Figure 9.1: A correct, secure, and Strong-private RFID authentication protocol based on an IND-CPA and PA + plaintext-aware public-key encryption scheme.

eorem .

Assume that the public-key encryption scheme used in the RFID scheme of Fig. . is correct, PA + plaintext-aware, and IND-CCA secure. If 2 and 2 are negligible, then the scheme is correct, secure, and Strong private.

9.9Security Proof

. . Correctness

Correctness is trivially shown using the encryption scheme’s correctness and the fact that the scheme is stateless.

. . Security

Since the scheme complies to De nition . for simple RFID protocols, we can apply simple security using an adversary who creates a single tag ID and makes (sk; a′; c′; ID′; KID′) queries (with the restriction ID′ ≠ ID). ese queries consist in checking whether Decsk(c′) = ID′ KID′ a′. We also let a be the output of S R ( ; ).

We construct an algorithm B who receives pk and simulates the RFID system, A, and all oracle queries without sk. We further make B output A’s output. To handle A’s queries, B is given an access to a decryption oracle that she queries with c′ and later checks whether the plaintext is equal to ID′ KID′ a′. We now use a sequence of games in which Si denotes the event that the adversary wins Game i.

Game . We let this game be the security experiment played by a xed A that has her environment simulated by B. Let S0 be the event that the adversary wins the security experiment.

Game . We rst make a change in Game and de ne Game as being the same except that S ( ; ) never produces an a that was sent before to the S T in-

.

terface. In other words, we require that A never guesses a. As a is chosen uniformly, when A makes s calls to S T , the probability of this event happening is bounded by s2 so that

j Pr[S0] Pr[S1]j s2 :

Since s is polynomially bounded, this probability is negligible when 2 is negligible.

Game . We de ne Game in which A never issues a S R (c; ) query for a c that was obtained from a S T (a ; vtag) query. Since S T never received a, the decryption of the ciphertext the adversary submits must fail to match the a chosen by the reader for session and the R interface answers with 0. erefore, the adversary always loses the game when this event occurs and we have

Pr[S1] Pr[S2] = 0

Game . In Game we modify the S T (a; vtag) interface so that instead of encrypting of ID KID a, itencryptsarandom R ofthesamelength. (Recallthatnosuchoutput is sent to the reader.)

We now construct a hybrid argument to show that j Pr[S3] Pr[S2]j is negligible. For that, we rst let B3(i) be an hybrid blinder that acts as follows: e i rst S T (ai; vtag) queries submitted by the adversary are treated by encrypting ID KID ai and the rest by encrypting random strings. We let C denote an INDCCA adversary who plays the IND-CCA game, simulating B2(i)/B2(i + 1) by submitting ID KID a (as in B2(i + 1)) and R (as in B2(i)) to the IND-CCA challenger who randomly chooses one of the messages and returns its encryption. C then continues B2(i)/B2(i + 1)’s execution and returns its output. e di erence in the output of B2(i) and B2(i + 1) can thus be expressed as a distinguisher advantage for the IND-CCA game which is negligible by assumption. erefore, we nd that

j Pr[S3] Pr[S2]j = negl(k):

At this point, A is receiving messages that are not related to KID. Clearly, the only way for her to win the game is to guess KID which happens with probability 2 . In other words,

Pr[S3] = 2

erefore, the scheme is secure.

.

.

the simulation by itself. Regarding the R oracle, C just queries a decryption oracle and checks whether the decrypted message matches.

e rst i 1 S T queriesaremadetotheIND-CCA challengerinareal-or- random version. e challenge ciphertext c in the IND-CCA game is the answer

Bi

from the challenger. It is either a real answer (as in the A1 2 simulation) or a simu-

Bi+1

lated one (as in the A1 2 simulation). Note that no R query is made on the session in which the adversary sent c (this case has been taken care of in Game ).

which is negligible as r is polynomially bounded and the scheme is IND-CCA secure.

Atthispoint,wecanlegitimatelyconsideranadversary A2 whomakesnoS T queries.

Game . WenowsimulateallremainingR queries. Todoso, weconstructanadversary E playing the PA ++ game.

is adversary takes the public key then simulates A2 interacting with the RFID system. Recall that, like in Game , the algorithms and oracles of the scheme do not depend on the secret key, except for the R queries that will be treated herea er. We let E simulate the RFID system to A2, handling her queries as follow:

Assuming w.l.o.g. that session identi ers are not randomized, L is deterministically computed by E.

E simulates S R queries by asking the oracle OS to sample from the uniform distribution over f0; 1g . It then forwards the received answer to A2.

D T (Samp) queries are handled by asking the randomness oracle OS

to sample from the distribution speci ed by Samp to get one or more random ID. If any of the returned identi ers corresponds to a drawn tag, E outputs ?. Otherwise, it generates, deterministically and for each returned IDi, a fresh vtagi and inserts the pair (vtagi; IDi) into the table T . A er that, and for each IDi, it sets the bit bi to 1 if IDi is legitimate, and to 0 otherwise. At last, it returns ((vtag1; b1); : : : ; (vtagn; bn)) to A2.

