Privacy Preserving Protocols Privacy Preserving Protocols Workshop on Cryptography for the Internet of Things Jens Hermans KU Leuven - COSIC 20 November 2012
Privacy Preserving Protocols Introduction Cryptography in Daily Life RFID
Privacy Preserving Protocols Introduction Cryptography in Daily Life Car Keys
Privacy Preserving Protocols Introduction Cryptography in Daily Life Access Control
Privacy Preserving Protocols Introduction Cryptography in Daily Life Product Tracking
Privacy Preserving Protocols RFID Privacy 1 RFID Privacy Requirements 2 Privacy Models Protocol Analysis Provable Security (Privacy) Privacy Model Insider Attacks Requirements 3 Lightweight Cryptography 4 Existing Protocols 5 Protocol Design Design Performance 6 Conclusions and Future Perspectives
Privacy Preserving Protocols RFID Privacy Why? Industrial espionage
Privacy Preserving Protocols RFID Privacy Why? User privacy
Privacy Preserving Protocols RFID Privacy Why? Das Kapital Insulin pump Underwear Membership implant User privacy
Privacy Preserving Protocols RFID Privacy Why? Wireless Gun
Privacy Preserving Protocols RFID Privacy RFID Privacy: goals ... ID = u0012345, S = ... { (ID=u0012345, ID = ? P=...) , ...}
Privacy Preserving Protocols RFID Privacy RFID Privacy: goals ID = u0012345, S = ... Link? #T ags? ID = u7654321, S = ...
Privacy Preserving Protocols RFID Privacy Corrupting Tags
Privacy Preserving Protocols RFID Privacy Requirements Different Privacy Solutions Protocol Level Privacy Kill Command Destroy Tag Shielding (Read Range Reduction) ...
Privacy Preserving Protocols RFID Privacy Requirements Threat Analysis / Requirements Privacy Low High Low Security Supply Chain Public Transport Payments Car Keys Access Control High Passports
Privacy Preserving Protocols Privacy Models 1 RFID Privacy Requirements 2 Privacy Models Protocol Analysis Provable Security (Privacy) Privacy Model Insider Attacks Requirements 3 Lightweight Cryptography 4 Existing Protocols 5 Protocol Design Design Performance 6 Conclusions and Future Perspectives
Privacy Preserving Protocols Privacy Models Protocol Analysis Protocol Analysis ... ID = u0012345, S = ... { (ID=u0012345, ID = ? P=...) , ...} Properties: Security Privacy: untraceability Allow corruption
Privacy Preserving Protocols Privacy Models Protocol Analysis Protocol Analysis ... ID = u0012345, S = ... { (ID=u0012345, ID = ? P=...) , ...} Results Many published protocols broken: ⇒ Lack of formal proofs!
Privacy Preserving Protocols Privacy Models Provable Security (Privacy) Provable Security (Privacy)
Privacy Preserving Protocols Privacy Models Provable Security (Privacy) Provable Security (Privacy) System Adversary Adversary wins if ...
Privacy Preserving Protocols Privacy Models Privacy Model Juels-Weis model (2005) System Adversary A B A or B Adversary wins if output is correct tag.
Privacy Preserving Protocols Privacy Models Privacy Model Vaudenay model (2007) System Adversary (Blinded) B Adversary wins if output is true and not trivial
Privacy Preserving Protocols Privacy Models Privacy Model Privacy Model Hermans et al. (2011) Design goals: Strong adversary: can always corrupt Solve issues with wide strong privacy Model ‘reality’ Easy to use
Privacy Preserving Protocols Privacy Models Privacy Model Privacy Model Hermans et al. (2011) System Adversary A B A C
Privacy Preserving Protocols Privacy Models Privacy Model Privacy Model Hermans et al. (2011) System Adversary A B A C Adversary wins if random bit is guessed correctly.
Privacy Preserving Protocols Privacy Models Privacy Model Privacy Model Hermans et al. (2011) New Features: Features (reused): corruption → on real tag Virtual tag handles wide strong privacy Indistinguishability based Single random bit for entire system
Privacy Preserving Protocols Privacy Models Privacy Model Indistinguishability Encryption: Privacy-models: abc xyz RO Juels-Weis IND-CPA Vaudenay IND-CCA Hermans et al. IND-CCA2 ... #!$
Privacy Preserving Protocols Privacy Models Privacy Model Indistinguishability Encryption: Privacy-models: A B RO Juels-Weis IND-CPA Vaudenay IND-CCA Hermans et al. IND-CCA2 ...
