.-J. Quisquater, Secure implementation of identification systems, Journal of Cryptology 4(3) (1991), 175-183.
7. T. Beth and Y. Desmedt, Identification tokens - or: solving the chess grandmaster problem, in: CRYPTO, Santa Barbara, CA, USA, August 1990, Lecture Notes in Computer Science, Vol. 537, Springer-Verlag, pp. 169-177.
8. M. Blaze, Looking on the bright side of black-box cryptography (transcript of discussion), in: Security Protocols Workshop, Cambridge, UK, April 2000, Lecture Notes in Computer Science, Vol. 2133, Springer-Verlag, pp. 54-61. (Pubitemid 33347507)
9. S. Brands and D. Chaum, Distance-bounding protocols, in: Advances in Cryptology - EUROCRYPT'93, Lofthus, Norway, May 1993, Lecture Notes in Computer Science, Vol. 765, Springer-Verlag, pp. 344-359.
10. L. Bussard and W. Bagga, Distance-bounding proof of knowledge to avoid real-time attacks, in: Security and Privacy in the Age of Ubiquitous Computing, S. Ryoichi, Q. Sihan and O. Eiji, eds, Chiba, Japan, May-June 2005, IFIP International Federation for Information Processing, Vol. 181, Springer-Verlag, pp. 223-238.
11. L. Bussard and Y. Roudier, Embedding distance-bounding protocols within intuitive interactions, in: Security in Pervasive Computing - SPC, D. Hutter, G. Múller, W. Stephan and M. Ullmann, eds, Boppard, Germany, March 2003, Lecture Notes in Computer Science, Vol. 2802, Springer-Verlag, pp. 119-142.
12. S. Capkun, L. Buttyan and J.-P. Hubaux, SECTOR: secure tracking of node encounters in multihop wireless networks, in: ACM Workshop on Security of Ad Hoc and Sensor Networks - SASN'03, Fairfax, VA, USA, October 2003, ACM, pp. 21-32.
13. S. Capkun and J.-P. Hubaux, Secure positioning of wireless devices with application to sensor networks, in: INFOCOM, Miami, FL, USA, March 2005, IEEE Computer Society, pp. 1917-1928. (Pubitemid 41390704)
14. M. Card, Mastercard paypass, available at: http://www.mastercard.com/, 2010.
15. S. Chow, P.A. Eisen, H. Johnson and P.C. van Oorschot, White-box cryptography and an AES implementation, in: Selected Areas in Cryptography - SAC, Newfoundland, Canada, August 2002, Lecture Notes in Computer Science, Vol. 2595, Springer-Verlag, pp. 250-270.
16. J.H. Conway, On Numbers and Games, London Mathematical Society Monographs, Vol. 6, Academic Press, London-New York-San Francisco, 1976.
17. Y. Desmedt, Position statement in RFID S&P panel: from relative security to perceived secure, in: Financial Cryptography, Scarborough, Trinidad and Tobago, February 2007, Lecture Notes in Computer Science, Vol. 4886, Springer-Verlag, pp. 53-56. (Pubitemid 351153043)
18. Y. Desmedt, C. Goutier and S. Bengio, Special uses and abuses of the Fiat-Shamir passport protocol, in: Advances in Cryptology - CRYPTO'87, C. Pomerance, ed., Santa Barbara, CA, USA, August 1988, Lecture Notes in Computer Science, Vol. 293, IACR, Springer-Verlag, pp. 21-39.
19. D. Dolev and A.C.-C. Yao, On the security of public key protocols, IEEE Transactions on Information Theory 29(2) (1983), 198-207.
20. S. Drimer and S.J. Murdoch, Keep your enemies close: distance bounding against smartcard relay attacks, in: 16th USENIX Security Symposium on USENIX Security Symposium, Santa Clara, CA, USA, June 2007, USENIX Association, pp. 1-16.
21. J. Eagle, RFID: The Early Years 1980-1990, available at: http://members.surfbest.net/eaglenest/ rfidhist.htm, 2002.
22. A. Fiat and A. Shamir, How to prove yourself: practical solutions to identification and signature problems, in: Advances in Cryptology - CRYPTO'86, A. Odlyzko, ed., Santa Barbara, CA, USA, August 1986, Lecture Notes in Computer Science, Vol. 263, IACR, Springer-Verlag, pp. 186-194.
23. A. Francillon, B. Danev and S. Capkun, Relay attacks on passive keyless entry and start systems in modern cars, Cryptology ePrint Archive, Report 2010/332, 2010.
