On the (im)possibility of perennial message recognition protocols without public-key cryptography

Abstract

A message recognition protocol (MRP) aims to exchange authenticated information in an insecure channel. During the initialization session of the protocol, the parties exchange some authenticated information which the adversary can passively observe. Then, one party wants to send authenticated messages to the other party over an insecure channel. Such security requirements are often found in wireless sensor networks.A perennial MRP is one that is able to recover from the adversarial interference, no matter how long the adversary has been active before it stops. MRPs based on hash chains are not perennial because after fixing the length of the hash chain in the initialization phase, authentic communication is not possible if the adversary interferes until all elements of the hash chain have been consumed.Perennial MRPs can be trivially built from public-key primitives. In this paper we present very strong evidence that they cannot be constructed from "cheap" primitives. Namely, we show in the symbolic model of cryptography, perennial MRPs cannot be built using just hash functions and XORing. The result also covers other symmetric primitives, e.g. encryption. The result explains why all previous attempts to construct perennial MRPs from those primitives have failed. The result also has interesting implications regarding authentication protocols in general, and the gap between formal and computational models of cryptography.

Robotics cyber security: vulnerabilities, attacks, countermeasures, and recommendations

“…The security analysis shows that this scheme is secure against the known attacks for authentication protocols including replay and man-in-themiddle attacks. However, González Muñiz and Laud stated that symmetric-key techniques were not enough to construct message recognition protocols in [284]. Moreover, the authors also presented a very strong evidence that Message Recognition Protocols (MRPs) cannot be built from "cheap" primitives using only hash functions and XORing.…”

Implementing Cryptographic Primitives in the Symbolic Model

“…This can hinder the generalization of certain kinds of results. For example, as stated, the impossibility result of [13] only applies to hash functions and XOR operations.…”

“…The technique does not require the prover to universally quantify over processes and contexts, but just provide an observationally equivalent process to a specific, the "most powerful" attacker against processes using the implementation of the primitive. We apply the technique by providing a secure implementation for the randomized symmetric encryption primitive in terms of one-way hash functions and exclusive or, thereby generalizing our impossibility result [13].…”