Key agreement over a radio link

Mario Cagalj, Jean-Pierre Hubaux
2004
Report or working paper

Abstract

We present a simple, and yet powerful, technique for key establishment over a radio link in peer-to-peer networks. Our approach is based on the Diffie-Hellman key agreement protocol. This protocol is known to be vulnerable to the ``man-in-the-middle" attack if two users involved in the protocol share no authenticated information about each other (e.g., public keys) prior to the protocol execution. In this work, we show how the natural ability of users to authenticate each other by visual and verbal contact can provide a context for secure verification of the integrity of the Diffie-Hellman parameters (e.g., Diffie-Hellman public keys). Having established such a context (e.g., by being in the vicinity of each other), even if they share no authenticated information in advance, the users can run the Diffie-Hellman protocol in a secure way: at the end of the protocol, the users will be able to check whether the Diffie-Hellman public keys they exchanged were tampered with by an attacker. We have devoted much attention to the user-friendliness of our solution: (i) all messages in our protocol are exchanged exclusively over a radio link (neither physical contact nor an infrared link is required between the devices); (ii) the users do not have to enter any passwords. All the users have to do is to compare a short string of usual words displayed on each of their devices. We quantify the trade-off between the size of this string and the level of the provided security. We have implemented our technique in Java. Our system is independent of the underlying operating system and can be run on a variety of personal mobile devices, including those with very limited computing power.

Official source

https://infoscience.epfl.ch/record/509?ln=en

About this result

This page is automatically generated and may contain information that is not correct, complete, up-to-date, or relevant to your search query. The same applies to every other page on this website. Please make sure to verify the information with EPFL's official sources.

Related concepts

Related publications

Mario Cagalj, Jean-Pierre Hubaux
2004
Report or working paper

Abstract

Official source

https://infoscience.epfl.ch/record/509?ln=en

About this result

Related concepts (16)

Related concepts

Related publications (19)

Related publications

Thwarting selfish and malicious behavior in wireless networks

Mario Cagalj

Security is at the core of any communication system and, in particular, of wireless (radio) networks. In this thesis, we focus on three important security aspects in the framework of wireless networks: selfish (noncooperative) behavior at the Medium Access Control (MAC) layer, "radio channel jamming"-based Denial-of-Service (DoS) attacks against sensor networks and secure key agreement in peer-to-peer wireless networks. In the context of selfish behavior at the MAC layer, we focus on single collision domain Carrier-Sense Multiple-Access with Collision Avoidance (CSMA/CA) networks. We use both cooperative and non-cooperative game theory to model and analyze the co-existence of multiple CSMA/CA selfish users. Using insights from the game theoretic analysis, we propose a simple channel access protocol that discourages selfish behavior and results in the optimal and fair allocation of the available bandwidth. We perform an extensive evaluation of the proposed protocol. We then consider two types of malicious behavior. The first type deals with an adversary who tries to obstruct the operation of a wireless network by jamming the used radio channel. The second type is concerned with an adversary who interferes with a key agreement protocol executed between parties that use a radio link, in an attempt to learn their private information or to fool them into accepting fake messages as genuine. Concerning the first kind of malicious behavior, we focus on wireless sensor networks, perhaps the most vulnerable category of wireless networks to this kind of threat. An adversary can mask the events that the sensor network should detect by stealthily jamming an appropriate subset of the nodes; in this way, he prevents them from reporting what they sense to the network operator. Therefore, in spite of the fact that an event is sensed by one or several nodes (and the sensor network is fully connected), the network operator cannot be informed on time – we call this the coverage paradox. To mitigate this problem, we propose a reactive defense mechanism based on wormholes, which were so far considered to be a security threat. In our solution, thanks to channel diversity, the nodes under the jamming attack are able to create (probabilistically) a communication route that is resistant to jamming; thus, appropriate information can be conveyed out of the jammed region. We develop appropriate mathematical models to study the proposed mechanisms. Concerning the second kind of malicious behavior, we focus on the problem of a user-friendly key agreement (and message authentication) in settings where the users do not share any authenticated secret or certified public key in advance. We base our approach on the Diffie-Hellman key agreement protocol, which is known to be vulnerable to the "man-in-the-middle" attack if the users involved in the protocol do not share any authenticated information about each other (e.g., public keys, certificates, passwords, shared keys, etc.) prior to the protocol execution. We solve the problem by leveraging on the natural ability of users to authenticate each other by visual and verbal contact. We propose three techniques: the first is based on the visual comparison of short strings, the second on distance bounding, and the third on a novel concept called integrity codes (I-codes). In each case, the users do not need to enter any password or other data, nor do they need physical or infrared connectivity between their devices. We analyze our protocols using a well-established methodology that leads us to a rigorous modularization and a thorough robustness proof of our proposal. We also provide an implementation of I-codes.

