Parallel and Concurrent Security of the HB and HB+ Protocols Jonathan Katz∗† Ji Sun Shin∗‡ Abstract Juels and Weis (building on prior work of Hopper and Blum) propose and analyze two shared-key authentication protocols — HB and HB+ — whose extremely low computational cost makes them attractive for low-cost devices such as radio-frequency identification (RFID) tags. Security of these protocols is based on the conjectured hardness of the “learning parity with noise” (LPN) problem: the HB protocol is proven secure against a passive (eavesdropping) adversary, while the HB+ protocol is proven secure against active attacks. Juels and Weis prove security of these protocols only for the case of sequential executions, and explicitly leave open the question of whether security holds also in the case of parallel or concurrent executions. In addition to guaranteeing security against a stronger class of adversaries, a positive answer to this question would allow the HB+ protocol to be parallelized, thereby substantially reducing its round complexity. Adapting a recent result by Regev, we answer the aforementioned question in the affirmative and prove security of the HB and HB+ protocols under parallel/concurrent executions. We also give what we believe to be substantially simpler security proofs for these protocols which are more complete in that they explicitly address the dependence of the soundness error on the number of iterations. ∗ Dept. of Computer Science, University of Maryland. {jkatz,sunny}@cs.umd.edu. This research was supported by NSF Trusted Computing grants #0310499 and #0310751, and NSF CAREER award #0447075. ‡ Supported by NSF Trusted Computing grant #0310499. † 1 Introduction Low-cost, resource-constrained devices such as radio-frequency identification (RFID) tags or sensor nodes demand extremely efficient algorithms and protocols. Securing such devices is a challenge since, in many cases, “traditional” cryptographic protocols are simply too computationally-intensive to be utilized. With this motivation in mind, Juels and Weis [20] — building upon work of Hopper and Blum [18, 19] — investigate two highly-efficient, shared-key (unidirectional) authentication protocols suitable for an RFID tag identifying itself to a tag reader. (We will sometimes refer to the tag as a prover and the tag reader as a verifier.) These protocols are extremely lightweight, requiring both parties to perform only a relatively small number of primitive bit-wise operations such as “XOR” and “AND,” and can thus be implemented using fewer than the 5-10K gates required to implement even a block cipher such as DES or AES [20]. The two authentication protocols studied by Juels and Weis are both proven secure via reduction to the “learning parity with noise” (LPN) problem [4, 5, 6, 9, 17, 21, 18, 19, 25]; a formal definition of this problem as well as evidence for its difficulty are reviewed in Section 2.1. The first protocol (called the HB protocol [18, 19]) is proven secure against a passive (eavesdropping) adversary, while the second (called HB+ ) is proven secure against the stronger class of active adversaries. In each case, Juels and Weis focus on a single, “basic authentication step” of the protocol and prove that a computationally-bounded adversary cannot succeed in impersonating a tag in this case with probability noticeably better than 1/2; that is, a single iteration of the protocol has soundness error 1/2. The implicit assumption (though see below) is that repeating these “basic authentication steps” sufficiently-many times yields a protocol with negligible soundness error. Difficulties and limitations. There are, however, some subtle limitations of the security proofs given by Juels and Weis. Most serious, perhaps, is a difficulty explicitly highlighted by Juels and Weis and regarded by them as a potential barrier to usage of the HB + protocol in practice [20, Section 6]: the proof of security for HB + requires that the adversary’s interactions with the tag (i.e., when the adversary is impersonating a tag reader) be sequential. Besides leaving in question the security of HB+ under concurrent executions, this also means that the HB + protocol itself (which, recall, consists of sufficiently-many repetitions of an underlying basic authentication step) requires very high round complexity since the multiple iterations of the basic authentication step cannot be parallelized but must instead be performed sequentially. The difficulty and importance of proving security of various identification protocols under concurrent or parallel composition is wellunderstood, and many results are known: for example, the (black-box) zero-knowledge property of an identification protocol is not preserved under parallel [14] or concurrent [8] composition (though it is preserved under sequential composition [16]), whereas witness indistinguishability is preserved in these cases [11]. Unfortunately, the HB + protocol is not known to satisfy either zero knowledge or witness indistinguishability and so such results are of no help here. An additional difficulty, not explicitly mentioned in [20], is that it is unclear what is the exact relationship