24. L. Francis, G. Hancke, K. Mayes and K. Markantonakis, Practical NFC peer-to-peer relay attack using mobile phones, in: Workshop on RFID Security - RFIDSec'10, Istanbul, Turkey, June 2010, Lecture Notes in Computer Science, Springer-Verlag, to appear.
25. J. Gleick, A new approach to protecting secrets is discovered, The New York Times, 18 February 1987, pp. C1 and C3.
26. M. Halváč and T. Rosa, A note on the relay attacks on e-passports: the case of Czech e-passports, Cryptology ePrint Archive, Report 2007/244, 2007.
27. G. Hancke, A practical relay attack on ISO 14443 proximity cards, Manuscript, February 2005.
28. G. Hancke, Practical attacks on proximity identification systems, in: IEEE Symposium on Security and Privacy - S&P 2006, Berkeley, CA, USA, May 2006, IEEE Computer Society, pp. 328-333.
29. G. Hancke and M. Kuhn, An RFID distance bounding protocol, in: Conference on Security and Privacy for Emerging Areas in Communication Networks - SecureComm 2005, Athens, Greece, September 2005, IEEE Computer Society, pp. 66-73.
30. G. Hancke, K. Mayes and K. Markantonakis, Confidence in smart token proximity: relay attacks revisited, Computers & Security 28(7) (2009), 615-627.
31. Y.-C. Hu, A. Perrig and D.B. Johnson, Packet leashes: A defense against wormhole attacks in wireless networks, in: INFOCOM, San Francisco, CA, USA, March-April 2003, pp. 1976-1986.
32. Y.-C. Hu, A. Perrig and D.B. Johnson, Wormhole attacks in wireless networks, IEEE Journal on Selected Areas in Communications 24(2) (2006), 370-380.
33. ISO/IEC 14443, Identification cards - contactless integrated circuit(s) cards - proximity cards.
34. G. Kapoor, W. Zhou and S. Piramuthu, Distance bounding protocol for multiple RFID tag authentication, in: EUC'08: Proceedings of the 2008 IEEE/IFIP International Conference on Embedded and Ubiquitous Computing, Shanghai, China, December 2008, IEEE Computer Society, pp. 115-120.
35. O. Kara, S. Kardas, M.A. Bingol and G. Avoine, Optimal security limits of RFID distance bounding protocols, in: Workshop on RFID Security - RFIDSec'10, Istanbul, Turkey, June 2010, Lecture Notes in Computer Science, Springer-Verlag, to appear.
36. Z. Kfir and A. Wool, Picking virtual pockets using relay attacks on contactless smartcard systems, in: Conference on Security and Privacy for Emerging Areas in Communication Networks - SecureComm 2005, Athens, Greece, September 2005, IEEE Computer Society, pp. 47-68.
37. C.H. Kim and G. Avoine, RFID distance bounding protocol with mixed challenges to prevent relay attacks, J.A. Garay, A. Miyaji and A. Otsuka, eds, in: 8th International Conference on Cryptology and Network Security - CANS'09, Kanazawa, Ishikawa, Japan, December 2009, Lecture Notes in Computer Science, Vol. 5888, Springer-Verlag, pp. 119-133.
38. C.H. Kim, G. Avoine, F. Koeune, F.-X. Standaert and O. Pereira, The swiss-knife RFID distance bounding protocol, in: International Conference on Information Security and Cryptology - ICISC'08, Seoul, Korea, December 2008, Lecture Notes in Computer Science, Vol. 5461, Springer- Verlag, pp. 98-115.
39. J. Klein-Saffran, Electronic monitoring vs. halfway houses: A study of federal offenders, in: Alternatives to Incarceration, Fall 1995, pp. 24-28.
40. A. Laurie, Website: http://www.rfidiot.org/, 2010.
41. A. Levi, E. Çetintas, M. Aydos, Ç.K. Koç and M.U. Çaglayan, Relay attacks on bluetooth authentication and solutions, in: International Symposium Computer and Information Sciences - ISCIS 2004, Kemer-Antalya, Turkey, October 2004, Lecture Notes in Computer Science, Vol. 3280, Springer- Verlag, pp. 278-288. (Pubitemid 39741662)
42. C. Meadows, R. Poovendran, D. Pavlovic, L. Chang and P. Syverson, Distance bounding protocols: Authentication logic analysis and collusion attacks, in: Advances in Information Security Series, Secure Localization and Time Synchronization for Wireless Sensor and Ad Hoc Networks, Vol. 30, Springer-Verlag, 2007, pp. 279-298, Chapter 2.
