On Bluetooth Repairing: Key Agreement Based on Symmetric-Key Cryptography

Abstract

Abstract. Despite many good (secure) key agreement protocols based on publickey cryptography exist, secure associations between two wireless devices are often established using symmetric-key cryptography for cost reasons. The consequence is that common daily used security protocols such as Bluetooth pairing are insecure in the sense that an adversary can easily extract the main private key from the protocol communications. Nevertheless, we show that a feature in the Bluetooth standard provides a pragmatic and costless protocol that can eventually repair privateless associations, thanks to mobility. This proves (in the random oracle model) the pragmatic security of the Bluetooth pairing protocol when repairing is used. Setting up Secure CommunicationsDigital communications are often secured by means of symmetric encryption and message authentication codes. This provided high throughput and security. However, setting up this channel requires agreeing on a private key with large entropy. Private key agreement between remote peers through insecure channel is a big challenge. A first (impractical) solution was proposed in 1975 by Merkle [19]. A solution was proposed by Diffie and Hellman in 1976 [12]. It works, provided that the two peers can communicate over an authenticated channel which protects the integrity of messages and that a standard computational problem (namely, the Diffie-Hellman problem) is hard.To authenticate messages of the Diffie-Hellman protocol is still expensive since those messages are pretty long (typically, a thousand bits, each) and that authentication is often manually done by human beings. Folklore solutions consist of shrinking this amount of information by means of a collision-resistant hash function and of authenticating only the digest of the protocol transcript. The amount of information to authenticate typically reduces to 160 bits. However, collision-resistant hash functions are threatened species these days due to collapses of MD5, RIPEMD, SHA, etc. [9,23,24,25,26]. Furthermore, 160 bits is still pretty large for human beings to authenticate. Another solution using shorter messages have been proposed by Pasini and Vaudenay [20] using

SAS-Based Group Authentication and Key Agreement Protocols

“…Bellare and Rogaway formalised a corresponding security model [3,4] where an adversary can execute several protocol instances concurrently and succeeds in deception if at least one protocol reaches an accepting state with incorrect outputs. The model was later extended to capture security of key agreement protocols [2] and then used in the context of manual authentication [21,20,17,18].…”

SAS-Based Authenticated Key Agreement

“…We adopt the security model from [Vau05,Vau06,PV06] based on the one from Bellare-Rogaway [BR93]. We consider a network of participants which are located at some nodes.…”

RFID Authentication Efficient Proactive Information Security within Computational Security

“…The underlining assumption of this protocol is that the adversary is not listening in at least one of each n successive interactions between the Tag and the Verifier. In essence, AP 1 protocol extends the "minimalist" security model in [12] and the assumptions made in [18]. The underlying assumption of AP 1 is that each communication session is atomic.…”