between the soundness error and the number of repetitions of the basic authentication step; this is true for both the HB and HB + protocols, regardless of whether the repetitions are carried out in parallel or sequentially.1 This is related to the more general question of “when is solving multiple instances of a problem more difficult than solving a single instance?” (i.e., hardness amplification) which has been studied in many contexts [26, 15, 3, 13, 24, 7] and turns out to be surprisingly non-trivial to answer. Unfortunately, there does not seem to be any prior work that 1 Indeed, as we have noted earlier, Juels and Weis [20] only prove soundness 1/2 for a basic authentication step and never make any claims regarding the security of multiple iterations (for either HB or HB+ ); this indicates that those authors also recognized the difficulty of characterizing the dependence of soundness on the number of iterations. 1 applies in our setting. Specifically: • For the HB and HB+ protocols it is not possible to efficiently verify whether a given transcript is “successful” without possession of the secret key; thus, Yao’s “XOR-lemma” [26, 15] and related techniques that require efficient verifiability do not apply. • Work on hardness amplification for “weakly-verifiable puzzles” [7] does not apply either. Although the HB/HB+ protocols can be viewed as efficiently-verifiable puzzles, hardness amplification in [7] is only proved for completely independent instances of the “puzzle.” In particular, then, the work of [7] implies that running the basic authentication step of the HB protocol n times using n independent keys yields soundness (roughly) 1/2 n , but says nothing about running n iterations using the same key (which is the case we are interested in). • The HB/HB+ protocols are computationally-sound only, and thus known results [13, Appendix C] [24] on soundness reduction for interactive proof systems (which apply only when soundness holds even against an all-powerful cheating prover) do not apply either. • Bellare, et al. [3] study soundness reduction in computationally-sound protocols, and show a positive result [3, Sect. 4] for the case of protocols running in 3 rounds. Unfortunately, their result is specifically stated to apply only when the verifier does not hold a secret key (or, more generally, only when the verifier does not share state across different iterations). As in the case of weakly-verifiable puzzles, then, this result is of no help when the same secret key is used across all iterations. An additional difficulty in our setting is that the verifier is supposed to accept even when some iterations have not been answered successfully; indeed, crucial to both the HB and HB + protocols is that the honest prover injects “noise” into its answers and so even the honest prover does not succeed with probability 1. This was not explicitly addressed in the security proofs of [20], either, and introduces additional complications. 1.1 Our Contributions In this work we address the difficulties and open questions mentioned above, and show the following results: (1) the HB+ protocol remains secure under arbitrary concurrent interactions of the adversary with the honest prover/tag, and so in particular the iterations of the HB + protocol can be parallelized; furthermore, (2) our security proofs explicitly incorporate the dependence of the soundness error on the number of iterations as well as on the error introduced by the honest prover. Besides the results themselves, we expect that the techniques and proofs we give here will be of independent interest for future work on cryptographic applications of the LPN problem. Our main technical tool is a result due to Regev [25] (see also [5]) showing that the hardness of the LPN problem implies the pseudorandomness of a certain distribution. Using this, we give proofs which we believe are substantially simpler than those given in [20], and also more complete (in that, in contrast to [20], they explicitly deal with the dependence of soundness on the number of iterations and also the issues arising due to non-perfect completeness). 1.2 Additional Discussion The problem of secure authentication using a shared, secret key is by now well-understood, and many widely-known solutions based on, e.g., block ciphers are available. We stress that the aim of the line of research considered here, as in [20], is to develop protocols which are exceptionally efficient while still guaranteeing some useful level of (provable) security. The estimates from [20] 2 are that 5,000–10,000+ gates are needed for block-cipher implementations, whereas a typical RFID tag may only have 2,000 gates that can be dedicated to security. Moore’s Law will not necessarily help here, either: as pointed out in [20], there is intense pressure to keep prices for RFID tags low; as computational power per fixed unit of currency increases, the trend has been to reduce the cost of tags and thus expand their application domain rather than to increase their computational power while keeping costs fixed. In short, there seems to be “little effective change in tag resources for some time to come, and thus