Mutual Chip Authentication - kutylowski.im.pwr.wroc.pl · Mutual Authentication Hanzlik, Kluczniak,...

AnonymousMutual

Authentication

Hanzlik,Kluczniak,Krzywiecki,Kutylowski Mutual Chip Authentication

Lucjan Hanzlik, Kamil Kluczniak, Łukasz Krzywiecki,Mirosław Kutyłowski

Wrocław University of TechnologyWrocław, Poland

ACS, TRUSTCOM 2013, Melbourne

AnonymousMutual

Authentication

Hanzlik,Kluczniak,Krzywiecki,Kutylowski

Introduction

Personal identity cards - eIDstrong cryptographic authentication.wireless communication.

AdvantagesProtection against forgeries.Remote authentication.

E.g.: new German identity card (Personalausweis).

AnonymousMutual

Authentication


Extended Access Control (EAC)

GoalAuthenticated key exchange between a chip and a terminal.

Part 1: Terminal AuthenticationAuthentication of an ephemeral key from the terminal.The ephemeral key is signed by the terminal.

Part 2: Chip authenticationDerivation of a session key.Authentication of the chip by proving the knowledge ofa DH secret key.

AnonymousMutual

Authentication


EAC

Chip TerminalxC - private, xT - signing key,yC = gxC - public, yT - verification key,cert(yC) cert(yT )

Terminal auth

verify certificatecert(yT )←−−−−− choose xep at random

choose rAyep←−− yep := gxep

rA−→ s := SigxT (rA||yep)

verify s with yTs←−

Chip authcert(yC )−−−−−→ verify certificate

K := yxCep K := yxep

CKA := H(K , 1), KA := H(K , 1),KB := H(K , 2) KB := H(K , 2)KC := H(K , 3) KC := H(K , 3)

rB := MACKC(cT )

rB−→ verify tag with KCKsession := (KA,KB) Ksession := (KA,KB)

AnonymousMutual

Authentication


EAC

Chip Terminal

xC - private, xT - signing key,

yC = gxC - public, yT - verification key,

cert(yC) cert(yT )Terminal auth








rB := MACKC(cT )


AnonymousMutual

Authentication


EAC


Terminal auth

verify certificate cert(yT )←−−−−−choose xep at random







rB := MACKC(cT )


AnonymousMutual

Authentication


EAC


Terminal auth

verify certificatecert(yT )←−−−−−

choose xep at random


rA−→s := SigxT (rA||yep)





rB := MACKC(cT )


AnonymousMutual

Authentication


EAC


Terminal auth



rA−→s := SigxT (rA||yep)





rB := MACKC(cT )


AnonymousMutual

Authentication


EAC


Terminal auth





Chip auth

cert(yC )−−−−−→ verify certificate



rB := MACKC(cT )


AnonymousMutual

Authentication


EAC


Terminal auth







C

KA := H(K , 1), KA := H(K , 1),

KB := H(K , 2) KB := H(K , 2)

KC := H(K , 3) KC := H(K , 3)

rB := MACKC(cT )


AnonymousMutual

Authentication


EAC


Terminal auth








rB := MACKC(cT ) rB−→ verify tag with KC

Ksession := (KA,KB) Ksession := (KA,KB)

AnonymousMutual

Authentication


Privacy problems

Terminalstrong evidence of terminal’s presencethe chip can send an x chosen by a third party andthen returns a terminal’s signature of x .the certificates are transmitted in clear, an observergets information who it talking with the terminal

Goalmake interaction between the chip and the terminalanonymous for an observer,preserve simplicity,provable key security and provable anonymity.

AnonymousMutual

Authentication


AMA - Protocol Description

Alice BobxA - private, xB - private,yA = gxA , cert(yA) yB = gxB , cert(yB)random a at random chose b at random

hA := H(a) hB := H(b)

cA := ghAcA−→ cB := ghB

cB←−K := chA

B K := chAB

KA := H(K , 1), KA := H(K , 1),KB := H(K , 2) KB := H(K , 2)K ′

A := H(K , 3), K ′A := H(K , 3),

K ′B := H(K , 4) K ′

B := H(K , 4)

rA := H(cxAB ,K ′

A)EncKA

(cert(yA),rA)−−−−−−−−−−−→ check cert(yA)

rA 6= H(yhBA ,K ′

A)EncKB

(cert(yB),rB)←−−−−−−−−−−− rB := H(cxB

A ,K ′B)

check cert(yB)rB 6= H(yB ,K ′

B)Ksession := H(K , 5) Ksession := H(K , 5)

