any < 1/2 by Katz and Smith [KS b]. It should be noted that in all those security proofs, ky and are only the parameters on which depend the resulted adversary against the LPN problem, the other parameters only a ect the gap of the reduction.

3.5The GRS Attack

Soon a er its publication, Gilbert, Robshaw and Sibert exhibited an attack against HB+ that can be carried by a man-in-the-middle adversary [GRS ]. Before going any further, it is worth noting that such an adversary is stronger than the active adversary considered in the security analysis of HB+. So, the GRS attack does not contradict the security claims mentioned in [JW a, KS a, KS b]. In the same time, the adversary considered by Gilbert et al. is also weaker than the usual man-in-the-middle adversary as, to carry out the attack, the adversary is only required to manipulate messages going from the veri er to the prover. For this reason, such adversaries are called GRS adversaries and a protocol secure against any GRS adversary is said to be secure in the GRS model.

e GRS attack against HB+ consists in changing the a value sent by the veri er. Taking a constant kx-vector , the adversary replaces each a of the r rounds of the protocol by a . Upon reception of each of these message, the prover computes

z = a x x b y :

Hence, the veri er accepts when x = 0. In the case where x = 0, the success probability is not altered and the prover authenticates successfully with probability 1 PFR. In the other case, i.e., when x = 1, all the noise bits become ipped and the probability

Depending on the outcome of the protocol, the adversary deduces one linear equation in x. at equation is correct with a probability of at least (1 PFR). e secret vector x can then be recovered by launching kx instances of the protocol and altering the a messages with di erent

Note that this attack can be optimized by carefully choosing the vectors i. For instance, the adversary can choose i as being the vector with only the bit at position i set to and the others set to 0. In this case, i x = xi so the adversary deduces this bit from the outcome of

.

as x. Hence, she succeeds in time complexity O(ky) and probability (1 pFR)k. We remark that this second phase is not mandatory for all attack scenarios. If, for example, the goal of the adversary is to impersonate the prover to the veri er, then recovering y is unnecessary: Once the adversary learns x, she only has to choose b = 0 so that the nal response z does not depend on y.

As Juels and Weis [JW b] noted, it may be possible to counter this attack by introducing extra defense mechanisms. For instance, the veri ers can have a detection mechanism that consists of stopping the system from performing authentications or revoking the shared key

aer a xed number of authentication failures is reached. As the manipulations of the adversary induce an acceptance rate of 1/2 for the kx protocol sessions needed to recover x, setting

athreshold lower than kx/2 for the number of failed authentications would limit the success probability of the attack.

3.6Attempts to Thwart the GRS Attack

A er the publication of the GRS attack on HB+, several HB-related candidates were proposed to obtain a lightweight protocol based on the LPN problem secure in the GRS model.

In this section, we review a certain number of these protocols.

. . HB++

HB++ was proposed by Bringer, Chabanne, and Dottax [BCD ] to yield an HB-related protocol that is secure in the GRS model.

e protocol is depicted in Figure . . It works in two phases. In the rst phase, two parties who share a secret key Z agree on a session key consisting of a quadruplet (x; x′; y; y′). For that, both participants exchange k-bit vectors A and B and compute (x; x′; y; y′) h(A; B; Z), where h is a universal hash function. e second phase of the protocol is similar to HB+, i.e., the two parties exchange k-bit vectors a and b. en the prover picks two bit noises ; ′ following the bernoulli distribution with parameter . He then sends to the verier z = a x b y , as in HB+, and z′ = f(a) i x′ f(b) i y′ ′. e veri er then accepts the session of both relations hold. As for HB+, both participants run the protocol for r rounds and authentication succeeds if more than t sessions get accepted. HB++ can

.

a x b y = z and

f(a) i x′ f(b) i y′ = z′

Figure 3.3: e HB++ protocol. One complete protocol instance consists of one session key derivation protocol and r authentications. such rounds. f is a permutation and f( ) i refers to the bit rotation by i bits to the le in little endian notations.

be seen as two parallel instances of the HB protocol with independent secrets but correlated challenges.