a pressing need for new lightweight primitives” [20]. Gilbert, et al. [12] have recently shown a man-in-the-middle attack on the HB + protocol. Although their attack would be debilitating if carried out successfully, the possibility of such an attack does not mean that it is now useless to explore the security of the HB/HB + protocols in weaker attack models! (Indeed, only recently have man-in-the-middle attacks on identification protocols been formally considered in general [2], yet certainly research in the area conducted up to that point is not valueless.) There will always be some tradeoff between efficiency and security, and our work can be viewed as mapping out where the HB/HB + protocols lie on this spectrum. Moreover, Juels and Weis [20, Appendix A] note that the man-in-the-middle attack of [12] does not apply in a detection-based system where numerous failed authentication attempts immediately raise an alarm. Furthermore, especially in the case of RFID (where communication is inherently short range), it appears much more difficult to mount a man-in-the-middle attack than an active attack. 2 The reader is referred to the work of Wool, et al. [22, 23], for an illuminating discussion on the feasibility of man-in-the-middle attacks in RFID systems. 2 Definitions and Preliminaries We formally define the LPN problem and state and prove the main technical lemma on which we rely. We also define our notion(s) of security for identification; these are standard, but some complications arise due to the fact that the HB/HB + protocols do not have perfect completeness. 2.1 The LPN Problem View k as a security parameter. If s, a 1 , . . . , aℓ are binary vectors of length k, let zi = hs, ai i denote the dot product of s and ai (modulo 2). Given the values a1 , z1 , . . . , aℓ , zℓ for randomly-chosen {ai } and ℓ = O(k), it is possible to efficiently solve for s using standard linear-algebraic techniques. However, in the presence of noise where each z i is flipped (independently) with probability ε, finding s becomes much more difficult. We refer to the problem of learning s in this latter case as the LPN problem. For the formal definition, let Ber ε be the Bernoulli distribution with parameter ε ∈ (0, 12 ) (so if ν ∼ Berε then Pr[ν = 1] = ε and Pr[ν = 0] = 1 − ε), and let A s,ε be the distribution defined by: n o a ← {0, 1}k ; ν ← Berε : (a, hs, ai ⊕ ν) . Also let As,ε denote an oracle which outputs (independent) samples according to this distribution. Algorithm M is said to (t, q, δ)-solve the LPN ε problem if i h Pr s ← {0, 1}k : M As,ε (1k ) = s ≥ δ, 2 Though there have been claims of being able to read some RFID tags over as much as 69 feet [1], the maximum distance from which many commonly-used cards can be read appears to be almost two orders of magnitude lower [22]. Note further that a man-in-the-middle attack requires the ability to send data to the tag (and reader). 3 and furthermore M runs in time at most t and makes at most q queries to its oracle. 3 In asymptotic terms, in the standard way, the LPN ε problem is “hard” if every probabilistic polynomial-time algorithm solves the LPNε problem with only negligible probability (where the algorithm’s running time and success probability are functions of k). Note that ε is usually taken to be a fixed constant independent of k, as will be the case here. The value of ε to use depends on a number of tradeoffs and design decisions: although, roughly speaking, the LPNε problem becomes “harder” as ε increases, a larger value of ε also implies that the honest prover is rejected more often (as will become clear when we describe the HB/HB + protocols, below). In any case, our results are meaningful for all ε ∈ (0, 14 ). For concreteness, the reader can think of ε ≈ 18 . The hardness of the LPNε problem (for constant ε ∈ (0, 12 )) has been studied in many previous works. It can be formulated also as the problem of decoding a random linear code [4, 25], and is known to be N P-complete [4] as well as hard to approximate within a factor better than 2 (where the optimization problem is phrased as finding an s satisfying the most equations) [17]. These worst-case hardness results are complemented by numerous studies of the average-case hardness of the problem [5, 6, 9, 21, 18, 19, 25]. Most relevant for our purposes is that the current best-known algorithm for solving the LPN ε problem [6] requires t, q = 2Θ(k/ log k) . We refer the reader to [20, Appendix D] for more exact estimates of the running time of this algorithm, as well as suggested practical values for k. 2.2 A Technical Lemma In this section we prove a key technical lemma: hardness of the LPN ε problem implies “pseudorandomness” of As,ε . Specifically, let Uk+1 denote the uniform distribution on (k + 1)-bit strings. The following lemma shows that oracle access to A s,ε (for randomly-chosen s) is indistinguishable from oracle access to Uk+1 . A proof of the following is essentially in [25, Sect. 4], although we have fleshed out some of the details and worked out the concrete parameters of the reduction. Lemma 1 Say there exists an algorithm D making q oracle queries, running in time t, and such that i i h h Pr s ← {0, 1}k : D As,ε (1k ) = 1 − Pr DUk+1 (1k ) = 1 ≥ δ.
