Privacy and anonymity on the Internet have become a serious concern. Even when anonymity tools like Tor or VPNs are used, the IP and therefore the approximate geolocation from which the user connects to such a service is still visible to an adversary who controls the network. Our proposal Proxyaims to mitigate this problem by providing a relay of user-controlled hardware proxies that allows to connect to a (potentially public) network over a large physical distance. One endpoint is connected to a public Wifi hotspot, while the other end connects (over a chain of relay nodes) to the user’s computer. Proxy uses a lightweight protocol to create a secure channel between two endpoint nodes, whereas the communication can be routed over an arbitrary amount of relay nodes. The employed cryptography is based on NaCl, using Curve25519 for the key exchange as well as Salsa20 and Poly1305 for authenticated payload encryption. Proxy tunnels TCP/IP connections and can therefore be used to secure and anonymize existing, unprotected protocols. We implemented Proxy on the ESP8266, a popular Wifi microcontroller, and show that Proxy incurs a latency of 20.4 ms per hop under normal operating conditions.
Abundant experiments have shown that phantom source nodes cannot leave far away from the real source node. In this paper, we propose a novel position tracking based source location privacy (PTSLP) protection scheme for wireless sensor networks (WSNs). First, we construct a phantom area in order to make phantom source nodes being far from the real source node. Secondly, we combine shortest path routing and random routing to forward packets to sink node rather than deviating from sink node. Then, we make every packet pass through a special area called trace cost area which consists of many sensor nodes with different weights in different areas and finally reach the ring around sink node. Compared with SLP-E, which fails to take overlapping path into consideration, our proposed scheme can reduce overlapping path. Simulation results show that PTSLP can increase safety time and enhance source location privacy in WSNs.
Recently there has been interesting in short-range communication using audio channels for device pairing and as a self-jamming communication medium. Given that such channels are audible to participants they are considered more resistant to active attacks, i.e. the attack could be distinguished by the participants. In this paper, we investigate the validity of this assumption in the only two practical acoustic self-jamming systems using different modulation schemes. We show that basic overshadowing is possible in these systems using an audio channel and that the attack cannot be effectively detected by the participants.
Side-channel attacks put the security of the implementations of cryptographic algorithms under threat. Secret information can be recovered by analyzing the physical measurements acquired during the computations and using key recovery distinguishing functions to guess the best candidate. Several generic and model based distinguishers have been proposed in the literature. In this work we describe two contributions that lead to better performance of side-channel attacks in challenging scenarios. First, we describe how to transform the physical leakage traces into a new space where the noise reduction is near-optimal. Second, we propose a new generic distinguisher that is based upon minimal assumptions. It approaches a key distinguishing task as a problem of classification and ranks the key candidates according to the separation among the leakage traces. We also provide experiments and compare their results to those of the Correlation Power Analysis (CPA). Our results show that the proposed method can indeed reach better success rates even in the presence of significant amount of noise.
Energy consumption of block ciphers is critical in resource constrained devices. Unrolling has been explored in literature as a technique to increase efficiency by eliminating energy spent in loop control elements such as registers and multiplexers. However these savings are minimal and are offset by the increase in glitching power that comes with unrolling. We propose an efficient latch-based glitch filter for unrolled designs that reduces energy per encryption by an order of magnitude over a straightforward implementation, and by 28–32% over the best existing glitch filtering schemes. We explore the optimal number of glitch filters that should be used in order to minimize total energy, and provide estimates of the area cost. Partially unrolled designs also benefit from using our scheme with energies competitive to fully serialized implementations. We demonstrate our approach on the SIMON-128 and AES-256 block ciphers.
Distance-bounding protocols use the round-trip time of a challenge-response cycle to provide an upper-bound on the distance between prover and verifier. In order to obtain an accurate upper-bound, the computation time at the prover's side should be as short as possible, which can be achieved by precomputing the responses and storing them in a lookup table. However, such lookup-based distance bounding protocols suffer from a trade-off between the achieved security level and the size of the lookup table. In this paper, we study this security-memory trade-off problem for a large class of lookup-based distance bounding protocols; called layered protocols. Relying on an automata-based security model, we provide mathematical definitions for different design decisions used in previous lookup-based protocols, and perform general security analyses for each of them. We also formalize an interpretation of optimal trade-off and find a non-trivial protocol transformation approach towards optimality. That is to say, our transformation applied to any layered protocol results in either an improved or an equal protocol with respect to the optimality criterion. This transformation allows us to provide a subclass of lookup-based protocol that cannot be improved further, which means that it contains an optimal layered protocol.
