SLIDE 1
Privacy Preserving Protocols
Privacy Preserving Protocols
Workshop on Cryptography for the Internet of Things Jens Hermans KU Leuven - COSIC 20 November 2012
Privacy Preserving Protocols Introduction Cryptography in Daily Life
Privacy Preserving Protocols Workshop on Cryptography for the - - PowerPoint PPT Presentation
Privacy Preserving Protocols Workshop on Cryptography for the - - PowerPoint PPT Presentation
Privacy Preserving Protocols Privacy Preserving Protocols Workshop on Cryptography for the Internet of Things Jens Hermans KU Leuven - COSIC 20 November 2012 Privacy Preserving Protocols Introduction Cryptography in Daily Life RFID Privacy
SLIDE 2
SLIDE 3
Privacy Preserving Protocols Introduction Cryptography in Daily Life
Car Keys
SLIDE 4
Privacy Preserving Protocols Introduction Cryptography in Daily Life
Access Control
SLIDE 5
Privacy Preserving Protocols Introduction Cryptography in Daily Life
Product Tracking
SLIDE 6
Privacy Preserving Protocols RFID Privacy
1 RFID Privacy
Requirements
2 Privacy Models
Protocol Analysis Provable Security (Privacy) Privacy Model Insider Attacks Requirements
3 Lightweight Cryptography 4 Existing Protocols 5 Protocol Design
Design Performance
6 Conclusions and Future Perspectives
SLIDE 7
Privacy Preserving Protocols RFID Privacy
Why?
Industrial espionage
SLIDE 8
Privacy Preserving Protocols RFID Privacy
Why?
User privacy
SLIDE 9
Privacy Preserving Protocols RFID Privacy
Why?
Das Kapital Insulin pump Underwear
Membership implant
User privacy
SLIDE 10
Privacy Preserving Protocols RFID Privacy
Why?
Wireless Gun
SLIDE 11
Privacy Preserving Protocols RFID Privacy
RFID Privacy: goals
ID = u0012345, S = ...
...
{ (ID=u0012345, P=...) , ...}
ID = ?
SLIDE 12
Privacy Preserving Protocols RFID Privacy
RFID Privacy: goals
ID = u0012345, S = ... ID = u7654321, S = ...
Link? #T ags?
SLIDE 13
Privacy Preserving Protocols RFID Privacy
Corrupting Tags
SLIDE 14
Privacy Preserving Protocols RFID Privacy Requirements
Different Privacy Solutions
Protocol Level Privacy Kill Command Destroy Tag Shielding (Read Range Reduction) ...
SLIDE 15
Privacy Preserving Protocols RFID Privacy Requirements
Threat Analysis / Requirements
Privacy Low High Security Low Supply Chain Public Transport Payments High Car Keys Access Control Passports
SLIDE 16
Privacy Preserving Protocols Privacy Models
1 RFID Privacy
Requirements
2 Privacy Models
Protocol Analysis Provable Security (Privacy) Privacy Model Insider Attacks Requirements
3 Lightweight Cryptography 4 Existing Protocols 5 Protocol Design
Design Performance
6 Conclusions and Future Perspectives
SLIDE 17
Privacy Preserving Protocols Privacy Models Protocol Analysis
Protocol Analysis
ID = u0012345, S = ...
...
{ (ID=u0012345, P=...) , ...}
ID = ? Properties: Security Privacy: untraceability Allow corruption
SLIDE 18
Privacy Preserving Protocols Privacy Models Protocol Analysis
Protocol Analysis
ID = u0012345, S = ...
...
{ (ID=u0012345, P=...) , ...}
ID = ? Results Many published protocols broken: ⇒ Lack of formal proofs!
SLIDE 19
Privacy Preserving Protocols Privacy Models Provable Security (Privacy)
Provable Security (Privacy)
SLIDE 20
Privacy Preserving Protocols Privacy Models Provable Security (Privacy)
Provable Security (Privacy)
Adversary System
Adversary wins if ...
SLIDE 21
Privacy Preserving Protocols Privacy Models Privacy Model
Juels-Weis model (2005)
Adversary System
A B
A or B
Adversary wins if output is correct tag.
