1. Low-Cost Untraceable Authentication Protocols for RFID Yong Ki Lee, Lejla Batina, Dave Singelée, Ingrid Verbauwhede BCRYPT workshop on RFID Security February 5, 2010, Leuven

2. Outline of the talk Challenges in RFID networks Security problems Privacy problems Cryptographic building blocks ECC-based authentication protocols Search protocol Hardware architecture Conclusion

3. RFID technology Radio Frequency Identification as we explain it to Dave’s tech-savvy grandmother: 1. Passive tag 2. Battery assisted (BAP) 3. Active tag with onboard power source

4. RFID applications Asset tracking Barcode replacement RFID passports Mobile credit card payment systems Transportation payment systems Sporting events (timing / tracing) Animal identification …

5. RFID security problems (I) Impersonation attacks Genuine readers Malicious tags => Tag-to-server authentication

6. RFID security problems (II) Eavesdropping Replay attacks Man-in-the-middle attacks Cloning Side-channel attacks …

7. RFID privacy problems (I) [A. Juels. RSA Laboratories] Mr. Jones in 2020

8. RFID privacy problems (II) [A. Juels. RSA Laboratories] Mr. Jones in 2020 Wig model #4456 (cheap polyester) Das Kapital and Communist- party handbook 1500 Euros in wallet Serial numbers: 597387,389473 … 30 items of lingerie Replacement hip medical part #459382

9. RFID privacy problems (III) RFID Privacy problem Malicious readers Genuine tags => Untraceability

10. RFID privacy problems (IV) Untraceability Inequality of two tags: the (in)equality of two tags must be impossible to determine Theoretical framework of Vaudenay [ASIACRYPT ‘07] : Narrow vs wide privacy Weak vs strong privacy

11. Cryptographic authentication protocol Tag proves its identity Security (entity authentication) Privacy Challenge-response protocol ReaderTag Challenge Response

12. Technological requirements Scalability Implementation issues Cheap implementation Memory Gate area Lightweight Efficient => Influence on cryptographic building blocks

13. Implementation cost Symmetric encryption AES: 3-4 kgates Cryptographic hash function SHA-3: 10 – 30 kgates) [ECRYPT II: SHA-3 Zoo] Public-key encryption Elliptic Curve Cryptography (ECC): 11-15 kgates =>Public key cryptography is suitable for RFID

14. ECC-based authentication protocols Rely exclusively on ECC !!! Wide-strong privacy Two sub-modules ID-transfer scheme Pwd-transfer scheme Combination => 3 protocols Computational requirements Security requirements

15. System parameters

16. 16 Example: Secure ID Transfer Server: y Tag: x 1, Y=yP T1T1 T2T2 r t1 € ZT 1 ← r t1 P r s1 € Z T 2 ←( r t1 + x 1 )P (y -1 T 2 – T 1 ) ( ) -1 = x 1 P

17. ID-transfer scheme (protocol 1)

18. ID + Pwd-transfer scheme (protocol 3)

19. Search protocol (I) Linear search: scalability issues Search for one particular tag Design requirements: One-round authentication Dedicated authentication Security against replay attacks Wide-weak privacy Combine with ECC-based authentication protocol

20. Search protocol (II)

21. Hardware architecture

22. Performance comparison Circuit Area (Gate Eq.)14,566 Cycles for EC point multiplication59,790 Frequency700 KHz Power13.8 µW Energy for EC point multiplication1.18 µJ

23. Conclusion Security & privacy in RFID networks Challenging research problem Public-key cryptography is suitable for RFID tags ECC hardware implementation Wide-strong authentication protocols Search protocol

24. Questions??

25. EXTRA SLIDES

26. Pwd-transfer scheme

27. ID + Pwd-transfer scheme (protocol 2)