Analysis of block cipher modes of operation for RFID devices

K. D. Tsaregorodtsev

Prikladnaya Diskretnaya Matematika. Supplement, no. 13 (2020), pp. 67-69

Résumé

The RFID system consists of radio-tag and interrogator. The main purpose of devices is authentication with a transmission of small amount of data between tag and interrogator. We study modes that require only block encryption to be implemented in the tag (due to hardware limitations). CTR, OFB and modified CBC modes were analyzed. Modified CBC mode CBC$[F]$ can be specified as follows: $$ C_0 = \text{IV}, C_i = F_k(C_{i-1} \oplus M_i), $$ where $F_k$ denotes either encryption ($F_k = E_k$) or decryption ($F_k = E_k^{-1})$ of one block of data on the key $k$, $M_i$ is the $i$-th block of plaintext, $C_i$ is the $i$-th block of ciphertext, IV is an initialization vector. Assume that the length of the key is $k$ bits, the length of the one block of data is $n$ bits, and consider an adversary that runs time no more than $t$, makes no more than $q$ oracle queries, each of length no more than $m$ blocks. Then, given an oracle access to the CBC$[E_k]$ and $\widehat{\text{CBC}} = \text{CBC}[E_k^{-1}]$ modes, the maximal advantage in the LOR-experiment can be bounded from above by: $$ \text{Adv}^\text{LOR}_{\text{CBC}, \widehat{\text{CBC}}}(t, q, m) \le \frac{3q^2 m^2}{2^n - qm} + \frac{t+q}{2^{k-1}}. $$

Détail

Keywords: provable security, RFID, mode of operation.