SLIDE 22
Privacy Preserving Protocols Privacy Models Privacy Model
Vaudenay model (2007)
Adversary (Blinded) System B
Adversary wins if output is true and not trivial
SLIDE 23
Privacy Preserving Protocols Privacy Models Privacy Model
Privacy Model Hermans et al. (2011)
Design goals: Strong adversary: can always corrupt Solve issues with wide strong privacy Model ‘reality’ Easy to use
SLIDE 24
Privacy Preserving Protocols Privacy Models Privacy Model
Privacy Model Hermans et al. (2011)
Adversary System
A B A C
SLIDE 25
Privacy Preserving Protocols Privacy Models Privacy Model
Privacy Model Hermans et al. (2011)
Adversary System
A B A C
Adversary wins if random bit is guessed correctly.
SLIDE 26
Privacy Preserving Protocols Privacy Models Privacy Model
Privacy Model Hermans et al. (2011)
New Features: corruption → on real tag wide strong privacy Features (reused): Virtual tag handles Indistinguishability based Single random bit for entire system
SLIDE 27
Privacy Preserving Protocols Privacy Models Privacy Model
Indistinguishability
Encryption: RO IND-CPA IND-CCA IND-CCA2 ...
abc
#!$
xyz
Privacy-models: Juels-Weis Vaudenay Hermans et al.
SLIDE 28
Privacy Preserving Protocols Privacy Models Privacy Model
Indistinguishability
Encryption: RO IND-CPA IND-CCA IND-CCA2 ...
A B
Privacy-models: Juels-Weis Vaudenay Hermans et al.
SLIDE 29
Privacy Preserving Protocols Privacy Models Privacy Model
Privacy Levels
Strong Forward Wide Narrow Weak
at end at end
SLIDE 30
Privacy Preserving Protocols Privacy Models Privacy Model
Privacy Requirements
Privacy Level Application Narrow Weak Supply Chain Narrow Forward Smart Products Wide Weak Car Keys Wide Forward Payments Access Tokens Passports Public Transport
SLIDE 31
Privacy Preserving Protocols Privacy Models Insider Attacks
Insider Attacks
Adversary System Insider T ag
SLIDE 32
Privacy Preserving Protocols Privacy Models Requirements
Privacy Requirements
Privacy Level Application Narrow Weak Supply Chain Narrow Forward Smart Products Wide Weak Car Keys Payments Wide Forward + Insider Access Tokens Passports Public Transport
SLIDE 33
Privacy Preserving Protocols Privacy Models Requirements
Privacy Requirements
Privacy Level Application Narrow Weak Supply Chain Narrow Forward Smart Products Wide Weak Car Keys Payments Wide Forward + Insider Access Tokens Currently: Wide Strong Passports Public Transport
SLIDE 34
Privacy Preserving Protocols Lightweight Cryptography
1 RFID Privacy
Requirements
2 Privacy Models
Protocol Analysis Provable Security (Privacy) Privacy Model Insider Attacks Requirements
3 Lightweight Cryptography 4 Existing Protocols 5 Protocol Design
Design Performance
6 Conclusions and Future Perspectives
SLIDE 35
Privacy Preserving Protocols Lightweight Cryptography
Lightweight Devices
↔
SLIDE 36
Privacy Preserving Protocols Lightweight Cryptography
Lightweight Cryptography?
Limits: Area (➾➾➾) Time Power Energy
SLIDE 37
Privacy Preserving Protocols Lightweight Cryptography
Typical Ingredients for Protocols
Primitive Status RNG OK? Key Update ??? Block Cipher OK Hash Function OK ECC OK
- ???
