A Formal Security Analysis of ERTMS Train to Trackside Protocols

Abstract

Where a licence is displayed above, please note the terms and conditions of the licence govern your use of this document. When citing, please reference the published version. Take down policy While the University of Birmingham exercises care and attention in making items available there are rare occasions when an item has been uploaded in error or has been deemed to be commercially or otherwise sensitive.

A Framework for Vulnerability Detection in European Train Control Railway Communications

“…A high-level security analysis of ERTMS is made in [13] but does not present the vulnerabilities of the EuroRadio protocol that will be exploited with this framework. Different vulnerabilities of the EuroRadio protocol are pointed out in [3] by performing an analysis of it with the ProVerif tool. These vulnerabilities include, for instance, the ability of including high-priority messages or deletion of messages, since the session establishment process does not use timestamps and, therefore, these messages could be replicated.…”

“…In addition, the EuroRadio protocol is used to ensure the authenticity and the integrity of the communications. However, it has been proved that both protocols have vulnerabilities [2,3].…”

An Attack Against Message Authentication in the ERTMS Train to Trackside Communication Protocols

“…After authentication, the trackside equipment will synchronise its clock upon receipt of the first message from the train. The EuroRadio and Application Layer protocols have previously been formally analysed [6], where it was shown that while both layers prevent an attacker from learning the secret key, there are flaws in the protocol, for instance allowing unauthenticated 'Unconditional Emergency Stop' messages being sent by an attacker. There is no existing work to our knowledge, however, which attempts to fuzz the EuroRadio or Application Layer protocols at this time.…”

“…We continue by computing the value of the last message block m f l+2 , such that m f has the same MAC as the original message, using Eq. (6) and H…”

“…As far as we are aware, our paper presents the first feasible attack against the cryptography used by ERTMS. At a more abstract level, De Ruiter et al [6] present a formal analysis of the security of the EuroRadio key establishment protocols, however they abstract away from the cryptographic details. Bloomfield et al [3] provide a highlevel security analysis of ERTMS, but did not find the vulnerability in the EuroRadio MAC presented in this paper.…”