On Privacy for RFID

Abstract

Many wearable devices identify themselves in a pervasive way. But at the same time, people want to remain anonymous. Modeling anonymity and unlinkability in identification protocols is a delicate issue. In this paper, we revisit the privacy model from Asiacrypt 2007. We show how to achieve forward-privacy (in the V07 sense) using an IND-CCA secure cryptosystem with the PKC protocol. We review the impossibility result of strong privacy and the model extension from CANS 2012 to reach strong privacy (in the OV12 sense) using the PKC protocol with plaintext awareness. We also discuss on the simplified model from ES-ORICS 2011 and achieve strong-privacy (in the HPVP11 sense) using IND-CCA security only. Finally, we apply these results to add privacy protection in distance bounding protocols.

Privacy failure in the public‐key distance‐bounding protocols

“…We disproved the result by [6] about the prover privacy of their protocol. In Table 2 we list all (secure) public-key distance bounding protocols (following [12]), where insecure soundness means that a terrorist fraud is possible, that is, a far away malicious prover could make the verifier accept with the help of a close-by malicious participant, and without having the information about his secret extractable from his view. Hence, the only existing pubic-key distance-bounding protocol offering privacy so far are the HPO protocol [2], privDB [9], and eProProx [12].…”

“…This work was partly sponsored by the ICT COST Action IC1403 Cryptacus in the EU Framework Horizon 2020. [2] insecure secure insecure GOR [6] insecure insecure insecure privDB [9] insecure secure secure ProProx [10,11] secure insecure insecure eProProx [12] secure secure secure…”

Formal Analysis of Distance Bounding with Secure Hardware

“…Because of this disconnection, all DB protocols require separate security analysis for each of them. The only publickey DB protocols that are secure against all of them (MiM, DF, DH, TF') are ProProx [27], its variant eProProx [25] and TREAD [2]. Some important distance bounding protocols [6,8,10,15,21,23,19] are all vulnerable to TF'.…”

Secure Contactless Payment

“…If the distance of a prover is close enough, the verifier will be sure of the nonexistence of relay attack during the protocol execution. Apparently, it is necessary to utilize a secure distance bounding [20,26,25,27,12,6,24,9,10] in contactless payment.…”