Then there exists an
algorithm M making q ′ = O q · δ −2 log k oracle queries, running in time t′ = O t · kδ −2 log k , and such that h i Pr s ← {0, 1}k : M As,ε (1k ) = s ≥ δ/4. (We remark that various tradeoffs are possible between the number of queries/running time of M and its success probability in solving LPN ε ; see [25, Sect. 4]. We aimed for simplicity in the proof rather than trying to optimize parameters.)
Proof Set N = O δ−2 log k . Algorithm M As,ε (1k ) proceeds as follows: 1. M chooses random coins ω for D and uses these for the remainder of its execution. 2. M runs D Uk+1 (1k ; ω) for a total of N times to obtain an estimate p for the probability that D outputs 1 in this case. (The probability here is over the responses from the oracle.) 3 Our formulation of the LPN problem follows, e.g., [25]; the formulation in, e.g., [20] allows M to output any s satisfying ≥ (1 − ε) fraction of the equations returned by As,ε . It is easy to see that for q large enough these formulations are essentially equivalent as with overwhelming probability there will be a unique such s. 4 3. M obtains q · N samples {(a1,j , z1,j )}qj=1 , . . . , {(aN,j , zN,j )}qj=1 from As,ε . Then for i ∈ [k]: (a) Run D(1k ; ω) for a total of N times, using a fresh set of samples {(a j , zj )}qj=1 to answer the q oracle queries of D each time. Answer the j th oracle query of D in each iteration by choosing a random bit cj and returning (aj ⊕ (cj · ei ), zj ), where ei is the vector with 1 at position i and 0s elsewhere. Obtain an estimate p i for the probability that D outputs 1 in this case. (b) If |pi − p| ≥ δ/4 set s′i = 0; else set s′i = 1. 4. Output s′ = (s′1 , . . . , s′k ). Let us analyze the behavior of M . First note that, by standard averaging argument, with probability at least δ/2 over choice of s and random coins ω it holds that h i h i Pr DAs,ε (1k ; ω) = 1 − Pr D Uk+1 (1k ; ω) = 1 ≥ δ/2, (1) where the probabilities are taken over the answers D receives from its oracle. We restrict our attention to s, ω for which Eq. (1) holds and show that in this case M outputs s ′ = s with probability at least 1/2. The theorem follows. By our choice of N we have that i h (2) Pr DUk+1 (1k ; ω) = 1 − p ≤ δ/16 except with probability at most O(1/k). Next focus on a particular iteration i of steps 3(a) and 3(b). Letting hybi denote the distribution of the answers returned to D in this iteration, we again have h i (3) Pr D hybi (1k ; ω) = 1 − pi ≤ δ/16 except with probability at most O(1/k). Applying a union bound (and setting parameters appropriately) we see that with probability at least 1/2 Eqs. (2) and (3) hold (the latter for all i ∈ [k]), and so we assume this to be the case for the rest of the proof. We claim that if si = 0 then hybi = As,ε , while if si = 1 then hybi = Uk+1 . To see this note that when si = 0 the answer (aj ⊕ (cj · ei ), zj ) returned to D is distributed exactly according to A s,ε since hs, aj ⊕ (cj · ei )i = hs, aj i = zj . On the other hand, if si = 1 then zj = hs, aj i is independent of aj ⊕ (cj · ei ) since cj is random (and unknown to D). It follows that if si = 0 then h i h i Pr D hybi (1k ; ω) = 1 − Pr D Uk+1 (1k ; ω) = 1 ≥ δ/2 δ ′ = 3δ (by Eq. (1)), and so |pi − p | ≥ 2δ − 2 · 16 8 (by Eqs. (2) and (3)) and s i = 0 = si . When si = 1 then i i h h Pr Dhybi (1k ; ω) = 1 = Pr D Uk+1 (1k ; ω) = 1 , δ = 8δ (again using Eqs. (2) and (3)) and s ′i = 1 = si . Since this holds for all and so |pi − p | ≤ 2 · 16 i ∈ [k], we conclude that s′ = s. 5 2.3 Overview of the HB/HB+ Protocols, and Security Definitions The HB and HB+ protocols as analyzed here consist of n parallel iterations of a “basic authentication step.” We describe the basic authentication step for the HB protocol, and defer a discussion of the HB+ protocol to Section 3.2. In the HB protocol, a tag T and a reader R share a random secret key s ∈ {0, 1}k ; a basic authentication step consists of the reader sending a random challenge a ∈ {0, 1}k to the tag, which replies with z = hs, ai ⊕ ν for ν ∼ Ber ε . The reader can then verify ? whether the response z of the tag satisfies z = hs, ai; we say the iteration is successful if this is the case. See Figure 1. T (s, ε) R(s) a a ← {0, 1}k ✛ ν ← Berε z := hs, ai ⊕ ν z ✲ ? verify: z = hs, ai Figure 1: The basic authentication step of the HB protocol. Even for an honest tag a basic iteration is unsuccessful with probability ε. For this reason, a reader accepts upon completion of all n iterations of the basic authentication step as long as ≈ ε · n of these iterations were unsuccessful. More precisely, let l, u be such that l ≤ ε · n ≤ u; then the reader accepts as long as the number of unsuccessful iterations lies in the range [l, u]. Since ε · n is the expected number of unsuccessful iterations for an honest tag, the completeness error ε c (i.e., the probability that an honest tag is rejected) can be calculated via a Chernoff bound. 