A Method for Proving Unlinkability of Stateful Protocols

Abstract

The rise of contactless and wireless devices such as mobile phones and RFID chips justifies significant concerns over privacy, and calls for communication protocols that ensure some form of unlinkability. Formally specifying this property is difficult and context-dependent, and analysing it is very complex; as is common with security protocols, several incorrect unlinkability claims can be found in the literature. Formal verification is therefore desirable, but current techniques are not sufficient to directly analyse unlinkability. In [21], two conditions have been identified that imply unlinkability and can be automatically verified. That work, however, only considers a restricted class of protocols. We adapt their formal definition as well as their proof method to the common setting of RFID authentication protocols, where readers access a central database of authorised users. Moreover, we also consider protocols where readers may update their database, and tags may also carry a mutable state. We propose sufficient conditions to ensure unlinkability, find new attacks, and obtain new proofs of unlinkability using Tamarin to establish our sufficient conditions.

An Interactive Prover for Protocol Verification in the Computational Model

“…Those case studies (Basic Hash [25], Hash Lock [42], LAK with pairs instead of XOR as in [41], MW [50] and Feldhofer [40]) are authentication protocols between identityspecific tags and a generic reader (having access to a shared database with authorized tags credentials). We used our tool to establish proofs of unlinkability using the notion defined in [4], [6]: an outside observer must not be able to distinguish between a system where each tag can play many sessions from a system where each tag can play at most one session.…”

“…These proofs follow the same global pattern: we use the induction tactic to reason on an arbitrary number of sessions, then at some point we use the equivalent tactic to transform the conditional of an action into an equivalent formula that can be removed with FA-DUP. The systematic use of authentication to establish unlinkability is reminiscent of the wellauthentication condition of [6], [41].…”

“…This has allowed us to obtain proofs of unlinkability that are out-ofscope of these tools, cf. discussion about Basic Hash in [6].…”

“…The corresponding SQUIRREL, CRYPTOVERIF and EASYCRYPT files can be found in the repository [53]. 6 We start by presenting the summary of the key findings of our comparison in Appendix E-A. This summary is based on the basic quantitative comparison of the three approaches in Appendix E-B, and an in-depth qualitative comparison conducted in Appendices E-C, to E-F, where we compare the three approaches on how protocols, security properties and cryptographic assumptions are modelled, and on how security proofs are carried out.…”

Fully Authentication Services Scheme for NFC Mobile Payment Systems

“…Therefore, in this paper, we proposed an authentication scheme for NFC mobile payment systems in order to resolve security problems that were observed above. The major contributions of this paper can be summarized as follows: the proposed authentication scheme for mobile payment systems is discussed; security verification using Burrows et al [35] logic and an automatic cryptographic protocol verifier (ProVerif) tool [36][37][38] is used to verify the security services; comparative security analysis shows how the proposed scheme can fully support mutual authentication, full perfect forward security and full anonymity services and can resist all types of attacks; and a comparative performance analysis shows the proposed scheme's applicability. This paper prepared as follows.…”