Breaking Unlinkability of the ICAO 9303 Standard for e-Passports Using Bisimilarity

Abstract

We clear up confusion surrounding privacy claims about the ICAO 9303 standard for e-passports. The ICAO 9303 standard includes a Basic Access Control (BAC) protocol that should protect the user from being traced from one session to another. While it is well known that there are attacks on BAC, allowing an attacker to link multiple uses of the same passport, due to differences in implementation; there still remains confusion about whether there is an attack on unlinkability directly on the BAC protocol as specified in the ICAO 9303 standard. This paper clarifies the nature of the debate, and sources of potential confusion. We demonstrate that the original privacy claims made are flawed, by uncovering attacks on a strong formulation of unlinkability. We explain why the use of the bisimilarity equivalence technique is essential for uncovering our attacks. We also clarify what assumptions lead to proofs of formulations of unlinkability using weaker notions of equivalence. Furthermore, we propose a fix for BAC within the scope of the standard, and prove that it is correct, again using a state-of-the-art approach to bisimilarity.

Compositional Analysis of Protocol Equivalence in the Applied $$\pi $$-Calculus Using Quasi-open Bisimilarity

“…The situation is mirrored, however, if we attempt to formulate a property using too coarse equivalence: real attacks may be missed. Recent work [26,28], comprehensively explains an attack on ePassports that allows unauthorised observers to track movements of the holder. This attack was overlooked by trace equivalence, which is strictly coarser than bisimilarity.…”

“…If the attack is also classically valid it is also a counterexample for observational equivalence. This methodology was used to resolve the problem of whether there is an attack on the BAC protocol for ePassports [26,28], as originally stated in terms of observational equivalence [8].…”

Breaking and Fixing Unlinkability of the Key Agreement Protocol for 2nd Gen EMV Payments

“…Hirschi, Baelde and Delaune [15] weakened this definition by redefining unlinkability as a trace equivalence problem for which they develop tool support for obtaining proofs of unlinkability. However, in general, using trace equivalence may lead to missing attacks as pointed out in [16] where Horne, Mauw, and Smith study ePassport protocols and revisit bisimilarity-based strong unlinkability definitions.…”

Attack-Defence Frameworks: Argumentation-Based Semantics for Attack-Defence Trees

“…The privacy goal is to ensure ePassport holders cannot be linked from one session to the next, which is called unlinkability. There are attacks on unlinkability, involving relaying messages to remote readers [14]. Note furthermore, that such attacks do not completely compromise unlinkability, e.g., ePassport holders cannot be tracked forever, only in a limited time window, so there are resource considerations here.…”