Achieving Better Privacy for the 3GPP AKA Protocol

Abstract

International audienceProposed by the 3rd Generation Partnership Project (3GPP) as a standard for 3G and 4G mobile-network communications, the AKA protocol is meant to provide a mutually-authenticated key-exchange between clients and associated network servers. As a result AKA must guarantee the indistinguishability from random of the session keys (key-indistinguishability), as well as client- and server-impersonation resistance. A paramount requirement is also that of client privacy, which 3GPP defines in terms of: user identity confidentiality, service untraceability, and location untraceability. Moreover, since servers are sometimes untrusted (in the case of roaming), the AKA protocol must also protect clients with respect to these third parties. Following the description of client-tracking attacks e.g. by using error messages or IMSI catchers, van den Broek et al. and respectively Arapinis et al. each proposed a new variant of AKA, addressing such problems. In this paper we use the approach of provable security to show that these variants still fail to guarantee the privacy of mobile clients. We propose an improvement of AKA, which retains most of its structure and respects practical necessities such as key-management, but which provably attains security with respect to servers and Man-in-the- Middle (MiM) adversaries. Moreover, it is impossible to link client sessions in the absence of client-corruptions. Finally, we prove that any variant of AKA retaining its mutual authentication specificities cannot achieve client-unlinkability in the presence of corruptions. In this sense, our proposed variant is optimal

A Method for Proving Unlinkability of Stateful Protocols

“…fixes) have been shown (resp. proposed) in the literature [7], [20], [24], [13]. We study here a simplified version of the AKA protocol, inspired from the different fixes proposed in the literature.…”

“…We study here a simplified version of the AKA protocol, inspired from the different fixes proposed in the literature. More specifically, we add a challenge-response mechanism at the beginning of the protocol to avoid the encrypted IMSI replay attack [20]. With this modification, we add the generation of fresh nonces for the network and the mobile station, thus the resynchronisation mechanism using the sequence number becomes useless and we remove this sequence number, which takes away the main difficulty of the original protocol.…”

Novel 5G Authentication Protocol to Improve the Resistance Against Active Attacks and Malicious Serving Networks

“…For this protocol, some of the older identified attacks still hold. For instance, there are the attacks of [19]- [21] that exploit the usage of the different types of failures, MAC based or synchronization based, to track a specific subscriber. In the attack, an old authentication challenge already received by the subscriber needs to be replayed and identification of the same subscriber is obtained in case a synchronization failure is replied.…”

A Formal Treatment of Accountable Proxying Over TLS

“…RELATED WORK Two-party authenticated key-exchange protocols are an old and well-studied primitive [2] and various notions of channel security have been formalized and applied to TLS 1.2 [20], [25], [8], [22], [31], [36], [27] and 1.3 [13], [14], [19], [16], [3], [28], [23], [26], [21]. However, as Bhargavan et al [4] showed in the context of TLS, and as Alt et al [1] and Fouque et al [17] -in the context of mobile networks, expanding two-party handshakes to include even a single, dedicated middlebox can expose the obtained channel to serious attacks. Our work reuses some parts of [4]'s security model, specifically the elegant way in which multiparty protocols can be viewed as compositions of 2-party AKE schemes; however, the scope of our paper is fundamentally different.…”