4 Overall, then, the entire HB protocol is parameterized by ε, l, u, and n. Observe that by sending random answers in each of the n iterations, an adversary trying to impersonate a valid tag succeeds with probability def ∗ = δε,l,u,n −n 2 · u   X n i=l i ; ∗ that is, δε,l,u,n is the best possible soundness error we can hope to achieve for the given setting of the parameters. Our definitions of security will be expressed in terms of the adversary’s ability to do better than this. Looking at asymptotic security (taking k as a security parameter), note that for any constant ε < 1/2 it is easy to find functions l, u, n of k such that n = O(k) and furthermore ∗ are negligible. both the completeness error εc and the “best achievable” soundness error δ ε,l,u,n HB Let Ts,ε,n denote the tag algorithm in the HB protocol when the tag holds secret key s (note that the tag algorithm is independent of l, u), and let R HB s,ε,l,u,n similarly denote the algorithm run by the tag reader. We denote a complete execution of the HB protocol between a party T̂ and the E D and say this equals 1 iff the reader accepts. reader R by Tˆ , RHB s,ε,l,u,n For the case of a passive attack on the HB protocol, we imagine an adversary A running in 4 Note in particular that if u is set to exactly ε · n then the completeness error will be rather high. One can imagine changing the protocol so that the tag introduces at most ε · n errors; see Section 4 for discussion of this point. 6 two stages: in the first stage the adversary obtains q transcripts 5 of (honest) executions of the protocol by interacting with an oracle trans HB s,ε,n (this models eavesdropping); in the second stage, the adversary interacts with the reader and tries to impersonate the tag. We define the adversary’s advantage as E i h D def ∗ k transHB HB s,ε,n (1k ) : Advpassive = 1 − δε,l,u,n . (ε, l, u, n) = Pr s ← {0, 1} ; A A, R s,ε,l,u,n A,HB + As we will describe in Section 3.2, the HB + protocol uses two keys s1 , s2 . We let TsHB denote 1 ,s2 ,ε,n + HB the tag algorithm in this case, and let R s1 ,s2 ,ε,l,u,n denote the algorithm run by the tag reader. For the case of an active attack on the HB + protocol, we again imagine an adversary running in two stages: in the first stage the adversary interacts at most q times with the honest tag algorithm (with concurrent executions allowed), while in the second stage the adversary interacts only with the reader.6 The adversary’s advantage in this case is   E D + + def TsHB ∗ active k k HB ,s ,ε,n . AdvA,HB+ (ε, l, u, n) = Pr s1 , s2 ← {0, 1} ; A 1 2 (1 ) : A, Rs1 ,s2 ,ε,l,u,n = 1 − δε,l,u,n We remark that in both the HB and HB+ protocols, the tag reader’s actions are independent of the secret key(s) it holds except for its final decision whether or not to accept. So, allowing the adversary to interact with the reader multiple times (even concurrently) does not give the adversary much additional advantage (other than the fact that, as usual, the probability that the adversary succeeds in at least one impersonation attempt scales linearly with the number of attempts). Proofs of Security for the HB and HB+ Protocols 3 3.1 Security of the HB Protocol against Passive Attacks Recall from the previous section that we parameterize the HB protocol by ε (a measure of the noise introduced by the tag), l, u (which determine the completeness error ε c as well as the best achievable soundness δ ∗ ), and n (the number of iterations of the basic authentication step given in Figure 1). We stress that these n iterations are run in parallel, and so the entire protocol requires only two rounds. The following result characterizes security of the HB protocol against passive attack. This can be compared to [20, Lemma 1], where Juels and Weis prove security for a single iteration of the HB protocol (i.e., they fix n = 1) and do not explicitly take the non-zero completeness error into account (this is taken into account in the following via the dependence on l, u). Theorem 2 Say there exists an adversary A eavesdropping on at most q executions of the HB protocol, running in time t, and achieving Adv passive A,HB (ε, l, u, n) ≥ δ. Then there exists an algorithm D making (q + 1) · n oracle queries, running in time O(t), and such that i i h h Pr s ← {0, 1}k : D As,ε (1k ) = 1 − Pr D Uk+1 (1k ) = 1 2u   X n ∗ . ≥ δ + δε,l,u,n − εc − 2−n · i i=0 5 Following [18, 19, 20], a transcript comprises only the messages exchanged between the parties and does not include the reader’s decision of whether or not to accept. If the adversary is given this additional information, the adversary’s advantage may increase by (at most) an additive factor of q · ε c . 6 As we have already noted, this is the “classical” notion of security against active attacks which does not take into account man-in-the-middle attacks. 7 Asymptotically, for any ε < 14 and n = Θ(k) all terms of the above expression (other than δ) are negligible for appropriate choice of l, u. We thus conclude that the HB protocol is secure (for n = Θ(k) and appropriate choice of l, u) assuming the hardness of the LPN ε problem. Proof D, given access to an oracle returning (k + 1)-bit strings (a, z), proceeds as follows: 1. D runs the first phase of A. Each time A requests to view a transcript of the protocol, D obtains n samples {(ai , zi )}ni=1 from its oracle and returns these to A. 2. When A is ready for the second phase, D again obtains n samples {(āi , z̄i )}ni=1 from its oracle. D then sends the challenge (ā1 , . . . , ān ) to A and receives in return a response Z ′ = (z1′ , . . . , zn′ ). 3. D outputs 1 iff Z̄ = (z̄1 , . . . , z̄n ) and Z ′ differ in at most 2u entries. P n
