Towards Secure Distance Bounding

Abstract

Abstract. Relay attacks (and, more generally, man-in-the-middle attacks) are a serious threat against many access control and payment schemes. In this work, we present distance-bounding protocols, how these can deter relay attacks, and the security models formalizing these protocols. We show several pitfalls making existing protocols insecure (or at least, vulnerable, in some cases). Then, we introduce the SKI protocol which enjoys resistance to all popular attack-models and features provable security. As far as we know, this is the first protocol with such all-encompassing security guarantees. Why Distance-Bounding?It is well known that a chess beginner can win against a chess grand-master easily by defeating two grand-masters concurrently, taking different colors in both games, and relaying the move of one master to the other. This is a pure relay attack where two masters play against each other while each of them thinks he is playing against a beginner.In real life, relay attacks find applications in access control. For instance, a car with a wireless key can be opened by relaying the communication between the key (the token) and the car. RFID-based access control to buildings can also be subject to relay attacks [21]. The same goes for (contactless) credit-card payments: a customer may try to pay for something on a malicious terminal which relays to a fake card paying for something more expensive [15].To defeat relay attacks, Brands and Chaum [9] introduced the notion of distance bounding protocol. This relies on the fact that information is local and it cannot travel faster than light. So, an RFID reader can identify when participants are close enough because the round-trip communication time has been small enough. The idea is that a prover holding a key x proves to a verifier that he is close to him. Ideally, this notion should behave like a traditional interactive proof system in the sense that it must satisfy:-completeness (i.e., an honest prover close to the verifier will pass the protocol with high probability)This invited paper summarizes results from [4,5,6,7,8].

Relay Cost Bounding for Contactless EMV Payments

“…Classic distance bounding protocols have been widely studied in the literature and elegant solutions have been proposed [18,10,8,6]. These protocols assume that card and reader share a secret and then measure the time it takes to exchange a number of bits.…”

Distance Bounding Based on PUF

“…We compare with other distance bounding protocols. The parameters in pufDB, SKI [5,6], FO [14,33] and DBopt [7] are taken such that the protocols achieve 99% completeness with a noise of 5% as it is described in [7]. (I.e., we adjust E max to have 99% completeness and obtain different figures than in the previoous table.)…”

“…Most of the proposed protocols are vulnerable to TF attacks but a few protocols provide security against all types of threats: the protocol of Fischlin and Onete [14], the SKI protocol [5,6], DBopt protocols [7], the public-key DB protocols ProProx [35] and eProProx [34], and the anonymous DB protocol SPADE [9]. However, all these proofs are made on the assumption that in TF, the prover does not want to give his credential to the adversary for further application.…”

Practical and Provably Secure Distance-Bounding

“…to [11,10, Table 1]). The protocols left standing in front of this attack are the SKI protocols [11,10] to be studied herein and the Fischlin-Onete protocol [24].…”