43. A. Menezes, P.C. van Oorschot and S.A. Vanstone, Handbook of Applied Cryptography, CRC Press, Boca Raton, FL, 1996.
44. J. Munilla, A. Ortiz and A. Peinado, Distance bounding protocols with void-challenges for RFID, in: Workshop on RFID Security - RFIDSec'06, Graz, Austria, July 2006.
45. J. Munilla and A. Peinado, Distance bounding protocols for RFID enhanced by using voidchallenges and analysis in noisy channels, Wireless Communications and Mobile Computing 8(9) (2008), 1227-1232.
46. V. Nikov and M. Vauclair, Yet another secure distance-bounding protocol, Cryptology ePrint Archive, Report 2008/319, 2008.
47. NXP, NXP mifare plus - benchmark security for mainstream applications, available at: http://mifare.net/downloads/NXP-Mifare-Plus-leaflet.pdf, 2009.
48. Y. Oren and A. Wool, Relay attacks on RFID-based electronic voting systems, Cryptology ePrint Archive, Report 2009/442, 2009.
49. P. Peris-Lopez, J.C. Hernandez-Castro, J.M. Estevez-Tapiador and J.C.A. van der Lubbe, Shedding some light on RFID distance bounding protocols and terrorist attacks, arXiv.org, Computer Science, Cryptography and Security, 2009.
50. K.B. Rasmussen, C. Castelluccia, T. Heydt-Benjamin and S. Capkun, Proximity-based access control for implantable medical devices, in: ACM Conference on Computer and Communications Security - CCS'09, Chicago, IL, USA, November 2009, ACM, pp. 410-419.
51. J. Reid, J. Gonzalez Neito, T. Tang and B. Senadji, Detecting relay attacks with timing based protocols, in: Proceedings of the 2nd ACM Symposium on Information, Computer and Communications Security - ASIACCS'07, F. Bao and S. Miller, eds, Singapore, Singapore, March 2007, ACM, pp. 204-213. (Pubitemid 47479240)
52. A. Saxena, B. Wyseur and B. Preneel, Towards security notions for white-box cryptography, in: Information Security Conference - ISC 2009, Pisa, Italy, September 2009, Lecture Notes in Computer Science, Vol. 5735, Springer-Verlag, pp. 49-58.
53. D. Singelée and B. Preneel, Distance bounding in noisy environments, in: European Workshop on Security in Ad-Hoc and Sensor Networks - ESAS'07, Cambridge, UK, July 2007, Lecture Notes in Computer Science, Vol. 4572, Springer-Verlag, pp. 101-115.
54. D. Singelée and B. Preneel, Key establishment using secure distance bounding protocols, in: MOBIQUITOUS'07: Proceedings of the 2007 Fourth Annual International Conference on Mobile and Ubiquitous Systems: Networking & Services (MobiQuitous), Philadelphia, PA, USA, August 2007, IEEE Computer Society, pp. 1-6.
55. F. Stajano, F.-L.Wong and B. Christianson, Multichannel protocols to prevent relay attacks, in: Proceedings of Financial Cryptography 2010, Tenerife, Spain, January 2010, Lecture Notes in Computer Science, Vol. 6052, Springer-Verlag, pp. 4-19.
56. R. Trujillo Rasua, B. Martin and G. Avoine, The Poulidor distance-bounding protocol, in: Workshop on RFID Security - RFIDSec'10, Istanbul, Turkey, June 2010, Lecture Notes in Computer Science, Springer-Verlag, to appear.
57. Y.-J. Tu and S. Piramuthu, RFID distance bounding protocols, in: First International EURASIP Workshop on RFID Technology, Vienna, Austria, September 2007, pp. 67-68.
58. Visa, Visa conctless credit card, available at: http://usa.visa.com/ personal/cards/paywave/index. html, 2010.
59. B.R. Waters and E.W.Felten, Secure, private proofs of locations, Princeton Computer Science, TR- 667-03, 2003.
60. A. Young and M. Yung, The dark side of "black-box" cryptography, or: should we trust Capstone?, in: Advances in Cryptology - CRYPTO'96, Santa Barbara, CA, USA, August 1996, Lecture Notes in Computer Science, Vol. 1109, Springer-Verlag, pp. 89-103. (Pubitemid 126106233)
61. J. Zhou and J. Shi, RFID localization algorithms and applications - a review, Journal of Intelligent Manufacturing 20(6) (2008), 695-707.