Practical and Provably Secure Distance-Bounding

Abstract

From contactless payments to remote car unlocking, many applications are vulnerable to relay attacks. Distance bounding protocols are the main practical countermeasure against these attacks. In this paper, we present a formal analysis of SKI, which recently emerged as the first family of lightweight and provably secure distance bounding protocols. More precisely, we explicate a general formalism for distance-bounding protocols, which lead to this practical and provably secure class of protocols (and it could lead to others). We prove that SKI and its variants are provably secure, even under the real-life setting of noisy communications, against the main types of relay attacks: distance-fraud and generalised versions of mafia-and terrorist-fraud. To attain resistance to terrorist-fraud, we reinforce the idea of using secret sharing, combined with the new notion of a leakage scheme. In view of resistance to generalised mafia-frauds (and terrorist-frauds), we present the notion of circular-keying for pseudorandom functions (PRFs); this notion models the employment of a PRF, with possible linear reuse of the key. We also identify the need of PRF masking to fix common mistakes in existing security proofs/claims. Finally, we enhance our design to guarantee resistance to terrorist-fraud in the presence of noise.

Sound Proof of Proximity of Knowledge

“…-We change the definition of soundness from [10] and [25] to make it closer to the one of interactive proofs. So, our model is pretty natural and nicely connects recent work on distance bounding (such as the BMV model [6,8,9]) and interactive proofs. -We construct ProProx, the very first sound PoPoK.…”

“…We refine the security definitions and other tools from the BMV model [6,8,9,25]. Constructions depend on some security parameter λ which is omitted for more readability.…”

“…We follow the BMV model [6,8,9]: we assume that participants have a location which is an element of a metric space S, with a distance function d. If a participant π 1 at a location loc 1 executes a special command send(π 2 , m) at time t to send a message m to a participant π 2 at location loc 2 , the message m is received by π 2 at time t + d(loc 1 , loc 2 ). Furthermore, any malicious participant π 3 at some location loc 3 could see this message m at time t + d(loc 1 , loc 3 ).…”

“…This extends to Collusion fraud [6,8,9] where the goal of the adversary is to run a man-in-the-middle attack. Terrorist fraud is also related to the notion of soundness [25]: whenever the verifier accepts, there must be an extractor who can reconstruct the secret of the prover based on the view of all close-by participants, possibly after several iterations.…”

“…However, it was not formal enough. Then, two parallel models were developed: the BMV model [6,8,9] and the DFKO model [16]. There exist many symmetric distance-bounding protocols but so far only the SKI protocol [5,6,7,9] (based on the BMV model), the Fischlin-Onete (FO) protocol [18] (based on the DFKO model), and DB1, DB2, and their extensions [10,24] (combining both SKI and FO in the BMV model) provide an all-encompassing proven security.…”