Cryptanalysis on Anonymous Identity Authentication Protocols Using Chip Cards and RFID Tags

[[abstract]]為了有效地控管有限的資源，電子化的身份驗證機制已是現代生活中廣泛使用的技術；而為保障使用者的隱私，具匿名性(anonymity)的身份驗證協定為近年來十分受矚目的研究領域。 2004年，Das等學者提出了動態身份(dynamic identity)的概念，以確保驗證訊息不致洩露使用者的身份資訊。2009年，Wang等學者指出Das等學者的身份驗證協定具有安全上的缺失並提出改良的協定，宣稱他們的方法更安全且有效率。本論文將提出針對該身份驗證協定之扮演攻擊(impersonation attack )，首先，攻擊者可對登入請求訊息內的時戳進行竄改，在任何時間都能登入伺服器，不受到原時戳對登入請求訊息造成的時效限制。不僅如此，該攻擊還可讓攻擊者扮演成任意合法使用者登入伺服器。整體而言，本論文所提出的攻擊可以控制時戳與帳號，對該協定造成極大傷害。 動態身份的構想若是設計得宜，確實可能保障使用者的隱私；但是若在實作時，驗證者與被驗證者間之資料同步是一大問題。在2008年Liao與Tzeng提出了一個新型態的RFID身份驗證協定，巧妙地暫存少量資訊，並於雙方失去同步時，利用該暫存資訊恢復同步。本論文針對Liao與Tzeng的RFID身份驗證協定提出侵害匿名性之追蹤攻擊(tracing attack)，該攻擊以破壞標籤與資料庫的資料同步為手段，迫使理應動態更新之身份資訊停止更新，並藉此達到追蹤標籤之目的，同時破壞標籤(或標籤持有人)的位置隱私(location privacy)。本論文亦提出可能的改進方案。 以上所討論的驗證協定，均屬於單一伺服器的架構，當使用者有使用多種伺服器資源的需求時,則必需對各個伺服器進行註冊，對使用者極為不便。2010年，Juang等學者提出了多重伺服器環境下之身份驗證協定，嘗試解決此問題。然而，我們發現Juang等學者的身份驗證協定無法抵抗追蹤攻擊、阻斷標籤服務攻擊(Tag-destroy attack)與惡意伺服器之扮演攻擊。[[abstract]]In order to effectively control limited resources, identity authentication is a widely used technology in modern life. Moreover, for the privacy of users, designing identity authentication protocols with anonymity is a popular research topic in recent years. In 2004, Das et al. introduced the idea of dynamic identity, to ensure that the authentication message will not reveal user's identity information. In 2009, Wang et al. pointed out that Das et al.’s identity authentication protocol is insecure and proposed an improved protocol which is claimed to be more secure and efficient. In this thesis, we will propose an impersonation attack against Wang et al.’s protocol. First of all, an attacker can modify the time-stamp in a login request message, then he can login that server at any time, not subject to the limitation of the original time-stamp. Furthermore, an attacker can impersonation any legitimate user and login the server at any time. Overall, in the proposed attack, an attacker controls the time stamp and the identification, causing great harm to Wang et al.’s protocol. Dynamic identity may protect the privacy of users if the protocol properly designed; however, data synchronization between a user and a verifier is a big problem in implementation. In 2008, Liao and Tzeng proposed a new type of RFID identity authentication protocol, cleverly uses a small amount of temporary storage to ensure a user and a verifier can re-synchronize after a failed transaction. In this thesis, we will propose tracing attacks against Liao and Tzeng’s protocol. The attack destroys the synchronization between an RFID tag and the database, forcing the identification information stop updating; then achieves the purpose of tracking a tag and compromises the tag’s (or the tag holder’s) location privacy. We also propose possible countermeasure in this thesis. Previous authentication protocols are designed for single-server environment, it will be inconvenient if a user needed to access different resources provided by different servers. In 2010, Juang et al. try to resolve this issue by suggesting an identity authentication protocol in multi-server environment. However, in this thesis, we found Juang et al.’s identity authentication protocol is insecure against a tracking attack, a tag-destroy attack, and an impersonation attack of malicious server