A Terrorist-fraud Resistant and Extractor-free Anonymous Distance-bounding Protocol

Abstract

International audienceDistance-bounding protocols have been introduced to thwart relay attacks against contactless authentication protocols. In this context, veri-fiers have to authenticate the credentials of untrusted provers. Unfortunately , these protocols are themselves subject to complex threats such as terrorist-fraud attacks, in which a malicious prover helps an accomplice to authenticate. Provably guaranteeing the resistance of distance-bounding protocols to these attacks is a complex task. The classical countermeasures usually assume that rational provers want to protect their long-term authentication credentials, even with respect to their accomplices. Thus, terrorist-fraud resistant protocols generally rely on artificial extraction mechanisms, ensuring that an accomplice can retrieve the credential of his partnering prover. In this paper, we propose a novel approach to obtain provable terrorist-fraud resistant protocols without assuming that provers have any long-term secret key. Instead, the attacker simply has to replay the information that he has received from his accomplice. Based on this, we present a generic construction for provably secure distance-bounding protocols, and give three instances: (1) an efficient symmetric-key protocol, (2) a public-key protocol protecting the identities of the provers against external eavesdroppers, and finally (3) a fully anonymous protocol protecting the identities of the provers even against malicious verifiers trying to profile them

Distance-Bounding Protocols: Verification Without Time and Location

“…It is therefore the first fully automated formal verification framework for distance-bounding protocols. With our automated verification, we identified unreported vulnerabilities in two recent protocols: a mafia-fraud and a distancehijacking attack on the TREAD protocol [24], and a distancefraud attack against the EMV-based contactless payment protocol PaySafe [25].…”

“…To explain the overall methodology we use to analyse distance-bounding protocols, we perform a comprehensive analysis of the Terrorist-fraud Resistant and Extractor-free Anonymous Distance-bounding (TREAD) protocol [24] in Section 6.1. Later on, in Section 6.2 we show and discuss the results of our automated verification.…”

“…Various protocols have been proposed following this characteristic of Brands and Chaum's approach, e.g. [21,22,23,24,25] whilst others employ Hancke and Kuhn's design, such as [26,27,28,29,30].…”

“…Originally, a terrorist-fraud attack consisted in a far-away dishonest prover passing the distancebounding protocol with the help of the adversary, but without leaking the prover's long-term key [6]. Many attempts to formalize this intuition have been made in computational models [8,37,38,24]. Yet, there seems to be no agreement on the appropriate definition.…”

Distance bounding under different assumptions

“…Indeed, the threat model for DB is in constant evolution [23], and new attacks appear regularly: [4,11] present more than 40 protocols, most of which are vulnerable to at least one attack. In particular, the notion of terrorist fraud and how to provably resist it lead to numerous publications, e.g., [5,21,24,39].…”