Distance Bounding (DB) is a security technique through which it is possible to determine an upper-bound on the physical distance between two parties (denoted as verifier and prover). These protocols typically combine physical properties of the communication channel with cryptographic challenge-response schemes. A key challenge to design secure DB protocols is to keep the time required by the prover to process the challenges and compute and transmit the responses as low as possible. For this purpose, different implementation approaches have been proposed in the literature, both in the analog as in the digital domain. Moreover, different types of communication channels have been proposed as well to find an optimal balance between security and implementation feasibility. This paper is the first to evaluate the feasibility of implementing DB protocols using quantum communication. Unlike conventional DB protocols, which execute the rapid-bit exchanges over a Radio Frequency (RF) or ultrasound channel, our quantum-based DB protocol makes use of quantum-bit (qubit) transmissions and detection during the challenge-response phase. Our protocol offers security against distance fraud, mafia fraud and terrorist attacks. We also discuss how to protect against some specific implementation attacks, such as double read-out and quantum attacks, and give an overview of the main implementation challenges as well as possible limitations.
The limited computational capabilities of low-cost RFID cards may induce security weaknesses stemming from concessions made in hardware. In particular, RFID cards with weak pseudo-random number generators (PRNGs) can leak secret information. Current generation RFID cards, such as the Mifare DESFire EV1, improve on the cryptographic and random number generation capabilities of previous cards such as the Mifare Classic. However, there is not yet a published analysis on the quality of the true random number generator (TRNG) used in Mifare DESFire EV1 cards. This paper represents the first study of the randomness of the DESFire EV1, and shows preliminary results that highlight a distinct pattern of biases in its TRNG.
As a typical application of Internet of Things (IoT), wireless sensor networks (WSNs) have been widely used in many fields, such as remote healthcare, to gather data of monitoring area. However, due to open nature of wireless channel and limited computing and storage resource of sensor node, how to guarantee the sensitive sensed data are only be accessed by valid user becomes an important issue. Many user authentication protocols for WSNs have been proposed to address this issue, however, previous work more or less have their own weaknesses. Recently, Gope and Hwang proposed a lightweight anonymity authentication for WSNs, and they claimed that their protocol is secure against most attacks. However, our analysis indicates that their protocol still has some design and security flaws. To address the security issue for WSNs, a user authentication protocol with privacy protection for WSNs has been proposed. The analysis and comparisons results show that the proposed protocol is a robust and security one for WSNs.
During the past decade, cybersecurity threats have drawn everyone's attention and it's becoming a national priority in many leading countries. With the development of sophisticated mobile technology, mobile (contactless) payment insecurity, which may cause huge financial losses, is now becoming a serious threat to our daily life. During the holiday season in 2013, China's most welcome mobile payment system provider - Alipay - lost over 20 GB worth of customer data in a security breach, which affected at least 15 million customers. Even though the company has promised to evaluate the security of the system and to take necessary measures to protect customer's data, are we still safe with the payment? In this paper, we investigate several security vulnerabilities for Alipay wallet, which may cause individual's personal data and financial losses. This is due to not only less regulation by authorities but also the failure of enabling secure proximity authentication during mobile payment. By going through these surprising vulnerabilities, we come up with some ideas on how to combat them and show how to enhance the mobile payment security by enabling proximity authentication before monetary transactions.
ARM NEON architecture has occupied a significant share of high-end Internet of Things platforms such as mini computer, tablet and smartphone markets due to its low cost and high performance. This paper studies efficient techniques of lattice-based cryptography on ARM processor and presents the first implementation of ring-LWE encryption on ARM NEON architecture. We propose a vectorized version of Iterative Number Theoretic Transform (NTT) for high-speed computation and present a 32-bit variant of SAMS2 technique, original from Liu et al. in CHES2015, for fast reduction. Subsequently, we present a full-fledged implementation of Ring-LWE by taking advantage of proposed and previous optimization techniques. Ultimately, our ring-LWE implementation requires only 145 k clock cycles for encryption and 32.8k cycles for decryption for n = 256. These results are more than 17.6 times faster than the fastest ECC implementation on ARM NEON with same security level.
Europay MasterCard Visa (EMV) Tokenisation specification details how the risk involved in Personal Account Number (PAN) compromise can be prevented by using tokenisation. In this paper, we identify two main potential problem areas that raise concerns about the security of tokenised EMV contactless mobile payments, especially when the same token also called a static token is used to pay for all transactions. We then discuss five associated attack scenarios that would let an adversary compromise payment transactions. It is paramount to address these security concerns to secure tokenised payments, which is the main focus of the paper. We propose a solution that would enhance the security of this process when a smart phone is used to make a tokenised contactless payment. In our design, instead of using a static token in every transaction, a new dynamic token and a token cryptogram is used. The solution is then analysed against security and protocol objectives. Finally the proposed protocol was subjected to mechanical formal analysis using Scyther which did not find any feasible attacks within the bounded state space.