Privacy Preserving Protocols Privacy Models Privacy Model Privacy Levels Strong Forward Weak Wide at end Narrow at end
Privacy Preserving Protocols Privacy Models Privacy Model Privacy Requirements Privacy Level Application Narrow Weak Supply Chain Narrow Forward Smart Products Wide Weak Car Keys Payments Access Tokens Wide Forward Passports Public Transport
Privacy Preserving Protocols Privacy Models Insider Attacks Insider Attacks System Adversary Insider T ag
Privacy Preserving Protocols Privacy Models Requirements Privacy Requirements Privacy Level Application Narrow Weak Supply Chain Narrow Forward Smart Products Wide Weak Car Keys Payments Wide Forward + Insider Access Tokens Passports Public Transport
Privacy Preserving Protocols Privacy Models Requirements Privacy Requirements Privacy Level Application Narrow Weak Supply Chain Narrow Forward Smart Products Wide Weak Car Keys Payments Wide Forward + Insider Access Tokens Currently: Wide Strong Passports Public Transport
Privacy Preserving Protocols Lightweight Cryptography 1 RFID Privacy Requirements 2 Privacy Models Protocol Analysis Provable Security (Privacy) Privacy Model Insider Attacks Requirements 3 Lightweight Cryptography 4 Existing Protocols 5 Protocol Design Design Performance 6 Conclusions and Future Perspectives
Privacy Preserving Protocols Lightweight Cryptography Lightweight Devices ↔
Privacy Preserving Protocols Lightweight Cryptography Lightweight Cryptography? Limits: Area ( ➾➾➾ ) Time Power Energy
Privacy Preserving Protocols Lightweight Cryptography Typical Ingredients for Protocols Primitive Status RNG OK? Key Update ??? Block Cipher OK Hash Function OK ECC OK � ???
Privacy Preserving Protocols Lightweight Cryptography Lightweight Elliptic Curve Cryptography y Implementation [LBSV10]: Area (14.5 kGE) Q Time (85 ms) Power (13 . 8 ➭ W) x Energy (1 . 18 ➭ J) P R
Privacy Preserving Protocols Existing Protocols 1 RFID Privacy Requirements 2 Privacy Models Protocol Analysis Provable Security (Privacy) Privacy Model Insider Attacks Requirements 3 Lightweight Cryptography 4 Existing Protocols 5 Protocol Design Design Performance 6 Conclusions and Future Perspectives
Privacy Preserving Protocols Existing Protocols PRF (Block cipher) based [ISO/IEC 9798-2] State: x j Secrets: DB = { x j } Tag T Reader c ∈ R { 0, 1 } n c p ∈ R { 0, 1 } m r = F x ( c || p ) r , p Search x j ∈ DB s.t. F x j ( c || p ) = r Privacy Wide-Weak
Privacy Preserving Protocols Existing Protocols Symmetric Key and Efficiency Damg˚ ard-Pedersen ’08: Independent keys: inefficient O ( n ) Correlated keys: efficient O (log( n )) privacy loss
Privacy Preserving Protocols Existing Protocols Symmetric Key and Efficiency Damg˚ ard-Pedersen ’08: Independent keys: inefficient O ( n ) Correlated keys: efficient O (log( n )) privacy loss Key Updating Higher Privacy Level (narrow forward) Desynchronization Attacks / Efficiency Problems Implementation cost?
Privacy Preserving Protocols Existing Protocols EC Schnorr Protocol State: x j , Y Secrets: y , DB = { X j } Tag T Reader r ∈ R Z ℓ R = rP R � = O ? e e � = 0? s = x + er s ˙ X = sP − eR ∈ DB ? Privacy None
Privacy Preserving Protocols Existing Protocols Randomized Schnorr [BCI08] State: x j , Y Secrets: y , DB = { X j } Tag T Reader r 1 , r 2 ∈ R Z ℓ R 1 = r 1 P , R 2 = r 2 Y R 1 , R 2 � = O ? e s = ex + r 1 + r 2 s ˙ X = e − 1 ( sP − R 1 − y − 1 R 2 ) ∈ DB Privacy Narrow Strong
Privacy Preserving Protocols Existing Protocols Randomized Hash GPS [BCI09] State: x j , Y Secrets: y , DB = { X j } Tag T Reader r 1 , r 2 ∈ R Z ℓ R 1 = r 1 P , R 2 = r 2 Y z = H ( R 1 , R 2 ) R 1 , R 2 � = O ? e s = ex + r 1 + r 2 s , R 1 , R 2 Verify z ˙ X = e − 1 ( sP − R 1 − y − 1 R 2 ) ∈ DB Privacy Narrow Strong and Wide Forward
Privacy Preserving Protocols Existing Protocols IND-CCA2 Encryption [Vau07] State: s j , ID PK: K P . Secrets: DB = { s j } Tag T Reader c ∈ R { 0, 1 } n c r = Enc K P ( ID || s j || c ) r ID || s j || c ← Dec K S ( r ) Search s j ∈ DB Privacy Wide Strong
Privacy Preserving Protocols Existing Protocols Performance Protocol Privacy Ins. Ext. Snd. Operations Schnorr no no yes 1 EC mult Randomized Schnorr narrow-strong no yes 2 EC mult Rand. Hashed GPS narrow-strong no yes 2 EC mult wide-forward 1 hash
Privacy Preserving Protocols Existing Protocols Performance Protocol Privacy Ins. Ext. Snd. Operations Schnorr no no yes 1 EC mult Randomized Schnorr narrow-strong no yes 2 EC mult Rand. Hashed GPS narrow-strong no yes 2 EC mult wide-forward 1 hash Vaudenay wide-strong yes no 2 EC mult + DHIES 1 hash 1 MAC 1 symm enc Hash ElGamal wide-strong yes no 2 EC mult 1 hash 1 MAC
Recommend
More recommend