SLIDE 38
Privacy Preserving Protocols Lightweight Cryptography
Lightweight Elliptic Curve Cryptography
R P Q x y
Implementation [LBSV10]: Area (14.5 kGE) Time (85 ms) Power (13.8 ➭W) Energy (1.18 ➭J)
SLIDE 39
Privacy Preserving Protocols Existing Protocols
1 RFID Privacy
Requirements
2 Privacy Models
Protocol Analysis Provable Security (Privacy) Privacy Model Insider Attacks Requirements
3 Lightweight Cryptography 4 Existing Protocols 5 Protocol Design
Design Performance
6 Conclusions and Future Perspectives
SLIDE 40
Privacy Preserving Protocols Existing Protocols
PRF (Block cipher) based [ISO/IEC 9798-2]
State: xj Tag T Secrets: DB = {xj} Reader c ∈R {0, 1}n c p ∈R {0, 1}m r = Fx(c||p) r, p Search xj ∈ DB s.t. Fxj(c||p) = r
Privacy Wide-Weak
SLIDE 41
Privacy Preserving Protocols Existing Protocols
Symmetric Key and Efficiency
Damg˚ ard-Pedersen ’08: Independent keys: inefficient O(n) Correlated keys:
efficient O(log(n)) privacy loss
SLIDE 42
Privacy Preserving Protocols Existing Protocols
Symmetric Key and Efficiency
Damg˚ ard-Pedersen ’08: Independent keys: inefficient O(n) Correlated keys:
efficient O(log(n)) privacy loss
Key Updating Higher Privacy Level (narrow forward) Desynchronization Attacks / Efficiency Problems Implementation cost?
SLIDE 43
Privacy Preserving Protocols Existing Protocols
EC Schnorr Protocol
State: xj, Y Tag T Secrets: y, DB = {Xj} Reader r ∈R Zℓ R = rP R = O? e e = 0? s = x + er s ˙ X = sP − eR ∈ DB ?
Privacy None
SLIDE 44
Privacy Preserving Protocols Existing Protocols
Randomized Schnorr [BCI08]
State: xj, Y Tag T Secrets: y, DB = {Xj} Reader r1, r2 ∈R Zℓ R1 = r1P, R2 = r2Y R1, R2 = O? e s = ex + r1 + r2 s ˙ X = e−1(sP −R1−y−1R2) ∈ DB
Privacy Narrow Strong
SLIDE 45
Privacy Preserving Protocols Existing Protocols
Randomized Hash GPS [BCI09]
State: xj, Y Tag T Secrets: y, DB = {Xj} Reader r1, r2 ∈R Zℓ R1 = r1P, R2 = r2Y z = H(R1, R2) R1, R2 = O? e s = ex + r1 + r2 s, R1, R2 Verify z ˙ X = e−1(sP −R1−y−1R2) ∈ DB
Privacy Narrow Strong and Wide Forward
SLIDE 46
Privacy Preserving Protocols Existing Protocols
IND-CCA2 Encryption [Vau07]
State: sj, ID Tag T PK: KP . Secrets: DB = {sj} Reader c ∈R {0, 1}n c r = EncKP (ID||sj||c) r ID||sj||c ← DecKS(r) Search sj ∈ DB
Privacy Wide Strong
SLIDE 47
Privacy Preserving Protocols Existing Protocols
Performance
Protocol Privacy Ins.
- Ext. Snd.
Operations Schnorr no no yes 1 EC mult Randomized Schnorr narrow-strong no yes 2 EC mult
- Rand. Hashed GPS
narrow-strong no yes 2 EC mult wide-forward 1 hash
SLIDE 48
Privacy Preserving Protocols Existing Protocols
Performance
Protocol Privacy Ins.
- Ext. Snd.
Operations Schnorr no no yes 1 EC mult Randomized Schnorr narrow-strong no yes 2 EC mult
- Rand. Hashed GPS
narrow-strong no yes 2 EC mult wide-forward 1 hash Vaudenay wide-strong yes no 2 EC mult + DHIES 1 hash 1 MAC 1 symm enc Hash ElGamal wide-strong yes no 2 EC mult 1 hash 1 MAC
SLIDE 49
Privacy Preserving Protocols Protocol Design Design
1 RFID Privacy
Requirements
2 Privacy Models
Protocol Analysis Provable Security (Privacy) Privacy Model Insider Attacks Requirements
3 Lightweight Cryptography 4 Existing Protocols 5 Protocol Design
Design Performance
6 Conclusions and Future Perspectives
SLIDE 50
Privacy Preserving Protocols Protocol Design Design
New Protocol [Peeters, Hermans 2012]
Design protocol: Correct Extended soundness (At least) Wide Forward + Insider privacy Efficient
SLIDE 51
Privacy Preserving Protocols Protocol Design Design
EC Schnorr Protocol
State: xj, Y Tag T Secrets: y, DB = {Xj} Reader r ∈R Zℓ R = rP R = O? e e = 0? s = x + er s ˙ X = sP − eR ∈ DB ?
