Covert Channels in Privacy-Preserving Identification Systems Daniel V. Bailey (RSA Labs) Dan Boneh (Stanford) Eu-Jin Goh (Stanford) Ari Juels (RSA Labs) © 2007 RSA Laboratories ACM CCS 31 October 2007

You are probably carrying a constellation of wireless identification devices right now

Proximity cards

Automobile ignition keys f RFID helps secure hundreds of millions of automobiles –Cryptographic challenge-response –Philips claims more than 90% reduction in car theft thanks to RFID! –(Some, e.g., Texas Instruments DST, are weak [Bono et al. ‘05])…

Credit cards RFID now offered in all major credit cards in U.S.… Some even broadcast your name in the clear! –See “Vulnerabilities in First-Generation RFID-Enabled Credit Cards” [Heydt-Benjamin et al. ’07]

Transit cards

Passports Dozens of countries issuing RFID-enabled passports Other identity documents, e.g., drivers’ licenses, to follow

Animals too… “Not Really Mad” Livestock Housepets The cat came back, the very next day… 50 million+

Human location tracking Schools Amusement parks Hospitals In the same vein: mobile phones with GPS…

??? Human-implantable RFID += VeriChip TM

Human-implantable RFID += VeriChip TM Excellent test bed for privacy and security concepts! Proposed for medical-patient identification Also proposed and used as an authenticator for physical access control, a “prosthetic biometric” –E.g., Mexican attorney general purportedly used for access to secure facility What kind of cryptography does it have? –None: It can be easily cloned [Halamka et al. ’06] So shouldn’t we add a challenge-response protocol? Cloning may actually be a good thing

Human-implantable RFID Physical coercion and attack –In 2005, a man in Malaysia had his fingertip cut off by thieves stealing his biometric- enabled Mercedes –What would happen if the VeriChip were used to access ATM machines and secure facilities? Perhaps better if tags can be cloned! Tags should not be used for authentication—only for identification

Cloneability + privacy Privacy means no linkability or information about identities If a tag can be cloned, does that mean it can’t provide privacy? –Surprisingly, no! A very simple scheme allows for simultaneous cloneability and privacy

Cloneability + privacy Homomorphic public-key cryptosystem (e.g., El Gamal) Private / public key pair (SK, PK) Randomized scheme: C = E PK,r [m] Semantic security: Adversary cannot distinguish C = E PK,r [“Alice”] from C’*= E PK,s [“Bob”] Re-encryption property: Given C only, can produce randomized C* = E PK,s [m], without knowing m

Cloneability + privacy The scheme: When read, tag chooses fresh r and outputs C = E PK,r [“name”] Then: Reader with SK can decrypt name Semantic Security: Adversary cannot distinguish among tags, i.e., infringe privacy Re-encryption property: Adversary can clone a tag: records C and outputs randomized C*

The covert-channel problem Suppose there is an identification / authentication system… Authorized Employees Only Who’s there? E[“Alice”] It’s Alice!

The covert-channel problem Suppose there is an identification / authentication system… Authorized Employees Only Who’s there? E[“Alice” + ?] Alice has low blood pressure and high blood-alcohol Alice recently passed a casino’s RFID reader. Mercury switch indicates that Alice napped on job

How can we assure Alice of no covert channels? Outputs must be deterministic –Randomness always leaves room for covert emissions Could give Alice a secret key to check that outputs are formatted correctly –E.g., PRNG seed for device But we don’t want Alice (or a third party) to have to manage sensitive keying material! Can we enable Alice to verify covert-freeness publicly, i.e., without exposing secret keys? Simultaneous publicly verifiable covert-freeness and privacy are impossible!

Here’s why… Suppose there were a public CC detector… X18 Ultra CC-Detector TM A1A1 A2A2 No CC Yes, CC!

Here’s a covert channel! 1.Create identity for user “Bob” Bob could be fictitious Just need output sequence B 1, B 2, … 2.Alice’s chip does following: If no nap, output A 1, A 2, A 3, etc. with Alice’s identity If Alice has taken a nap, then flip to Bob’s identity, i.e., output A 1, A 2 … B 1, B 2

Suppose we detect this covert channel X18 Ultra CC-Detector TM A1A1 A2A2 No CC B1B1 Yes, CC

Now if there really is a user Bob, we have a problem... X18 Ultra CC-Detector TM A1A1 A2A2 No CC

Alice followed by Bob yields “Yes” X18 Ultra CC-Detector TM A1A1 B1B1 Yes, CC

BobAlice Privacy is broken: We can distinguish between identities! X18 Ultra CC-Detector TM Yes X18 Ultra CC-Detector TM No

So public CC-verifiability + privacy is impossible Now let’s show how to achieve it anyway… Idea: –Weaken privacy definition to eliminate localized privacy, e.g., privacy across pairwise values –Allow localized CC-checking, e.g., pairwise –Localized privacy is least important type of privacy Now we can do spot CC-checking… A1A1 A2A2 A3A3 A4A4 A5A5 A6A6 A7A7 A8A8 A9A9 X18 Ultra CC-Detector TM yes / no

So public CC-verifiability + privacy is impossible Now let’s show how to achieve it anyway… Idea: –Weaken privacy definition to exclude localized privacy, e.g., privacy across pairwise values –Allow localized CC-checking, e.g., pairwise –Localized privacy is least important type of privacy Now we can do spot CC-checking… A1A1 A2A2 A3A3 A4A4 A5A5 A6A6 A7A7 B1B1 B2B2 X18 Ultra CC-Detector TM yes / no

So public CC-verifiability + privacy is impossible Now let’s show how to achieve it anyway… Idea: –Weaken privacy definition to exclude localized privacy, e.g., privacy across pairwise values –Allow localized CC-checking, e.g., pairwise –Localized privacy is least important type of privacy Now we can do spot CC-checking… A1A1 A2A2 A3A3 A4A4 A5A5 A6A6 A7A7 A8A8 A9A9 ???

Still a challenge Construct a deterministic sequence whose values are: –Unlinkable (except pairwise) –Publicly, pairwise verifiable Basic ideas of our solution 1.General unlinkability via exponent squaring: –A 1 = h r, A 2 = h r, A 3 = h r, A 4 = h r, etc Verifiability via use of group with bilinear map e: –Pairwise check: e(A 2,A 2 ) = e(h,A 3 ) = e(h,h) r 8

Improving efficiency A 1 = h r, A 2 = h r, A 3 = h r, A 4 = h r, etc Determining identity is not efficient –Every tag must use separate value r known to reader –Reader must compute sequence for every tag Use composite-order bilinear maps [BGN ’05] –Reader secret g; public h (different subgroups) –Each tag has identifier e(g,g) d for unique d – At time i, tag with identifier d outputs g d A i – Reader computes e(g, g d A i ) = e(g, g d ) = e(g, g) d = tag ID – (With g and h in different subgroups, we can make h-base disappear)

More to do… In paper, we also demonstrate k-wise-checkable constructions and other access structures But there are still some problems: 1.Non-standard hardness assumption l -BDHS (Bilinear Diffie-Hellman Squaring) 2.We only address covert channels in known communication layer What if tag takes secret input? (Record transactions?) Timing or power side-channels? 3.Tag is no longer cloneable! 4

Much more to do… The number of implantable cardiac defibrillators (ICDs) alone is set to exceed 250,000 per year in the U.S. ICDs emit measurements and permit reprogramming Those constellations of wireless devices are moving into the body…