AnonymousMutual

Authentication



Alice Bob

xA - private, xB - private,yA = gxA , cert(yA) yB = gxB , cert(yB)random a at random chose b at random

hA := H(a) hB := H(b)


cB←−K := chA

B K := chAB


A := H(K , 3), K ′A := H(K , 3),

K ′B := H(K , 4) K ′

B := H(K , 4)

rA := H(cxAB ,K ′

A)EncKA


rA 6= H(yhBA ,K ′

A)EncKB

(cert(yB),rB)←−−−−−−−−−−− rB := H(cxB

A ,K ′B)



AnonymousMutual

Authentication



Alice BobxA - private, xB - private,yA = gxA , cert(yA) yB = gxB , cert(yB)

random a at random chose b at randomhA := H(a) hB := H(b)cA := ghA cA−→ cB := ghB

cB←−K := chA

B K := chAB


A := H(K , 3), K ′A := H(K , 3),

K ′B := H(K , 4) K ′

B := H(K , 4)

rA := H(cxAB ,K ′

A)EncKA


rA 6= H(yhBA ,K ′

A)EncKB

(cert(yB),rB)←−−−−−−−−−−− rB := H(cxB

A ,K ′B)



AnonymousMutual

Authentication



Alice BobxA - private, xB - private,yA = gxA , cert(yA) yB = gxB , cert(yB)random a at random chose b at randomhA := H(a) hB := H(b)


cB←−K := chA

B K := chAB


A := H(K , 3), K ′A := H(K , 3),

K ′B := H(K , 4) K ′

B := H(K , 4)rA := H(cxA

B ,K ′A)

EncKA(cert(yA),rA)

−−−−−−−−−−−→ check cert(yA)

rA 6= H(yhBA ,K ′

A)EncKB

(cert(yB),rB)←−−−−−−−−−−− rB := H(cxB

A ,K ′B)



AnonymousMutual

Authentication




hA := H(a) hB := H(b)


cB←−K := chA

B K := chAB


A := H(K , 3), K ′A := H(K , 3),

K ′B := H(K , 4) K ′

B := H(K , 4)rA := H(cxA

B ,K ′A)

EncKA(cert(yA),rA)

−−−−−−−−−−−→check cert(yA)

rA 6= H(yhBA ,K ′

A)EncKB

(cert(yB),rB)←−−−−−−−−−−− rB := H(cxB

A ,K ′B)



AnonymousMutual

Authentication




hA := H(a) hB := H(b)


cB←−K := chA

B K := chAB


A := H(K , 3), K ′A := H(K , 3),

K ′B := H(K , 4) K ′

B := H(K , 4)

rA := H(cxAB ,K ′

A)EncKA


rA 6= H(yhBA ,K ′

A)EncKB

(cert(yB),rB)←−−−−−−−−−−− rB := H(cxB

A ,K ′B)

check cert(yB)

rB 6= H(yB ,K ′B)

Ksession := H(K , 5) Ksession := H(K , 5)

AnonymousMutual

Authentication


Privacy

Transcript indistiguishabilityA communication transcript is undistinguishable fromrandom values.Certificates are hidden from an eavesdropper, he doesnot know the identity of the communicating parties.It is still true if an adversary gets a batch ofcommunication transcripts.

SimultabilityHolding only the certificate (public key) of a user, wecan generate the transcript with the same probabilitydistribution.A communication transcript cannot be used as a proof,for third parties, that a particular user has participatedin the communication.

AnonymousMutual

Authentication


Security

Long-term secret key leakageIf the long term secret keys of both parties leak, then apassive adversary still has negligible advantage to learn thesecret key.

Ephemeral key leakageIf the ephemeral keys of both parties leak, then an activeadversary still has negligible advantage to learn the secretkey.

AnonymousMutual

Authentication


Efficiency and Implementation

EfficiencyEAC AMA

Exponentiations on chip 1 + certver + signver 4 + certver

Exponentiations on terminal 2 + signgen + certver 4 + certver

Communication rounds 2 2

ImplementationPrototype implementation on Standard Java Card(Gemalto MultiApp ID V2.1)Average execution time for 500 tests:

1.261 seconds - secp192r1 elliptic curve1.602 seconds - secp256r1 elliptic curve

AnonymousMutual

Authentication


Conclusions

Anonymous Mutual Authentication (AMA)Symmetric.Secure in Real-or-Random model.Simultable.Identities of protocol participants are hidden fromeavesdroppers.As efficient as EAC.

AnonymousMutual

Authentication


The End

Thanks for your attention.

Acknowledgment. We thank Gemalto company for thetechnical support.

Mutual Chip Authentication - kutylowski.im.pwr.wroc.pl · Mutual Authentication Hanzlik, Kluczniak,...

Documents

Transcript of Mutual Chip Authentication - kutylowski.im.pwr.wroc.pl · Mutual Authentication Hanzlik, Kluczniak,...