1. Modelling Privacy for Off-line RFID Systems Flavio Garcia Radboud University Nijmegen together with Peter van Rossum RFIDSec 2009

2. Outline Current RFID privacy models A new model for off-line RFID systems that considers reader corruption Forward and self-stabilizing backwards privacy Protocols Conclusions

3. RFID Systems

4. Current RFID Models Permanent secure connexion Juels and Weis (2006) Vaudenay (2007) Avoine (2005) Fwd-Privacy

5. SafeUn-Safe Time

6. Narrow-FWD Private protocol [OSK03]

7. Many real systems are more complex Periodic connexion What kind of security can still be guaranteed? More information on the readers

8. Consider off-line systems where readers can be compromised

9. An adversary is a PPTA with access to the set of oracles O: CreateReader(R) CreateTag(T) Launch(R) Send(m,A) Result() CorruptTag(T) Sync() O+ = O  {DestroyReader(R)}

10. Fwd and Bwd-Privacy Safe Un-Safe Unachievable! (Unless extra assumptions are made) Safe

11. Forward privacy

12. Self-stabilizing backwards privacy

13. Forward and Self-stabilizing Backwards Private Protocol (idea) new day! BO K ← h(k’+1) K’ ← h(k’) K ← h(k) MAC using k’ K to `talk’ with the reader K’ to `talk’ with the BO

14. Forward and Self-stabilizing Backwards Private Protocol

15. Previous protocol is vulnerable to de- synchronization attacks Problem

16. Forward and Self-stabilizing Backwards Private Protocol

17. Verify key update Improvement

18. Improving synchronization

19. But still de-syncs if a reader is compromised Almost there

20. Improving synchronization

21. What to do Take special measures when a reader is compromised. Only update k’’s in BO if no reader corruption Con: this extends the privacy lost by one time slot

22. Conclusions model for (off-line) RFID systems in the presence of reader corruption forward and self-stabilizing backwards private protocols that uses only hash functions. De-sync resilience