When D’s oracle is Uk+1 , it is clear that D outputs 1 with probability exactly 2 −n · 2u i=0 i since Z̄ is in this case uniformly distributed and independent of everything else. On the other hand, when D’s oracle is As,ε then the transcripts D provides to A during the first phase of A’s execution are distributed identically to real transcripts in an execution of the HB protocol. Let def Z ∗ = (hs, ā1 i , . . . , hs, ān i) be the vector of “correct” answers to the challenge (ā1 , . . . , ān ) sent by ∗ D in the second phase. Then with probability at least δ + δ ε,l,u,n it holds that Z ′ and Z ∗ differ in at most u entries (since A successfully impersonates the tag with this probability). Also, since Z̄ is distributed exactly as the answers of an honest tag, Z̄ and Z ∗ differ in at most u positions except ∗ − εc the vectors Z ′ with probability at most εc . It follows that with probability at least δ + δ ε,l,u,n and Z̄ differ in at most 2u entries, and so D outputs 1 with at least this probability. The above result provides a useful P security
guarantee only when ε < 1/4, since when ε ≥ 1/4 u n then 2u ≥ 2ε · n ≥ n/2 and so 2−n · 2i=0 i ≥ 1/2. We also note that the concrete security reduction obtained above leaves much to be desired, and in particular it is not clear whether useful levels of security are achieved for reasonably-efficient settings of the parameters. On the other hand, it is unclear what can be said about the tightness of the security reductions obtained by Juels and Weis [20] since they do not explicitly handle multiple iterations of the protocol nor do they consider the effect that the acceptance criteria (i.e., in terms of l, u) have on the soundness. We believe that the security reduction can be improved by taking into account the distribution on Z̄ when D’s oracle is As,ε (and modifying step 3 of D appropriately), as well as by focusing on protocols with perfect completeness. See Section 4 for some discussion of the latter possibility. 3.2 Security of the HB+ Protocol against Active Attacks The HB protocol is insecure against an active attack, as an adversary can simply repeatedly query the tag with the same challenge vector (a 1 , . . . , an ) and thereby determine with high probability the correct values of hs, a1 i , . . . , hs, an i (after which solving for s is easy). To combat such an attack, Juels and Weis propose to modify the HB protocol by having the tag and reader share two (independent) keys s1 , s2 ∈ {0, 1}k . A basic authentication step now consists of three rounds: first the tag sends a random “blinding factor” b ∈ {0, 1} k ; the reader replies with a random challenge a ∈ {0, 1}k as before; and finally the tag replies with z = hs 1 , bi ⊕ hs2 , ai ⊕ ν for ν ∼ Ber ε . As in the HB protocol, the tag reader can then verify whether the response z of the tag satisfies ? z = hs1 , bi ⊕ hs2 , ai, and we again say the iteration is successful if this is the case. See Figure 2. The actual HB+ protocol consists of n parallel iterations of the basic authentication step (and so the entire protocol requires only three rounds). The protocol also depends upon parameters l, u ∗ are defined exactly as there. as in the case of the HB protocol, and the values ε c and δε,l,u,n 8 T (s1 , s2 , ε) R(s1 , s2 ) b a b ← {0, 1}k ✲ a ← {0, 1}k ✛ ν ← Berε z := hs1 , bi ⊕ hs2 , ai ⊕ ν z ✲ ? verify: z = hs1 , bi ⊕ hs2 , ai Figure 2: The basic authentication step of the HB + protocol. The following result characterizes security of the HB + protocol under active attacks. It can be compared to [20, Lemma 3], where Juels and Weis prove security for a single iteration of the HB+ protocol (i.e., they fix n = 1). Their proof requires rewinding of the adversary A in order to simulate the first phase of A, and therefore their proof does not extend to the case of parallel or concurrent executions of the basic authentication step. We remark that by combining the proofs of Theorem 3 and Lemma 1 (i.e., reducing the HB + protocol directly to the LPN problem rather than relying on Lemma 1 as an intermediate step) we can improve the security reduction stated in the following theorem. By applying techniques from [25, Sect. 4], the parameters of the reduction can be improved further. Theorem 3 Say there exists an adversary A interacting with the tag in at most q executions of (ε, l, u, n) ≥ δ. the HB+ protocol (possibly concurrently), running in time t, and achieving Adv active A,HB+ Then there exists an algorithm D making q · n oracle queries, running in time O(t), and such that h k Pr s ← {0, 1} : D As,ε 3  2u   ∗ i i h X δ + δε,l,u,n n 2n −n Uk+1 k . (1 ) = 1 ≥ (1 ) = 1 − Pr D − k −2 · i 2 2 k i=0 Asymptotically, for any ε < 41 and appropriate choice of n, l, u the last two terms of the above expression (and also εc ) are negligible. We thus conclude that the HB+ protocol is secure (for appropriate choice of n, l, u) assuming the hardness of the LPN ε problem. Proof D, given access to an oracle returning (k + 1)-bit strings (b, z̄), proceeds as follows: 1. D chooses s2 ∈ {0, 1}k uniformly at random. Then, it runs the first phase of A. To simulate a basic authentication step, D does the following: it obtains a sample (b, z̄) from its oracle and sends b as the initial message. A replies with a challenge a, and then D responds with z = z̄ ⊕ hs2 , ai. Note that since D does not rewind A here, there is no difficulty in simulating parallel executions of the basic authentication step (i.e., as part of an execution of the “full” HB+ protocol) or concurrent executions of the HB + protocol. 