Albeit Bellare and Palacio showed that the two latter notions together imply the former, it was not clear whether plaintext-awareness could serve any purpose that INDCCA security could not meet. We proved that using an IND-CCA secure encryption scheme does not yield a Strong private protocol and instantiating the same protocol with an IND-CPA secure and PA plaintext-aware encryption scheme results in a Strong private protocol.

. We extended our results to protocols o ering mutual authentication, i.e., in which the reader is also required to authenticate to a tag. In these settings, we showed that our de nition of privacy invalidates the results obtained by Armknecht et al. concerning the PV model. While they have demonstrated that no secure protocol can be NarrowStrong private with Vaudenay’s de nitions, we showed that Strong privacy, in our settings, with mutual authentication is achievable.

. We proposed a tradeo for Forward privacy by lowering its requirements by a small margin to allow protocols using lightweight cryptography to achieve a certain form of forward privacy. Concretely, these protocols ensure the privacy of all the tags’ actions that occurred before their secrets leaked to the adversary except for the last session in which a tag was involved before corruption if it did not end properly.

11.1The Security of RFID Primitives

e rst part of thesis was dedicated to analyzing the security of dedicated cryptographic primitives for RFID tags.

. . Our Contributions

Regarding the security of primitives dedicated to RFID tags, we mainly gave two contributions in analyzing the security of the protocol HB and the message authentication code S UASH.

e Security of the HB Protocol. We rst challenged the conjecture establishing the security of HB against man-in-the-middle adversaries. We showed that if an adversary can alter all messages transiting through the wireless channel set between a tag and a reader and if she has access to the result of each protocol session, she can recover the tag’s secret without tampering. We provided complexity analysis of the attack and showed a bound on the parameter that separated the case in which the attack is asymptotically polynomial from exponential.

e rst parameter set proposed by the authors of HB fell into the case in which the attack is polynomial and we showed that the tag’s secret can be retrieved by solving a system of linear equations a er disturbing messages in 220 protocol instances. e attack complexity for parameter set II is higher as the attack is exponential in the security parameter. Nevertheless, we

.

were still able to retrieve the secret a er disturbing 235 protocol sessions and solving a system of linear equations.

Possible xes to render HB immune to man-in-the-middle attacks were also analyzed. We looked at the possibility of lowering the error threshold or to bound the number of errors the prover introduces in its answer so that it always gets accepted. Unfortunately, both solutions turned out to be also vulnerable to variants of the attacks on HB .

S UASH. e second primitive we studied is the message authentication code S UASH. WeconcentratedonitssecurityargumentsanditsconnectiontotheRabinencryptionscheme. We separated the security of the two primitives by mounting an attack against the earlier version of S UASH that enables an adversary who has access to an oracle returning the MAC of messages it receives to recover the secret key. is attack scenario readily applies to challengeresponse protocols based on a MAC where the challenger, i.e., the reader in the context of RFIDs, sends a message to the prover, i.e., the tag in the context of RFIDs, which replies with the MAC of the received message.

Intheend,ourattackstrategyallowsustorecoverS UASH’ssecretkeysusing210 messages if the modulus 21277 1 is used for Rabin’s function. Replacing S UASH- ’s NLFSR with a linear one, we were able to recover the secret key using 64 queries to the MAC oracle.

. . Further Work

Although new protocols based on the LPN problem were proposed and even proven secure against man-in-the-middle attacks, they rely on other components than simple XOR operations. For instance, the MAC constructed by Kiltz et al. uses a secret pairwise independent permutation which in itself needs a large secret key to be added to the one for LPN problem. Basically, the reason for the introduction of this component is to break the linearity of the protocol and thwart the kind of attacks we succeeded in mounting. In this sense, the MAC and subsequent protocol they propose is not entirely built around the LPN problem as HBrelated protocols are. Although linearity provides nice implementation properties, our attack proved it to be a bad feature for security. erefore, in order to obtain a secure version of an HB protocol, it is necessary to design a variant that uses non-linear components. For efciency purposes, the perfect protocol would not rely on any other primitive than the LPN problem.

is linearity property is also at the center of our attack on S UASH. As a consequence, it is very probable that S UASH could be broken if a linear approximation of the mixing function could be found. Still, as we have shown that S UASH’s security is unrelated to Rabin’s, it would be interesting to compare S UASH’s security with a version stripped from Rabin’s squaring, i.e., a MAC that outputs a window of bits from an NLFSR initialized with the key and a message.

.

11.2Privacy in RFID Protocols

e second part of this thesis was devoted to developing our privacy model for RFID systems.

. . Our Contributions

In this part of the dissertation, we concentrated on privacy issues related to RFID systems and developed a model for assessing which level of privacy, if any, an RFID authentication protocol achieves.

e Need for a Privacy Model. e rst step toward proposing our privacy model was to emphasize the need for having one. For that, we used a basic ad hoc model, inspired by the literature of key-exchange protocols and the work of Bellare, Pointcheval, and Rogaway. at model only captured the notion of unlinkability, i.e., that a protocol is private if no adversary can give a relation between tags that were involved in protocol instances with the reader. In line with cryptography’s classical adversarial models, the adversary is assumed to have full control over the communication channel.

Despite working with an incomplete model, we were able to use it to show that several protocols, namely ProbIP, MARP, Auth , YA-TRAP, YA-TRAP+, O-TRAP, RIPP-FS, and the Lim-Kwon protocol, fail to be privacy concealing.

e Shortcomings of the LBdM Privacy Model. We also used that model to study two protocols that were proven to be forward private in the LBdM model, namely O-FRAP and O- FRAKE. As it turns out, both protocols fail to meet this notion in our model, hereby raising doubts on the pertinence of the LBdM model.

Vaudenay’s Privacy Model. We clari ed some notions in Vaudenay’s privacy model such as how tags are selected by the adversary. For that, Vaudenay used a vague term of distribution that is queried to an interface. We formalized this capability by saying that the adversary submits the description of a sampling algorithm which running time is bounded by a polynomial in the security parameter. We also gave two de nitions for the correctness of an RFID pro-

weaker version, proposed to re ect on several protocols proposed in the literature, requires correctness to only hold if the tag has not been involved in more than a certain number of consecutive sessions without being authenticated by the reader.

Relation with Other Models and Variants We compared Vaudenay’s model with several other privacy models dedicated to RFIDs. We looked at the relationship between Vaudenay’s privacy model and both the Juels-Weis and zk-privacy model. We showed that the former is

.

We also discussed an earlier attempt to obtain Strong privacy due to Ng et al., which introduced the rather arti cial class of wise adversaries that do not issue queries for which they already know the answer. Besides being hard to de ne and manipulate, the notion of wise adversaries is hard to motivate.

From Unilateral to Mutual Authentication. We extended our results to cover protocols which o er mutual authentication. In this regard, the corrected formulation of privacy discards the results of Armknecht et al. relative to the impossibility of achieving Narrow-Strong privacy. Moreover, we show that Strong privacy with mutual authentication is achievable using plaintext-aware encryption schemes.

We also revisited Paise and Vaudenay’s Narrow-Strong private protocol, which security theorem was invalidated by Arkmecht et al., and showed that the protocol is still Forward private.

. . Further Work

Further extensions to the model for diverse concrete senario can explored. For instance, we assume in our model that the adversary is able to learn the outcome of authentication. However, several deployed RFID applications give more information to the adversary in leaking

.