The two simulation-based notions shown thus far, i.e. SimTF security as in Chapter 2 and the strSimTF security introduced in Section 5.2.1, capture the notion that if the dishonest prover helps the adversary to win (with some probability), then the provided help allows a simulator to later win with the same probability. This is a very strong definition, which seems achievable only if the protocol provides the simulator with an advantage in future authentication, to compensate for tainted and erroneous adversary phases. However, in e.g. logistics or public transport, more efficient constructions are needed. Thus a less restrictive terrorist fraud definition seems more indicated here, capturing the intuition that the dishonest prover helps the adversary only insofar it restricts the adversary’s later access.
Our Game-based terrorist fraud resistance GameTF follows the intuition of Avoine et al. [4]. The key difference between simulation-based security and GameTF security is that GameTF security considers attacks invalid if the attacker gains an ulterior advantage to authenticate. In particular, the latter attempt’s success is not measured against the terrorist adversary’s success.
The model is different: we consider a simulator-free two-step game, with two adversaries A and A∗sharing the adversarial view viewA, as defined in the SimTF security model.11 Now A runs a strSimTF interaction with the dishonest P0, while A∗
runs a mafia fraud interaction with V in the presence of the prover (who is this time honest). Now A∗models the adversary after the prover stops helping: this adversary must authenticate in a MITM attack, using A’s state (i.e. viewA). Thus,
whereas S is passive and just uses viewAto authenticate, A∗in GameTF runs an active mafia-fraud interaction and uses
viewAto authenticate. We say that A is helpful to A∗if A∗authenticates with better than mafia-fraud-success probability
(i.e. viewAshouldn’t help A∗at all). We sketch the differences between SimTF and GameTF security in Figure 26. Also
note that in SimTF security, A queries the dishonest prover P0in at most Tmaxtime-critical phases; however, the GameTF
adversary A may query P0 in each time-critical round, tainting the phase if it uses relay scheduling.
Of A and A∗, the former is the terrorist adversary. Its attack is invalid if there exists A∗ such that A is helpful to A∗ (i.e. on input viewA, A∗ wins a MITM attack with higher probability than any mafia fraud adversary). Schemes
are GameTF secure if every terrorist fraud adversary A either (i) wins with negligible probability; or (ii) there exists an adversary A∗to which A is helpful. We denote A’s runtime by t and the number of prover-verifier, resp. verifier-adversary and adversary-prover sessions it runs by (qobs, qV, qP0). Also, A interacts with P0 with the restrictions in Definition 5.7; its success probability is denoted .
Once A stops and forwards viewA to A∗, this adversary runs a mafia-fraud interaction with P (we omit the apostrophe
as P is now honest). W.l.o.g., let A∗ run in time t∗≤ 3t (A∗
runs A at most twice internally, making the same queries as A), and let A∗run at most qobs prover-verifier, qV verifier-adversary, and resp. qV adversary-prover sessions (since A’s
queries to P0deviate from protocol, we allow one adversary-prover session for each verifier-adversary session for A∗). Let A∗win with probability ∗. We now define helpful terrorist fraud adversaries.
Definition 5.9 For an authentication scheme DB with parameters (tmax, Tmax, Emax, Nc), let A be a (t, qobs, qV, qP0) adversary interacting with V and P0 in a strSimTF interaction, and let st = viewA denote its state. We say that A
11Note that any other state information is computable from view
V A P0 V A∗ P0 ←−−−−−−−−−−→ ←−−−−−−−−−−→ ←−−−−−−−−−−→ ←−−−−−−−−−−→ ←−−−−−−−−−−→ ←−−−−−−−−−−→ ←−−−−−−−−−−→ Win w.p. PA −−−−−−−−−−−−→ −−−−−−−−−−−−Win w.p. → ⇓ ⇓ viewA viewA ⇓ ⇓ V S V A∗ P ←−−−−−−−−−−→ ←−−−−−−−−−−→ ←−−−−−−−−−−→ Win w.p. PS −−−−−−−−−−−−→ Win w.p. ∗ −−−−−−−−−−−−→
SimTF Security: GameTF Security:
PS≥ PA non-negl. or ∗> AdvmafiaDB
Figure 26: Simulation and game-based security models
is helpful to an adversary A∗ with input st, runtime at most 3t, running at most qobs, qV, and qP = qV sessions in a
mafia-fraud interaction with V and P, and winning with probability ∗(taken over viewAand the coins of A∗) if:
∗> AdvmafiaDB ,
where Advmafia
DB denotes the mafia fraud resistance of DB for a (t, qobs, qV, qP)-mafia adversary.
Now GameTF is defined as follows:
Definition 5.10 (GameTF Security) Let DB be a distance-bounding authentication scheme with parameters (tmax, Tmax,
Emax, allowbreakNc). The scheme is (t, qobs, qV, qP0, )-GameTF secure if for all (t, qobs, qV, qP0) adversaries A running a strSimTF interaction, one of the following statements hold:
• The probability that A wins is upper bounded by ; • There exists an adversary A∗
such that A is helpful to A∗ as defined above.
We say that a scheme DB is GameTF secure if it is (t, qobs, qV, qP0, )-GameTF secure for negligible .
A Case Study. As noted, we have already shown that one the classical, apparently terrorist fraud resistant protocol in [70] is in fact not SimTF secure. However, the original paper due to Reid et al. and the intuitive definition in [4] indicate that this protocol does, in fact, attain some degree of terrorist fraud resistance, which could be useful in practice. We show that schemes like [70] attain the notion of GameTF security. In particular, the attack shown in Chapter 2 is ruled out, since the adversary A∗gains an advantage in future authentication sessions.