2. When A is ready for the second phase of the HB + protocol, A sends an initial message b1 , . . . , bn (we now explicitly look at the actual HB+ protocol rather than focusing on a single basic authentication step). In response, D chooses random a 11 , . . . , a1n ∈ {0, 1}k , sends these challenges to A, and records A’s response z 11 , . . . , zn1 . Then D rewinds A, chooses random a21 , . . . , a2n ∈ {0, 1}k , sends these to A, and records A’s response z 12 , . . . , zn2 . 9 
def 3. Let zi⊕ := zi1 ⊕ zi2 and set Z ⊕ = z1⊕ , . . . , zn⊕ . Let âi = a1i ⊕ a2i and ẑi = hs2 , âi i, and set def Ẑ = (ẑ1 , . . . , ẑn ). D outputs 1 iff Z ⊕ and Ẑ differ in at most 2u entries. Let us analyze the behavior of D: Case 1: Say D’s oracle is Uk+1 . In step 1, above, since z̄ is uniformly distributed and independent of everything else, the answers z that D returns to A are uniformly distributed and independent of everything else. It follows that A’s view throughout the entire experiment is independent of the secret s2 chosen by D. n The {âi }ni=1 are uniformly and independently distributed, and so except with probability 22k they are linearly independent and non-zero (cf. Claim 4, below). Assuming this to be the case, Ẑ is uniformly distributed over {0, 1}n from the point ofPview of A. But then the probability that u n
Z ⊕ and Ẑ differ in at most 2u entries is exactly 2−n · 2i=0 . We conclude that D outputs 1 in i P2 u n
2n −n this case with probability at most 2k + 2 · i=0 i . Case 2: Say D’s oracle is As1 ,ε for randomly-chosen s1 . In this case, D provides a perfect simulation def δ+δ∗ ε,l,u,n for the first phase of A. By a standard averaging argument, with probability at least δ̂ = 2 over the randomness used in the first phase of A (which includes the keys s 1 , s2 , the randomness of A, and the randomness used in responding to A’s queries) the probability (over random challenges a1 , . . . , an sent by the tag reader in the second phase) that A successfully impersonates the tag in the second phase is at least δ̂. Assume this is the case. Then the probability that A successfully responds to both sets of queries a11 , . . . , a1n and a21 , . . . , a2n is at least δ̂2 . But this means that (z11 , . . . , zn1 ) differs in at most u entries from the “correct” answer
def ans1 = hs1 , b1 i ⊕ s2 , a11 , . . . , hs1 , bn i ⊕ s2 , a1n and also (z12 , . . . , zn2 ) differs in at most u entries from the “correct” answer
def ans2 = hs1 , b1 i ⊕ s2 , a21 , . . . , hs1 , bn i ⊕ s2 , a2n . But then (z11 , . . . , zn1 ) ⊕ (z12 , . . . , zn2 ) = Z ⊕ differs in at most 2u entries from ans1 ⊕ ans2 = =
s2 , a11 ⊕ s2 , a21 , . . . , s2 , a1n ⊕ s2 , a2n
= Ẑ. s2 , (a11 ⊕ a21 ) , . . . , s2 , (a1n ⊕ a2n ) We conclude that D outputs 1 in this case with probability at least δ̂ · δ̂2 . This completes the proof of the theorem. The following technical claim, used in the above proof, is quite straightforward: Claim 4 Assume n vectors a1 , . . . , an are chosen uniformly at random from {0, 1}k . The proban bility that these vectors are not linearly independent is less than 22k . Proof Say event Badi occurs if ai is linearly dependent on the previous i − 1 vectors chosen (for the case i = 1 this is the event a1 = 0k ). Since the subspace spanned by i − 1 vectors has size at i−1 most 2i−1 , the probability of Badi is at most 22k . Applying a union bound, we have: # "n n−1 X _ 2n −k 2i < k , Badi ≤ 2 · Pr 2 i=0 i=1 yielding the claim. A typical range of parameters might be k ≈ 200 and n ≈ 40–50, so the inconsequential. 10 2n 2k term above is truly 4 Conclusions and Open Questions The main technical results of this paper are the first rigorous proofs of (1) security of the HB + protocol against active attacks, even under parallel and concurrent executions; and (2) “hardness amplification” for the HB and HB+ protocols as the number of iterations of the basic authentication step increases. Our proofs are also the first to explicitly take into account the non-zero completeness error and the impact this has on the security of the protocol as a whole. We believe our proofs are remarkably simple, and view this as an additional contribution of this work (rather than as a drawback!). Indeed, we expect there will be further applications of Lemma 1 to the analysis of other cryptographic constructions based on the LPN problem, and hope this paper inspires and aids others in exploring such applications. It would be nice to improve the analysis (or propose new protocols) so as to obtain meaningful security guarantees even