Evaluating the security of one-way key chains in TESLA-based GNSS Navigation Message Authentication schemes

Abstract

In the proposals for Global Navigation Satellite Systems (GNSS) Navigation Message Authentication (NMA) that are based on adapting the Timed Efficient Stream Loss-Tolerant Authentication (TESLA) protocol, the length of the one-time keys is limited (e.g. to 80 bits) by the low transmission rate. As a consequence, the hash function that is used to build the one-way key chain is constructed having a longer, secure hash function (e.g. SHA-256), preceded by a time-varying yet deterministic padding of the input and followed by a truncation of the output. We evaluate the impact of this construction on the collision resistance of the resulting hash function and of the whole chain, and show that with current proposed parameters, combined with the use of efficient hashing hardware, it can lead to a feasible attack with significant collision probability. The collision can be leveraged to mount a long lasting spoofing attack, where the victim receiver accepts all the one time keys and the navigation messages transmitted by the attacker as authentic. We conclude by suggesting possible modifications to make TESLA-based NMA more robust to such attacks.

Modified Timed Efficient Stream Loss-tolerant Authentication to Secure Power Line Communication

“…TESLA is widely used to authenticate broadcast messages [31,32], such as DoS attack-tolerant TESLA-based broadcast authentication protocol in Internet of Things [33]. We first present an overview of TESLA by outlining properties that make TESLA suitable for securing PLC for load management systems.…”

Parameter Selection for the TESLA Keychain

“…This characteristic of being deterministic offers receivers the ability to recover the keychain in the event that messages are lost, but it also allows attackers the ability to carry out pre-computation attacks. The addition of a "salt", or cryptographic randomness, to the key creation process has been proposed in previous literature [5][7] [8]. This salt can come in the form of incorporating a time-varying hash function that changes with each iteration of key creation in the keychain.…”

“…The keys in the keychain will be derived from this one-way function by truncating the output of the hash to create each key. In [5], it was pointed out that one needs to be careful when truncating the output of the SHA256 function to create the keychain. A pre-image or second pre-image becomes more likely to be found as the amount of truncation increases.…”

“…This paper is divided into the following sections: Section II provides an overview of the TESLA algorithm; Section III briefly introduces the probabilistic model for TESLA security from [5] and derives an updated version of the attacker model; Section IV covers the trade space for the TESLA keychain design that is within the scope of this paper; Section V provides results and Section VI provides conclusions and recommendations from the trade space analysis.…”

Quantum‐resistant authentication algorithms for satellite‐based augmentation systems

“…Both symmetric and asymmetric algorithms have been proposed as digital authentication methods for GNSS and SBAS, and both sets of algorithms are built upon primitives that are assumed to be hard to break. For asymmetric algorithms, the primitive discussed here is the digital signature based on the discrete logarithm, and for symmetric algorithms, it is the one‐way hash function.…”