.

C (vtag) makes E reveal ID = T (vtag). Moreover, E looks for the

entry (ID; KID) in DB0 and DB1. If that corresponding entry contains a KID di erent from ′ ′, then it returns it. Otherwise, it queries OS to sample from the uniform distribution over f0; 1g and assigns the answer to KID. It subsequently updates the entry (ID; ) to (ID; KID) and returns this last pair as its answer. We further assume that whenever the tag ID is a legitimate one, E inserts the entry (ID; KT (vtag)) in a table TE .

To simulate the R ( ) oracle for an instance with transcript (a; c),

Esends c to the decryption oracle, checks that the recovered plaintext is of the form ID KID a, that it matches a tag state ID KID obtained from a previous C query on a legitimate tag. If this is the case, the answer to R must be , otherwise, the simulated answer is . Note that when the output of the E regarding a R query is , the genuine R query would also have answered . is is because that, knowing a subset of the database through corruption query, E can e ectively predict the answer when the database entry lies in this subset. Errors in the simulation thus occur when

Epredicts 0 and the genuine R query would also have outputted in a session without matching conversation. Clearly, the failure of one of E’s simulations corresponds to the happening of the event that A2 wins the security game, that we denoted E in the previous section. In other words,

Since we assumed the encryption scheme to be PA ++ plaintext-aware, we can use the plaintext extractor E of E to replace the decryption oracle without signi cantly altering the outcome distribution. However, E requires the view of E instead of the view of A2, so we cannot use it as an extractor for A2. Fortunately, it is possible to reconstruct that view given the adversary’s random tape and its queries. At rst, we note that E’s random coins are only used to initialize A2. Furthermore, all the randomness E obtains from OS to process C queries is revealed to A2. Moreover, since A2 is simulatable, we can use the algorithm A′2, induced by De nition . , to reconstruct, from A2’s view, a table T ′ indistinguishable from T . Since this table lists all the mappings between real and virtual identi ers, it is straightforward to reconstruct a randomness for E that she received to process the D T queries using the Samp 1 algorithms corresponding to the sampling queries of A2. We let this whole operation be carried by a polynomial-time algorithm V that takes as input the view of A2 and uses A′2 to reconstruct a view of E, i.e., it is such that V(viewA2 ) and viewE are indistinguishable. It follows that E (pk; ; V(viewA2 )) and E (pk; ; viewE ) are indistinguishable.

At this point, we are able to de ne B3, the partial blinder for R queries. Similar to E, we assume that B3 maintains a table TB3 containing a list of pairs (ID; KID)

.

for corrupted legitimate tags. In order to simulate a R query on an instanceof transcript (a; c), the blinder proceeds as follow.

a)e blinder calls upon E (pk; c; V(viewA2 )) to get Decsk(c) = ID KID a′.

b) A er that, it veri es that a = a′ and outputs 0 in case of failure. Otherwise, it continues.

c)en, it outputs 1 if the pair ID KID is listed in TB3 . Otherwise, it outputs 0.

e probability that Step fails can be expressed as a distinguisher advantage of the PA ++ game or between V(viewA2 ) and viewE , so

At the same time, Step fails when the event E occurs, so using triangle inequalities we conclude that

Recalling that E occurs with negligible probability and that the scheme is PA ++ plaintext-aware, the quantity above becomes negligible. Hence, B3 describes a successful blinder for the R oracle.

Game . In this game, we get rid of S R queries. is can easily be achieved by constructing a blinder B4 that returns uniformly distributed values from the set f0; 1g . Clearly, simulation is perfect as both distributions are perfectly indistinguishable. Hence,

Pr [A3 ! 1] = Pr[AB3 4 ! 1]

Game . Finally, we have an adversary A4 who only produces L queries. Since these are generated deterministically, we can trivially simulate the L oracle using a blinder B5. It follows that

Pr [A4 ! 1] = Pr[AB4 5 ! 1]

In the end, we have obtained an adversary A5 = AB, with B = B1 B5, who does not produce any oracle query that is such that

e scheme is thus Strong private.

.

9.10Perspective and Future Development

Toovercomethelimitationsputonsamplingqueries, wemayuseastrongernotionofplaintextawareness by adding auxiliary inputs to the adversary in the plaintext-awareness de nitions. If an encryption scheme could ever be proved to be auxiliary-PA + , then we would be able to achieve Strong privacy against adversaries who have no restriction on the choice of the efcient sampling algorithms to use.

e di culty in achieving this notion lies in how to simulate the avdersary’s behavior if it depends on the system’s randomness. In such cases, the extractor would need to be able to execute the adversasary “in the same way” it is executed in real conditions. Unfortunately, giving to the extractor the history of queries of the adversary cannot help

.