On the Pseudorandom Function Assumption in (Secure) Distance-Bounding Protocols

Abstract

Abstract. In this paper, we show that many formal and informal security results on distance-bounding (DB) protocols are incorrect/ incomplete. We identify that this inadequacy stems from the fact that the pseudorandom function (PRF) assumption alone, invoked in many security claims, is insufficient. To this end, we identify two distinct shortcomings of invoking the PRF assumption alone: one leads to distance-fraud attacks, whilst the other opens for man-in-the-middle (MiM) attacks. First, we describe -in a more unitary, formal fashion-why assuming that a family of functions classically used inside DB protocols is solely a PRF is unsatisfactory and what generic security flaws this leads to. Then, we present concrete constructions that disprove the PRF-based claimed security of several DB protocols in the literature; this is achieved by using some PRF programming techniques. Whilst our examples may be considered contrived, the overall message is clear: the PRF assumption should be strengthened in order to attain security against distance-fraud and MiM attacks in distance-bounding protocols!

Towards Secure Distance Bounding

“…Table 1 gives the probability of success of the best known attacks. This table does not consider possibly bad pseudorandom function (PRF) instances [5] nor any terrorist fraud based on noise tolerance [19]. These aspects will be discussed later in the present paper.…”

“…2 which we call DBENC in [5]. Here, only a 1 is derived from the initial nonces and a 2 is set to a 1 ⊕ x.…”

“…2. The DBENC Distance-Bounding protocol [34,5] the verifier, thanks to x. Other instances of DBENC where a 2 = a 1 ⊕ x are replaced by addition modulo some q or addition with a random factor, can also be broken, as shown in [4].…”

“…Unfortunately, this assumption alone is not enough to guarantee the security and some related security results from the literature are incorrect. Indeed, as shown in [5], we can artificially construct PRFs which make the protocol insecure. The PRF construction is done by PRF programming.…”

“…The idea is that a prover holding a key x proves to a verifier that he is close to him. Ideally, this notion should behave like a traditional interactive proof system in the sense that it must satisfy:-completeness (i.e., an honest prover close to the verifier will pass the protocol with high probability)This invited paper summarizes results from [4,5,6,7,8]. …”