Integrity-regions: Authentication Through Presence in Wireless Networks Srdjan Čapkun 1 and Mario Čagalj 2 1 Department of Computer Science, ETH Zurich 2 FESB, University of Split, Croatia ACM WiSe 2006

2 Key Establishment: Diffe-Hellman g a mod p g b mod p K AB =(g b ) a mod p K AB =(g a ) b mod p Mallory Alice Bob

3 Man in the Middle Attack (MITM)

4 Solution to the MITM: Authentication of DH Contributions g a mod p A B g b mod p, sig B (g b,g a ) sig A (g a,g b ) Uses signatures... (DH contributions are authenticated) A B here are the public keys TTP

5 Our goal: Avoiding Certificates (Reliance on TTPs) g a mod p A B g b mod p A B Visual recognition, conscious establishment of keys h( g a ) h( g b )

6 Existing Solutions Stajano and Anderson propose the “resurrecting duckling” security policy model (physical contact) Balfanz et al. “location-limited channel” (e.g., an infrared link) Asokan and Ginzboorg propose a solution based on a shared password Perrig and Song, hash visualization (image comparison) Maher presents several methods to verify DH public parameters (short string comparison), found flawed by Jakobsson Jakobsson and Larsson proposed two solutions to derive a strong key from a shared weak key Dohrmann and Ellison propose a method for key verification that is similar to DH-SC (short word comparison) Gehrmann et al., (short string comparison) Goodrich et al. Loud And Clear: Human Verifiable Authentication Based on Audio Cagalj et al. (short string comparison (1/2 string size)) Capkun, et al. key establishment for self-organized mobile networks (IR channel, mobility) Castellucia, Mutaf (device signal indistinguishability) Cagalj, Capkun, Hubaux, distance-based verification, channel anti- blocking Cagalj, Capkun,... Integrity-codes (awareness of presence)

7 The Seriousness of the MITM Attack Devices using low-power radios can avoid it? –not all radios can control their tx power –the ranges are highly unpredictable –the attacker can use high-gain directional antennas and increase its listening range up to 10x –neighboring/hidden devices I will establish keys in my own living room, I do not need security... –maybe your neighbor steals your dvd UWB output? –you meet someone at a conference... –ad hoc groups of emergency staff, police,... –... –yes, you probably do not need any security in your living room

8 Our Solution: Integrity-regions Main idea: message authentication through distance verification (e.g. ultrasonic distance-bounding) Assumption: the user can assume or visually verify that there are no malicious devices within the integrity region No certificates or preshared keys exchanged prior to the protocol execution

9 Integrity Region Protocol A B d M A’s integrity region d* (c,o) = commit(g b ) c,B d*=(t R -t S )v sound [1] verify (c,o) [2] verify that d* is within its (A's) integrity region d (i.e., d*  d) [3] verify that there are no devices at any distance d**  d* [4] if verifications (1-3) pass, A accepts message g b as genuine NA  oNA  o US channel tRtR NANA tStS

10 Diffie-Hellman with Integrity Regions Given g a Pick N A, N A  U {0,1} k m A  0  g a  N A (c A,o A )  commit (m A ) AliceBob * Given g b Pick N B  U {0,1} k m B  1  g b  N B (c B,o B )  commit (m B ) cAcA cBcB oBoB m B  open (c B,o B ) Verify 1 in m B s A  N A  N B oAoA m A  open (c A,o A ) Verify 0 in m A s B  N B  N A * R B  N A  s B NANA RBRB tStS tRtR d A =(t R -t S )v sound Verify s A = N A  R B * * Only Alice verifies her integrity region. If verification OK, Alice and Bob accept m B and m A, respectively.

11 Analysis of the Implementation with Ultrasound A B d M A’s integrity region d* c,B NA  oNA  o US channel tRtR NANA tStS (c,o) = commit(g b ) (c*,o*) = commit(g m ) c*,B N A  o*

12 Main Consequence of Integrity Regions Forcing the attacker to be physically close to the devices to perform the MITM attack. without integrity regions with integrity regions

13 Integrity-regions with (Omni)directional Antennas

14 Example Application Scenarios Setup of wireless sensor networks (establishment of keys) no attackers in this space (sensors’ I-region) Setup of a home network

15 Summary/Future Work Physical presence of the attacker (i.e., the attacker cannot be omnipresent (physically)) Honest devices (users) can have an awareness of presence (distance, space, surrounding devices) One solution: Integrity regions, message authentication through distance verification Impact on (mobile) ad hoc / sensor networks: –verification of the distance prevents MITM attacks on key establishment from remote locations –enables P2P key establishment / key pairing

16 Authentication Through Presence (Awareness) M. Čagalj, S. Čapkun, R. Rengaswamy, I.Tsigkogiannis, M. Srivastava, and J.-P. Hubaux. Integrity (I) codes: Message Integrity Protection and Authentication Over Insecure Channels. In Proceedings of the IEEE Symposium on Security and Privacy, 2006 M. Čagalj, S. Čapkun, and J.-P. Hubaux, Key Agreement in Peer-to-Peer Wireless Networks Proceedings of the IEEE (Special Issue on Security and Cryptography), 94(2), 2006