Sound Proof of Proximity of Knowledge

Abstract

Abstract. Public-key distance bounding schemes are needed to defeat relay attacks in payment systems. So far, only five such schemes exist, but fail to fully protect against malicious provers. In this paper, we solve this problem. We provide a full formalism to define the proof of proximity of knowledge (PoPoK). Protocols should succeed if and only if a prover holding a secret is within the proximity of the verifier. Like proofs of knowledge, these protocols must satisfy completeness, soundness (protection for the honest verifier), and security (protection for the honest prover). We construct ProProx, the very first sound PoPoK.

Survey of Distance Bounding Protocols and Threats

“…They are in bold in Tables 1 and 2, and are the following: KZP (2008) [33], Hitomi (2010) [45], NUS (2011) [28], SKI pro (2013) [9], FO (2013) [25], DB1 (2014) [12], DB2 (2014) [12], ProProx (2014) [53] and VSSDB (2014) [26]. The security level for impersonation fraud are the same for all these protocols and it is the best security level, i.e., it is equivalent at the security against brute force.…”

Private and Secure Public-Key Distance Bounding

“…We recall and adapt the framework of [4,18]. We assume a multiparty setting in which participants have a location and information travels at the speed of light.…”

“…Malicious participants may run an arbitrary probabilistic polynomial-time (PPT) algorithm. The definition below is adapted from [4,18] to accommodate identification protocols and also to bridge public-key and symmetric distance bounding. …”

“…Like in [4,18], all security notions are formalized by a game with three types of participants: provers, verifiers, and actors. Each participant can have several instances at different location or time.…”

“…Distance fraud shall also be prevented to be able to catch red handed people who pay with a stolen credit card. insecure insecure insecure insecure HPO [13] secure secure insecure secure insecure GOR [11] secure secure insecure insecure insecure insecure ProProx [18] secure secure secure secure insecure insecure privDB secure secure secure insecure secure secure (Missing entries correspond to absence of proof in either direction.) Not many public-key DB protocols exist: the Brands-Chaum protocol [5], the DBPK-Log protocol [6], the protocol by Hermans, Peeters, and Onete [13] (herein called the HPO protocol), its recent extension by Gambs, Onete, and Robert [11] (the GOR protocol, herein) 1 , and ProProx [18] (see Table 1).…”