in the case 14 ≤ ε < 12 . It would also be wonderful to improve the concrete security reductions obtained here, or to propose new protocols with tighter security reductions. (As we have mentioned, it is not clear whether the proofs provided here yield sufficiently-high security for practically-efficient settings of the parameters.) As one possible approach toward this goal, one can imagine changing the HB/HB + protocols so that the tag always introduces at most ε · n errors, rather than introducing errors in each of the n iterations with independent probability ε. 7 (A related idea, in a different context, was explored in [5]; their analysis does not seem to apply to our setting.) This would give protocols with perfect completeness, and would improve the concrete security bounds as well since the upper bound u could be set to exactly ε · n and the “problem” mentioned in footnote 5 would also go away. On the other hand it is not clear what can be said of the hardness of the natural variant of the LPN problem such protocols would be based on. It would also be very interesting to see an efficient protocol based on the LPN problem that is provably resistant to man-in-the-middle attacks. References [1] Associated Press. “Geeks Flex Hacker Muscles at Defcon.” Article appearing Aug. 2, 2005 on CNN.com. [2] M. Bellare, M. Fischlin, S. Goldwasser, and S. Micali. Identification Protocols Secure against Reset Attacks. Adv. in Cryptology — Eurocrypt 2001, LNCS vol. 2045, Springer-Verlag, pp. 495–511, 2001. [3] M. Bellare, R. Impagliazzo, and M. Naor. Does Parallel Repetition Lower the Error in Computationally-Sound Protocols? 38th IEEE Symposium on Foundations of Computer Science, IEEE, pp. 374–383, 1997. [4] E.R. Berlekamp, R.J. McEliece, and H.C.A. van Tilborg. On the Inherent Intractability of Certain Coding Problems. IEEE Trans. Info. Theory 24: 384–386, 1978. [5] A. Blum, M. Furst, M. Kearns, and R. Lipton. Cryptographic Primitives Based on Hard Learning Problems. Adv. in Cryptology — Crypto ’93, LNCS vol. 773, Springer-Verlag, pp. 278–291, 1994. [6] A. Blum, A. Kalai, and H. Wasserman. Noise-Tolerant Learning, the Parity Problem, and the Statistical Query Model. J. ACM 50(4): 506–519, 2003. 7 Note that introducing exactly ε · n errors in the n iterations is insecure. 11 [7] R. Canetti, S. Halevi, and M. Steiner. Hardness Amplification of Weakly Verifiable Puzzles. 2nd Theory of Cryptography Conference (TCC 2005), LNCS vol. 3378, Springer-Verlag, pp. 17–33, 2005. [8] R. Canetti, J. Kilian, E. Petrank, and A. Rosen. Black-Box Concurrent Zero-Knowledge Requires (Almost) Logarithmically Many Rounds. SIAM J. Computing 32(1): 1–47, 2002. [9] F. Chabaud. On the Security of Some Cryptosystems Based on Error-Correcting Codes. Adv. in Cryptology — Eurocrypt ’94, LNCS vol. 950, Springer-Verlag, pp. 131–139, 1995. [10] W. Diffie and M. Hellman. New Directions in Cryptography. IEEE Trans. Info. Theory 22(6): 644–654 (1976). [11] U. Feige and A. Shamir. Witness Indistinguishability and Witness Hiding Protocols. 22nd ACM Symposium on Theory of Computing, ACM, pp. 416–426, 1990. [12] H. Gilbert, M. Robshaw, and H. Silbert. An Active Attack against HB + — a Provably Secure Lightweight Authentication Protocol. Available at http://eprint.iacr.org/2005/237 [13] O. Goldreich. Modern Cryptography, Probabilistic Proofs, and Pseudorandomness. SpringerVerlag, 1998. [14] O. Goldreich and H. Krawczyk. On the Composition of Zero-Knowledge Proof Systems. SIAM J. Computing 25(1): 169–192, 1996. [15] O. Goldreich, N. Nisan, and A. Wigderson. On Yao’s XOR-Lemma. Available at http://eccc.uni-trier.de/eccc-reports/1995/TR95-050/ [16] O. Goldreich and Y. Oren. Definitions and Properties of Zero-Knowledge Proof Systems. J. Cryptology 7(1): 1–32, 1994. [17] J. Håstad. Some Optimal Inapproximability Results. J. ACM 48(4): 798–859, 2001. [18] N. Hopper and M. Blum. A Secure Human-Computer Authentication Scheme. Technical Report CMU-CS-00-139, Carnegie Mellon University, 2000. [19] N. Hopper and M. Blum. Secure Human Identification Protocols. Adv. in Cryptology — Asiacrypt 2001, LNCS vol. 2248, pp. 52–66, 2001. [20] A. Juels and S. Weis. Authenticating Pervasive Devices with Human Protocols. Adv. in Cryptology — Crypto 2005, LNCS vol. 3621, Springer-Verlag, pp. 293–308, 2005. Updated version available at: http://www.rsasecurity.com/rsalabs/staff/bios/ajuels/publications/pdfs/lpn.pdf [21] M. Kearns. Efficient Noise-Tolerant Learning from Statistical Queries. J. ACM 45(6): 983– 1006, 1998. [22] Z. Kfir and A. Wool. Picking Virtual Pockets using Relay Attacks on Contactless Smartcard Systems. Available at http://eprint.iacr.org/2005/052 [23] I. Kirschenbaum and A. Wool. How to Build a Low-Cost, Extended-Range RFID Skimmer. Available at http://eprint.iacr.org/2006/054 [24] R. Raz. A Parallel Repetition Theorem. SIAM J. Computing 27(3): 763–803, 1998. 12 [25] O. Regev. On Lattices, Learning with Errors, Random Linear Codes, and Cryptography. 37th ACM Symposium on Theory of Computing, ACM, pp. 84–93, 2005. [26] A. C.-C. Yao. Theory and Applications of Trapdoor Functions. 23rd IEEE Symposium on Foundations of Computer Science, IEEE, pp. 80–91, 1982. 13