Concerning its security in the GRS model, the authors of HB+ gave arguments regarding adversaries who modify the a message of all rounds of a protocol instance. Despite this, Gilbert, Robshaw, and Seurin [GRS a] proposed an adversary who only disturbed the rst s rounds by adding a constant vector to each vector a in a way similar to the GRS attack against HB+. eir subsequent analysis proved that this attack succeeds in producing a linear equation in the session secrets x and x′ if the attacker disturbs s 2 1t 2r ; 21t 2r rounds. As for the sake of correctness, false rejections have to happen with small probability, it must be

cure when no session key is established, i.e., if (x; x′; y; y′) is the long term key. Nevertheless, Gilbert, Robshaw, and Seurin were able to extend the attack to the case in which session keys are used.

. . HB

HB was proposed by Duc and Kim [DK ]. Again, this protocol consists of running r rounds and authentication succeeds when at least t of these rounds succeed. However, the protocol di ers for HB+ in that participants are given an extra k-bit secret vector s that is used in the beginning of the protocol to securely send a bit . is is done by having the

.

Figure 3.4: One round of the HB protocol. e protocol consists of r such rounds.

prover generate a random bit following a Bernoulli distribution of parameter ′ along with a k-bit vector b and sending b with w = b s . With the knowledge of s, the veri er can

veri er then veri es whether the z he receives is consistent using the appropriate equation.

Regarding its security, Duc and Kim provided a heuristic analysis. Concretely, they argued that since no adversary can recover ( is leads to a direct attack against the LPN problem), the GRS attack does not apply as the adversary cannot know whether it is adding x ory to z. However, Gilbert, Robshaw, and Seurin [GRS a] demonstrated that the success probability of the GRS manipulation applied to HB is dependent on x and y. In short, every value for the pair ( x; y) induce a di erent success probability which can be easily computed. Hence, it is su cient to run the same attack several times to deduce the success probability of the protocol with the manipulation, and therefore deducing the value of x and y. Repeating the whole attack k times, the adversary obtains two well de ned systems of linear equations which she can solve to retrieve x and y.

. . PUF-HB

Hammouri and Sunar [HS ] proposed to combine HB+ and physically unclonable functions (PUF) to obtain a tamper-resilient authentication protocol secure against GRS-like attacks.

.

Figure 3.5: One round of the PUF-HB protocol. e protocol consists of r such rounds.

A PUF is a function that is embodied in a physical structure and is easy to evaluate but hard to predict [GCvDD ]. Moreover, an individual PUF device must be easy to make but practically impossible to duplicate, even given the exact manufacturing process that produced it. Nevertheless for some types of PUFs, it is possible to obtain a good approximation of the PUF, up to an error rate of 3 for delay-based PUFs [GCvDD ], which in the case of an HB-like protocol can incorporated in the LPN problem’s Bernoulli noise.

PUF-HB is very similar to HB+ and di ers in the use of the PUF to compute the prover’s answer. As it is shown in Figure . , instead of computing a x like in the HB+ protocol, the prover computes PUF(a). In other words, the secret in PUF-HB consists of a single binary vector y. e prover initiates a protocol instance by sending a nonce b to which the veri er replies with a challenge a. e prover’s answer is then computed by picking a bit Ber( ) and z = PUF(a) b y . Having a function PUFϵ( ) approximating the PUF, the veri er checks that the equality z = PUFϵ(a) b y holds. If a er the procedure is repeated r times, the veri er has accepted at least t rounds, the protocol succeeds.

Using the non-linearity of the PUF function, the authors of PUF-HB argued that the GRS attack does not apply to their protocol. ey however do not show whether it can resist other variants of the GRS attack and only proved that PUF-HB is resistant to active adversaries, just like HB+. As it was already pointed at in [OOV ] and[Seu ], PUF-HB can easily be shown to be vulnerable to man-in-the-middle attacks. at is, a man-in-the-middle adversary who can modify messages going from the prover to the veri er can change all b messages to b and check whether the authentication succeeds or not. When authentication succeeds, the attacker learns that y = 0 with probability 1 PFR. Otherwise, she deduces thaty = 1, which holds with probability 1 PFA. Running this attack k times yields enough equations to solve a linear system and recover y.

Having said that, we can even show that PUF-HB is not secure in the GRS model for most PUFs. We only cover the case of delay-based PUFs but the attack generalizes to other types of PUFs that are vulnerable to modeling attacks [RSS+ ]. (In fact, the PUFs considered in the latter paper cover most proposed PUFs.) Delay-based PUFs can be modeled by a linear

.

We remark that the

e rstHB-relatedprotocolthatprovedtobeimmuneintheGRSmodelisHB [GRS b] for which we dedicate the next Chapter.

.