ghb#: a provably secure hb-like lightweight authentication protocol

Panagiotis Rizomiliotis and Stefanos Gritzalis

Dept. of Information and Communication Systems Engineering

University of the Aegean, Greece

GHB#: A Provably Secure HB-like Lightweight

Authentication Protocol

June 26-29, Singapore1 ACNS 2012

ContentsMotivation - RFIDThe HB familyThe HB# protocol

DesignSecurity

The GHB# protocolDesignSecurity

Implementation issuesConclusions

June 26-29, Singapore2 ACNS 2012

Motivation - RFID

June 26-29, SingaporeACNS 20123

Radio Frequency IdentificationA technology that enables the electronic

and wireless labeling and identification of objects, humans and animals

Replaces barcodesElectronic device that can store and

transmit data to a reader in a contactless manner using radio wavesMicrochipAntenna

Applications


Practically everywhere

Auto Auto ImmobilizersImmobilizers Automated Vehicle IdAutomated Vehicle Id

Animal TrackingAnimal Tracking Conveyor BeltConveyor Belt

ForkliftForklift

Dock Dock DoorDoor

HandheldHandheld

Point of SalePoint of Sale

Smart ShelvesSmart Shelves

Credit CardCredit Card

Electronic Electronic IdentityIdentity

Main Challenges


Security Confidentiality of stored data Integrity/authenticity Impersonation

Privacy Anonymity Untraceability

Normally, cryptography can solve all these problems.

Restrictions: Low cost Limited hardware and energy

We need new lightweight algorithms!!

The HB family of protocols


A set of ultra-lightweight authentication protocols initiated by Hopper and Blum’s work (the HB protocol) proposed initially for human identification

Then proposed for RFID tagsBased on the LPN problem

The HB family


HB (2001)HB+ (2005)HB++ (2006)HB-MP (2007)HB-MP+(2008)HB* (2007)HB# (2008)Subspace LPN based protocols (2011)

Three attack models (1/3)


PASSIVE-model1. Eavesdrop Tag-Reader2. Impersonate the Tag

DET – model1. Interrogate the Tag (Reader is not present)2. Impersonate the Tag

MIM – model 1. Modify the messages between Tag-Reader (SOS –

learn to authentication result)2. Impersonate the Tag GRS-attack: Modify only the messages send by

the Reader

Three attack models (2/3)DET-model


Three attack models (3/3)MIM-model


GRS-attack when ONLY bi can be modified

The HB# protocol


Gilbert, H., Robshaw, M., Seurin, Y.: HB#: Increasing the Security and Efficiency of HB+. In: Proceedings of Eurocrypt, Springer LNCS, vol. 4965, pp. 361-378, (2008)

1. Random-HB#: X,Y random

2. HB#: X,Y Toeplitz Matrices

)(vwt )1Pr( iv

The HB# protocol’s security


Based on MHB: an extension of the HB puzzle

HB# is secure against the PASSIVE, DET, GRS-attack There is a MIM attack

Ouafi, K., Overbeck, R., Vaudenay, S.: On the Security of HB# against a Man-in-the-Middle Attack. In: Proceedings of Asiacrypt, Springer LNCS, vol. 5350, pp.108-124 (2008)

Vectorial Boolean Functions


Vectorial Boolean Functions with m inputs and n outputs: mn FFF 22:

Gold Boolean Functions


Gold, R.: Maximal recursive sequences with 3-valued recursive crosscorrelation functions. IEEE Transactions on Information Theory, vol. 14, pp. 154-156, 1968

Power functions on a field

where Algebraic Degree = 2 BalancedAPNHigh nonlinearity

dxxnF2

1),gcd(,2 1 nid i

The GHB# protocol


Modify the HB#

Φ is a Gold Boolean function!

Complexity and other issues


Practically the same the behavior as the HB# protocol

False acceptance rate

False rejection rate

Storage complexity. The memory cost for the tag; i.e. the storage for the two secret matrices, is (kX +kY)m bits.

Communication complexity. The protocol requires (kX +kY + m) bits to be transferred in total.

Security analysis


Provably PASSIVE, DET and MIM secure It is based on the MHB puzzle like the HB#

(Actually, similarly to the HB# proofs our reduction uses rewinding)

The resistance against the MIM attacks is due to the APN property of the Gold function

Intuitive approach


From the presentation of Ouafi, K., Overbeck, R., Vaudenay, S.: On the Security of HB# against a Man-in-

the-Middle Attack. In: Proceedings of Asiacrypt, Springer LNCS, vol. 5350, pp.108-124 (2008)

HB#

tvzYbXawt )(

vbXz )()(

tzvbbXXaXwt ))()()()((

Estimation of the acceptance rate

GHB#The acceptance rate is random!

Remember Φ is APN!!!!!

Implementation Issues


Implementation of the Gold functionOptimal normal basisRequires 2m + 1 AND gates and 2m XOR

gates.

Complexity Comparison between GHB# and HB#.

Conclusions


RFID need ultra-lightweight protocolsThe HB family is the most promising

candidateGHB# is provably secureIt has the pros and cons of HB# Further research is needed to improve

implementation complexity

Thank you for your attention


Questions??

ghb#: a provably secure hb-like lightweight authentication protocol

Documents