Side-channel attacks represent a powerful category of attacks against cryptographic devices. Still, side-channel analysis for lightweight ciphers is much less investigated than for instance for AES. Although intuition may lead to the conclusion that lightweight ciphers are weaker in terms of side-channel resistance, that remains to be confirmed and quantified. In this paper, we consider various side-channel analysis metrics which should provide an insight on the resistance of lightweight ciphers against side-channel attacks. In particular, for the non-profiled scenario we use the theoretical confusion coefficient and empirical correlation power analysis. Furthermore, we conduct a profiled side-channel analysis using various machine learning attacks on PRESENT and AES. Our results show that the difference between AES and lightweight ciphers is smaller than one would expect. Interestingly, we observe that the studied 4-bit S-boxes have a different side-channel resilience, while the difference in the 8-bit ones is only theoretically present.
Over the past decade, besides authentication, ownership management protocols have been suggested to transfer or delegate the ownership of RFID tagged items. Recently, Niu et al. have proposed an authentication and ownership management protocol based on 16-bit pseudo random number generators and exclusive-or operations which both can be easily implemented on low-cost RFID passive tags in EPC global Class-1 Generation-2 standard. They claim that their protocol offers location and data privacy and also resists against desynchronization attack. In this paper, we analyze the security of their proposed authentication and ownership management protocol and show that the protocol is vulnerable to secret disclosure and desynchronization attacks. The complexity of most of the attacks is only two runs of the protocol and the success probability of the attacks is almost 1. We also proposed an improved version of the protocol which is secure against the attacks presented in this paper.
Near Field Communication (NFC) is a short-range contact- less communication standard recently emerging as cashless payment tech- nology. However, NFC has been proved vulnerable to several threats, such as eavesdropping, data modification, and relay attacks. A relay at- tack forwards the entire wireless communication, thus communicating over larger distances. In this paper, we review and discuss feasibility limitations when performing these attacks in Google's Android OS. We also perform an in-depth review of the Android implementation of the NFC stack. We show an experiment proving its feasibility using off-the- shelf NFC-enabled Android devices (i.e., no custom firmware nor root required). Thus, Android NFC-capable malicious software might appear before long to virtually pickpocket contactless payment cards within its proximity.
The standardization group ISO/IEC SC31/WG7 is working on a set of cryptographic suites to provide security to wireless devices including UHF RFID tags. These cryptographic suites are presented as independent parts to a single standard ISO/IEC 29167. Within this multi-part standard 29167-15 is based around very simple operations and intended to provide tag, interrogator, and mutual authentication. Here we show that these proposals can be fully compromised using algebraic cryptanalytic techniques; the entire key can be recovered after eavesdropping on just four authentications.
This paper describes a novel antenna design for communicating with ISO/IEC 14443A RFID cards at larger distances than the normal 5-10 cm. The set-up consists of two antennas, one to activate the card at the normal frequency of 13.56 MHz, and another to receive its response at the higher harmonic frequency of 40.68 MHz. The strong field required to power the card at larger distances is likely to drown out its response. By detecting the higher harmonic frequencies originating from the card's response this problem is solved, making communication at larger distances possible. The two antennas, placed 100 cm apart, form an RFID gate that can communicate with cards in the middle of the gate. This is a substantial improvement of the maximum skimming distance of 25 cm reported in literature.
Physically Unclonable Functions (PUFs) are used for generating unique signatures from the complex manufacturing variations in integrated circuits. However, the majority of PUFs have been shown to be vulnerable to modeling attacks. In this work, we take a closer look at the vulnerability of feed-forward arbiter PUFs towards a combined side-channel and modeling attack using data measured from our 32nm test chips. The side-channel information from the feed-forward PUF construction is used as a catalyst for improving the performance of modeling attacks. This hybrid attack helps to push the prediction accuracies to very high limits (> 98.5%), especially for larger PUF circuits. The hybrid attack yields around 7% improvement in prediction rates when compared to a conventional modeling attack mounted under the presence of error-inflicted challenge-response pairs.
Ever since its invention in the 1980s, e-cash has been considered a promising solution for privacy-preserving electronic payments. However, the computational capabilities, required for the processing of e-cash protocols, are demanding. Only recent works show the feasibility of implementing e-cash on constrained platforms. A particularly challenging, while at the same time extremely attractive platform, are smartcards. Smartcards are, next to magnetic stripe cards, the dominant platform used to execute electronic payments, and they enjoy wide user acceptance. In this paper we present an implementation of two e-cash schemes on MULTOS smartcards. We base the schemes on elliptic curve cryptography, which is supported by the API of the platform of choice. Our results are promising: When relying on a 160-bit elliptic curve, spending a coin, which encodes two attributes that are not revealed, can be executed in less than 800 ms with both considered schemes.