SLIDE 52
Privacy Preserving Protocols Protocol Design Design
Key Assumptions
Oracle Diffie-Hellman Assumption (A = aP, B = bP, abP) ∼ (A = aP, B = bP, rP) with extra O(Z) := xcoord(bZ)P. X Logarithm xcoord(rP)P ∼ r ′P
SLIDE 53
Privacy Preserving Protocols Protocol Design Design
New Protocol
State: x, Y = yP Tag T Secrets: y DB : {Xi = xiP} Reader R r1, r2 ∈R Z∗
ℓ
R1 = r1P, R2 = r2P e ∈R Z∗
ℓ
e d = xcoord(xcoord(r2Y )P) s = x + er1 + d ˙ d = xcoord(xcoord(yR2)P) ˙ X = (s − ˙ d)P − eR1 ∈ DB ?
SLIDE 54
Privacy Preserving Protocols Protocol Design Design
New Protocol - Extended Soundness
State: x, Y = yP Tag T Secrets: y DB : {Xi = xiP} Reader R r1, r2 ∈R Z∗
ℓ
R1 = r1P, R2 = r2P e ∈R Z∗
ℓ
e d = xcoord(xcoord(r2Y )P) s = x + er1 + d ˙ d = xcoord(xcoord(yR2)P) ˙ X = (s − ˙ d)P − eR1 ∈ DB ?
Extended Soundness Schnorr protocol ⇒ extended soundness (OMDL assumption)
SLIDE 55
Privacy Preserving Protocols Protocol Design Design
New Protocol - Privacy
State: x, Y = yP Tag T Secrets: y DB : {Xi = xiP} Reader R r1, r2 ∈R Z∗
ℓ
R1 = r1P, R2 = r2P e ∈R Z∗
ℓ
e d = xcoord(xcoord(r2Y)P) s = x + er1 + d ˙ d = xcoord(xcoord(yR2)P) ˙ X = (s − ˙ d)P − eR1 ∈ DB ?
SLIDE 56
Privacy Preserving Protocols Protocol Design Performance
Performance
Protocol Privacy Ins.
- Ext. Snd.
Operations Schnorr no no yes 1 EC mult Randomized Schnorr narrow-strong no yes 2 EC mult
- Rand. Hashed GPS
narrow-strong no yes 2 EC mult wide-forward 1 hash Vaudenay wide-strong yes no 2 EC mult + DHIES 1 hash 1 MAC 1 symm enc Hash ElGamal wide-strong yes no 2 EC mult 1 hash 1 MAC
SLIDE 57
Privacy Preserving Protocols Protocol Design Performance
Performance
Protocol Privacy Ins.
- Ext. Snd.
Operations Schnorr no no yes 1 EC mult Randomized Schnorr narrow-strong no yes 2 EC mult
- Rand. Hashed GPS
narrow-strong no yes 2 EC mult wide-forward 1 hash Vaudenay wide-strong yes no 2 EC mult + DHIES 1 hash 1 MAC 1 symm enc Hash ElGamal wide-strong yes no 2 EC mult 1 hash 1 MAC Our Protocol wide-forward-insider yes yes 4 EC mult
- optimised version
wide-forward-insider yes yes 2 EC mult
SLIDE 58
Privacy Preserving Protocols Conclusions and Future Perspectives
Summary
Overview RFID Privacy Models & Privacy Levels Implementation Aspects RFID Protocols New Private & Efficient RFID Protocol
SLIDE 59
Privacy Preserving Protocols Conclusions and Future Perspectives
Future Perspectives
Privacy models ‘Fair’ comparison Restrictions on tag corruption Simulatability vs indistinguishability Protocols New applications Other primitives → feasible? Analyze underlying assumptions (DDH-variants)
SLIDE 60
Privacy Preserving Protocols Conclusions and Future Perspectives