In what follows, we recall the scheme of [70], as described in Chapter 2 (with the modification increasing distance-fraud security), recalling its security properties and noting that this scheme is mafia fraud resistant. We use this fact to prove GameTF security. In this scheme, E denotes a symmetric encryption scheme (Reid et al. suggest to use bitwise XOR in practice), while PRF denotes a pseudorandom function.
Theorem 5.11 (Reid et al. Properties) Let DB be the distance-bounding authentication scheme in Figure 15 with pa- rameters (tmax, Nc). This scheme has the following properties:
• It is neither impersonation resistant, distance-fraud resistant, nor terrorist fraud resistant (assuming the pseudoran- domness of PRF).
• For any (t, qV, qP, qobs)-mafia-fraud adversary A against the scheme there exists a (t 0
, q0)-distinguisher A0 against PRF (where t0= t + O(n) and q0= qV+ qP+ qobs) or a (t
00
, q00)-distinguisher A00against the IND-CPA of E (where t00= t + O(n) and q00= qV+ qP+ qobs) such that
AdvmafiaDB (A) ≤ 34
Nc + AdvdPRF(A 0 ) + AdvIND-CPAE (A 00 ) + qV+ qobs 2 ! · 2−|NV|+ qP 2 ! · 2−|NP|
V(sk, idV) P(sk, idT) . . . . Lazy Phase pick NV← {0, 1}∗ pick NP← {0, 1}∗ NV, idV −−−−−−−−−−−−−−→
let eph ← PRF(sk, idV||idT||NV||NP) eph ← PRF(sk, idV||idT||NV||NP) ←−−−−−−−−−−−−−−NP, idT c ← Eeph(sk)
c ← Eeph(sk), R ← {0, 1}Nc Time-Critical Phases for i = 1, . . . , Nc Clock: Start Ri −−−−−−−−−−−−−−→ Ti= ciif Ri= 0 Ti⊕ Ri ←−−−−−−−−−−−−−− Ti= ephiotherwise Clock: Stop, output ∆t
Check Tiand ∆t ≤ tmax
Figure 27: The Reid et al. protocol
We proceed to show that the protocol due to Reid et al. does in fact attain the game-based terrorist fraud definition we just showed.
Proposition 5.12 (GameTF Security) Let DB be the protocol in Figure 15 with parameters (tmax, Nc). This scheme is
(t, qobs, qV, qP0, )-GameTF secure, for ≥ AdvmafiaDB .
Proof. Assume towards contradiction that the scheme is not (t, qobs, qV, qP0, )-GameTF resistant. Then there exists a (t, qobs, qV, qP0) adversary A such that: (i) A wins with probability > AdvmafiaDB ; and (ii) for all (3t, qobs, qV, qV)-adversaries
A∗
, initialised with viewA, running a mafia fraud interaction with V and P, the success probability ∗of A∗is such that
∗≥ Advmafia DB .
We construct, for each A as in (i) and (ii), an A∗with input viewA, winning in the attack above with probability ∗≥ .
Thus, if A wins with probability > AdvmafiaDB (as in (i)), our A ∗
follows the specifications of Definition 5.9 and wins with probability ∗= > Advmafia
DB (contradicting point (ii)). Thus, an adversary A for which points (i) and (ii) both hold does
not exist.
We describe A∗. For each session A runs with V, A∗runs a session with V and a parallel one with P, relaying the lazy phase and running time-critical phases as follows. In each verifier-adversary session sid, A∗runs A internally, branching out in two executions as in the proof of Theorem 5.3, so that: if A taints a phase, so does A∗(both succeed with probability 1 and have 1 less phase to taint); if A refuses to respond to challenge αi=: α, then A∗uses the Go-Early mafia strategy
(see Proposition 5.4), querying P with challenge ¯α = α ⊕ 1 (both A and A∗ know the same response), and A∗ guesses the response if queried with challenge α in session sid: this gives A and A∗equal winning probability; finally, if A forwards responses r∗0 (for a 0 challenge) and r∗1 (for a 1 challenge) for this round, A∗first extracts the responses rb= r∗b⊕ αb(by
cancelling the XORed challenges), and then A uses the Go-Early strategy, challenging P with α ∈ {0, 1}, and receiving Riα. Then A∗ sets Rαi¯ = Riα⊕ r0⊕ r1; on receiving challenge c ∈ {0, 1} in sid, A∗ responds with Rci. For the latter
strategy, there are four cases:
• Both values r0 and r1are correct. Then both A and A∗win with probability 1.
• Both values r0 and r1are incorrect. Then A loses the phase, while A∗wins with probability 1.
• Either r0or r1is incorrect. Now A wins the round with probability 12. As A∗runs the Go-Early strategy for challenge
α ∈ {0, 1}, it knows the correct Rαi, but the wrong R ¯ α
i (as r0⊕ r1is incorrect), and wins the phase with probability 1
2. If they answer wrongly, both adversaries subtract 1 from Emax.
Thus, A∗wins with at least as high probability as A in each time-critical phase, i.e. the success probability ∗of A∗equals the success probability of A, i.e. . It is easy to see that the parameters of A∗ are as required. Now if there exists an adversary A with > AdvmafiaDB , then A
∗
succeeds in its mafia-fraud interaction with probability ∗> AdvmafiaDB . Thus, A is
helpful to A∗, contradicting our assumption.