Optimal Security Limits of RFID Distance Bounding Protocols

Abstract

In this paper, we classify the RFID distance bounding protocols having bitwise fast phases and no final signature. We also give the theoretical security bounds for two specific classes, leaving the security bounds for the general case as an open problem. As for the classification, we introduce the notion of k-previous challenge dependent (k-PCD) protocols where each response bit depends on the current and k-previous challenges and there is no final signature. We treat the case k = 0, which means each response bit depends only on the current challenge, as a special case and define such protocols as current challenge dependent (CCD) protocols. In general, we construct a trade-off curve between the security levels of mafia and distance frauds by introducing two generic attack algorithms. This leads to the conclusion that CCD protocols cannot attain the ideal security against distance fraud, i.e. 1/2, for each challenge-response bit, without totally losing the security against mafia fraud. We extend the generic attacks to 1-PCD protocols and obtain a trade-off curve for 1-PCD protocols pointing out that 1-PCD protocols can provide better security than CCD protocols. Thereby, we propose a natural extension of a CCD protocol to a 1-PCD protocol in order to improve its security. As a study case, we give two natural extensions of Hancke and Kuhn protocol to show how to enhance the security against either mafia fraud or distance fraud without extra cost.

A framework for analyzing RFID distance bounding protocols

“…As she diverges from the verifier after a certain range she cannot receive also c i−1 , and so on. This leads to some concentric neighborhoods around the verifier which is addressed in [35]. The success probability of the attack may increase as the prover locates in a closer region between those neighborhoods.…”

Security of Distance-Bounding

“…Previous-challenge dependent distance-bounding protocols are analyzed by Kara, Kardaş, Bingöl, and Avoine in [45]. They focus on the low-cost distance-bounding protocols having bitwise fast phases and no final signature.…”

A Novel RFID Distance Bounding Protocol Based on Physically Unclonable Functions

“…The success probabilities against the mafia fraud and distance fraud are both equal to (3/4) n [14,19]. Distance bounding protocols are classified into two classes depending on whether a final signature is involved (e.g., [2,19,20,23,25,32,33]). These papers mostly focused on improving the security against mafia and distance frauds, and in fact some of them achieved the ideal security level (1/2) n against only both frauds.…”