More on the Security of Linear RFID Authentication Protocols

Abstract

Abstract. The limited computational resources available in RFID tags implied an intensive search for lightweight authentication protocols in the last years. The most promising suggestions were those of the HBfamiliy (HB + , HB # , TrustedHB, ...) initially introduced by Juels and Weis, which are provably secure (via reduction to the Learning Parity with Noise (LPN) problem) against passive and some kinds of active attacks. Their main drawbacks are large amounts of communicated bits and the fact that all known HB-type protocols have been proven to be insecure with respect to certain types of active attacks. As a possible alternative, authentication protocols based on choosing random elements from L secret linear n-dimensional subspaces of GF(2) n+k (so called CKK-protocols) were introduced by Cichoń, Klonowski, and Kutyłowski. These protocols are special cases of (linear) (n, k, L)-protocols which we investigate in this paper. We present several active and passive attacks against (n, k, L)-protocols and propose (n, k, L) ++ -protocols which we can prove to be secure against certain types of active attacks. We obtain some evidence that the security of (n, k, L)-protocols can be reduced to the hardness of the learning unions of linear subspaces (LULS) problem. We then present a learning algorithm for LULS based on solving overdefined systems of degree L in Ln variables. Under the hardness assumption that LULS-problems cannot be solved significantly faster, linear (n, k, L)-protocols (with properly chosen n, k, L) could be interesting for practical applications.

The Cryptographic Power of Random Selection

“…The principle of random selection underlies, e.g., the CKK-protocols of Cichoń, Klonowski, and Kuty lowski [7] as well as the F f -protocols in [3] and the Linear Protocols in [18]. It can be described as follows.…”

“…Note that the protocols introduced in [7], [3], and [18] are based on random selection of GF (2)-linear functions. The choice of linear basis functions is motivated by the fact that they can be implemented efficiently in hardware and have desirable pseudo-random properties with respect to a wide range of important statistical tests.…”

“…, L} and the inputs u ∈ {0, 1} n are randomly chosen by an oracle. In order to illustrate this notion, we sketch in appendix B how an efficient learning algorithm for RandomSelect (L, n, a) can be used for attacking the linear (n, k, L) + -protocol described by Krause and Stegemann [18].…”

“…The following outline of an attack on the (n, k, L) + -protocol by Krause and Stegemann [18] is meant to exemplify the immediate connection between the previously introduced learning problem RandomSelect (L, n, a) and the security of this whole new class of lightweight authentication protocols. Similar to the basic communication mode described in the introduction, the (n, k, L)…”

“…++ -protocol in [18]. Thus, the running time of our algorithm hints at how the parameters n, k, and L should be chosen in order to achieve an acceptable level of cryptographic security.…”