Panagiotis Rizomiliotis and Stefanos Gritzalis Dept. of Information and Communication Systems Engineering University of the Aegean, Greece GHB#: A Provably Secure HB-like Lightweight Authentication Protocol June 26-29, Singapore 1 ACNS 2012

Contents  Motivation - RFID  The HB family  The HB# protocol Design Security  The GHB# protocol Design Security  Implementation issues  Conclusions June 26-29, Singapore 2 ACNS 2012

Motivation - RFID June 26-29, Singapore ACNS Radio Frequency Identification A technology that enables the electronic and wireless labeling and identification of objects, humans and animals Replaces barcodes Electronic device that can store and transmit data to a reader in a contactless manner using radio waves  Microchip  Antenna

Applications June 26-29, Singapore ACNS Practically everywhere Auto Immobilizers Automated Vehicle Id Animal Tracking Conveyor Belt Forklift Dock Door Handheld Point of Sale Smart Shelves Credit Card Electronic Identity

Main Challenges June 26-29, Singapore ACNS Security  Confidentiality of stored data  Integrity/authenticity  Impersonation Privacy  Anonymity  Untraceability Normally, cryptography can solve all these problems. Restrictions: Low cost Limited hardware and energy We need new lightweight algorithms!!

The HB family of protocols June 26-29, Singapore ACNS A set of ultra-lightweight authentication protocols initiated by Hopper and Blum’s work (the HB protocol) proposed initially for human identification Then proposed for RFID tags Based on the LPN problem

The HB family June 26-29, Singapore ACNS HB (2001) HB+ (2005) HB++ (2006) HB-MP (2007) HB-MP+(2008) HB* (2007) HB# (2008) Subspace LPN based protocols (2011)

Three attack models (1/3) June 26-29, Singapore ACNS PASSIVE-model 1. Eavesdrop Tag-Reader 2. Impersonate the Tag DET – model 1. Interrogate the Tag (Reader is not present) 2. Impersonate the Tag MIM – model 1. Modify the messages between Tag-Reader (SOS – learn to authentication result) 2. Impersonate the Tag GRS-attack: Modify only the messages send by the Reader

Three attack models (2/3) DET-model June 26-29, Singapore ACNS

Three attack models (3/3) MIM-model June 26-29, Singapore ACNS GRS-attack when ONLY b i can be modified

The HB# protocol June 26-29, Singapore ACNS Gilbert, H., Robshaw, M., Seurin, Y.: HB#: Increasing the Security and Efficiency of HB+. In: Proceedings of Eurocrypt, Springer LNCS, vol. 4965, pp , (2008) 1. Random-HB#: X,Y random 2. HB#: X,Y Toeplitz Matrices

The HB# protocol’s security June 26-29, Singapore ACNS Based on MHB: an extension of the HB puzzle HB# is secure against the PASSIVE, DET, GRS-attack There is a MIM attack  Ouafi, K., Overbeck, R., Vaudenay, S.: On the Security of HB# against a Man- in- the-Middle Attack. In: Proceedings of Asiacrypt, Springer LNCS, vol. 5350, pp (2008)

Vectorial Boolean Functions June 26-29, Singapore ACNS Vectorial Boolean Functions with m inputs and n outputs:

Gold Boolean Functions June 26-29, Singapore ACNS Gold, R.: Maximal recursive sequences with 3-valued recursive crosscorrelation functions. IEEE Transactions on Information Theory, vol. 14, pp , 1968 Power functions on a field where Algebraic Degree = 2 Balanced APN High nonlinearity

The GHB# protocol June 26-29, Singapore ACNS Modify the HB# Φ is a Gold Boolean function!

Complexity and other issues June 26-29, Singapore ACNS Practically the same the behavior as the HB# protocol False acceptance rate False rejection rate Storage complexity. The memory cost for the tag; i.e. the storage for the two secret matrices, is (k X +k Y )m bits. Communication complexity. The protocol requires (k X +k Y + m) bits to be transferred in total.

Security analysis June 26-29, Singapore ACNS Provably PASSIVE, DET and MIM secure It is based on the MHB puzzle like the HB# (Actually, similarly to the HB# proofs our reduction uses rewinding) The resistance against the MIM attacks is due to the APN property of the Gold function

Intuitive approach June 26-29, Singapore ACNS From the presentation of Ouafi, K., Overbeck, R., Vaudenay, S.: On the Security of HB# against a Man- in-the-Middle Attack. In: Proceedings of Asiacrypt, Springer LNCS, vol. 5350, pp (2008) HB# Estimation of the acceptance rate GHB# The acceptance rate is random! Remember Φ is APN!!!!!

Implementation Issues June 26-29, Singapore ACNS Implementation of the Gold function  Optimal normal basis  Requires 2m + 1 AND gates and 2m XOR gates. Complexity Comparison between GHB# and HB#.

Conclusions June 26-29, Singapore ACNS RFID need ultra-lightweight protocols The HB family is the most promising candidate GHB# is provably secure It has the pros and cons of HB# Further research is needed to improve implementation complexity

Thank you for your attention June 26-29, Singapore ACNS Questions??