EPFL2006

Key Agreement in Peer-to-Peer Wireless Networks

Mario Cagalj, Srdan Capkun, Jean-Pierre Hubaux

We present a set of simple techniques for key establishment over a radio link in peer-to-peer networks. Our approach is based on the Diffie-Hellman key agreement protocol, which is known to be vulnerable to the ``man-in-the-middle" attack if the two users involved in the protocol share no authenticated information about each other (e.g., public keys, certificates, passwords, shared keys, etc.) prior to the protocol execution. In this paper, we show how the users can establish a shared key even if they share no authenticated information in advance; for this purpose, we leverage on the natural ability of users to authenticate each other by visual and verbal contact. Each of our techniques is based on a specific mechanism: (i) visual comparison of short strings, (ii) distance bounding, and (iii) integrity codes; in each case, the users do not need to enter any password or other data, nor do they need physical or infra-red connectivity between their devices. We base our analysis on a well-established methodology, leading us to a rigorous modularization and robustness proof of our proposal.

2006

Our main motivation is to design more user-friendly security protocols. Indeed, if the use of the protocol is tedious, most users will not behave correctly and, consequently, security issues occur. An example is the actual behavior of a user in front of an SSH certificate validation: while this task is of utmost importance, about 99% of SSH users accept the received certificate without checking it. Designing more user-friendly protocols may be difficult since the security should not decrease at the same time. Interestingly, insecure channels coexist with channels ensuring authentication. In practice, these latters may be used for a string comparison or a string copy, e.g., by voice over IP spelling. The shorter the authenticated string is, the less human interaction the protocol requires, and the more user-friendly the protocol is. This leads to the notion of SAS-based cryptography, where SAS stands for Short Authenticated String. In the first part of this thesis, we analyze and propose optimal SAS-based message authentication protocols. By using these protocols, we show how to construct optimal SAS-based authenticated key agreements. Such a protocol enables any group of users to agree on a shared secret key. SAS-based cryptography requires no pre-shared key, no trusted third party, and no public-key infrastructure. However, it requires the user to exchange a short SAS, e.g., five decimal digits. By using the just agreed secret key, the group can now achieve a secure communication based on symmetric cryptography. SAS-based authentication protocols are often used to authenticate the protocol messages of a key agreement. Hence, each new secure communication requires the interaction of the users to agree on the SAS. A solution to reduce the user interaction is to use digital signature schemes. Indeed, in a setup phase, the users can use a SAS-based authentication protocol to exchange long-term verification keys. Then, using digital signatures, users are able to run several key agreements and the authentication of protocol messages is done by digital signatures. In the case where no authenticated channel is available, but a public-key infrastructure is in place, the SAS-based setup phase is avoided since verification keys are already authenticated by the infrastructure. In the second part of this thesis, we also study two problems related to digital signatures: (1) the insecurity of digital signature schemes which use weak hash functions and (2) the privacy issues from signed documents. Digital signatures are often proven to be secure in the random oracle model. The role of random oracles is to model ideal hash functions. However, real hash functions deviate more and more from this idealization. Indeed, weaknesses on hash functions have already been discovered and we are expecting new ones. A question is how to fix the existing signature constructions based on these weak hash functions. In this thesis, we first try to find a better way to model weak hash function. Then, we propose a (randomized) pre-processing to the input message which transforms any weak signature implementation into a strong signature scheme. There remains one drawback due to the randomization. Indeed, the random coins must be sent and thus the signature enlarges. We also propose a method to avoid the increase in signature length by reusing signing coins. Digital signatures may also lead to privacy issues. Indeed, given a message and its signature, anyone can publish the pair which will confirm the authenticity of the message. In certain applications, like in electronic passports (e-passports), publishing the authenticated data leads to serious privacy issues. In this thesis, we define the required security properties in order to protect the data privacy, especially in the case of e-passport verification. The main idea consists for the e-passport to keep the signature secret. The e-passport should only prove that it knows a valid signature instead of revealing it. We propose a new primitive, called Offline Non-Transferable Authentication Protocol (ONTAP), as well as efficient implementations that are compatible with the e-passport standard signature schemes.

EPFL2009

Thwarting selfish and malicious behavior in wireless networks

Mario Cagalj

EPFL2006