Tamper-Evident Pairing (2311.14790v1)
Abstract: Establishing a secure connection between wireless devices has become significantly important with the increasing number of Wi-Fi products coming to the market. In order to provide an easy and secure pairing standard, the Wi-Fi Alliance has designed the Wi-Fi Protected Setup. Push-Button Configuration (PBC) is part of this standard and is especially useful for pairing devices with physical limitations. However, PBC is proven to be vulnerable to man-in-the-middle (MITM) attacks. Tamper-Evident Pairing (TEP) is an improvement of the PBC standard, which aims to fix the MITM vulnerability without interfering the useful properties of PBC. It relies on the Tamper-Evident Announcement (TEA), which guarantees that an adversary can neither tamper a transmitted message without being detected, nor hide the fact that the message has been sent. The security properties of TEP were proven manually by its authors and tested with the Uppaal and Spin model checkers. During the Uppaal model checking, no vulnerabilities were found. However, the Spin model revealed a case, in which the TEP's security is not guaranteed. In this paper, we first provide a comprehensive overview of the TEP protocol, including all information needed to understand how it works. Furthermore, we summarize the security checks performed on it, give the circumstances, under which it is no longer resistant to MITM attacks and explain the reasons why they could not be revealed with the first model. Nevertheless, future work is required to gain full certainty of the TEP's security before applying it in the industry.
- W.-F. Alliance, “Wi-Fi Protected Setup Specification, version 1.0 h, 2006,”
- S. Viehböck, “Brute forcing Wi-Fi Protected Setup,” Wi-Fi Protected Setup, vol. 9, 2011.
- W. Diffie and M. E. Hellman, “New directions in cryptography.,” IEEE Trans. Inf. Theory, vol. 22, no. 6, pp. 644–654, 1976.
- R. Kainda, I. Flechais, and A. W. Roscoe, “Usability and security of out-of-band channels in secure device pairing protocols,” in Proceedings of the 5th Symposium on Usable Privacy and Security, pp. 1–12, 2009.
- S. Gollakota, N. Ahmed, N. Zeldovich, and D. Katabi, “Secure In-Band Wireless Pairing,” in 20th USENIX Security Symposium (USENIX Security 11), (San Francisco, CA), USENIX Association, Aug. 2011.
- S. Owre, J. M. Rushby, and N. Shankar, “PVS: A Prototype Verification System,” in International Conference on Automated Deduction, pp. 748–752, Springer, 1992.
- G. J. Holzmann, “The model checker SPIN,” IEEE Transactions on software engineering, vol. 23, no. 5, pp. 279–295, 1997.
- J. Bengtsson, K. Larsen, F. Larsson, P. Pettersson, and W. Yi, “UPPAAL — a Tool Suite For Automatic Verification of Real-Time Systems,” in International hybrid systems workshop, pp. 232–243, Springer, 1995.
- A. Cimatti, E. Clarke, F. Giunchiglia, and M. Roveri, “NuSMV: A New Symbolic Model Verifier,” in International conference on computer aided verification, pp. 495–499, Springer, 1999.
- Cham: Springer International Publishing, 2018.
- M. Drijvers, M. Van Eekelen, and R. Kersten, “Model checking Tamper-Evident Pairing,” 2012.
- R. Kersten, B. v. Gastel, M. Drijvers, S. Smetsers, and M. v. Eekelen, “Using Model-Checking to Reveal a Vulnerability of Tamper-Evident Pairing,” in NASA Formal Methods Symposium, pp. 63–77, Springer, 2013.
- S. Mirzadeh, H. Cruickshank, and R. Tafazolli, “Secure Device Pairing: A Survey,” IEEE Communications Surveys & Tutorials, vol. 16, no. 1, pp. 17–40, 2014.
- C. Kuo, J. Walker, and A. Perrig, “Low-cost Manufacturing, Usability, and Security: An Analysis of Bluetooth Simple Pairing and Wi-Fi Protected Setup,” in International Conference on Financial Cryptography and Data Security, pp. 325–340, Springer, 2007.
- K. M. Haataja and K. Hypponen, “Man-in-the-Middle Attacks on Bluetooth: A Comparative Analysis, a Novel Attack, and Countermeasures,” in 2008 3rd International Symposium on Communications, Control and Signal Processing, pp. 1096–1102, 2008.
- K. Haataja and P. Toivanen, “Practical man-in-the-middle attacks against Bluetooth Secure Simple Pairing,” in 2008 4th International Conference on Wireless Communications, Networking and Mobile Computing, pp. 1–5, 2008.
- K. Haataja and P. Toivanen, “Two Practical Man-in-the-Middle Attacks on Bluetooth Secure Simple Pairing and Countermeasures,” IEEE Transactions on Wireless Communications, vol. 9, no. 1, pp. 384–392, 2010.
- K. S. McCurley, “The discrete logarithm problem,” in Proc. of Symp. in Applied Math, vol. 42, pp. 49–74, USA, 1990.
- B. P. Crow, I. Widjaja, J. G. Kim, and P. T. Sakai, “IEEE 802.11 Wireless Local Area Networks,” IEEE Communications magazine, vol. 35, no. 9, pp. 116–126, 1997.
- J. Goodman, A. G. Greenberg, N. Madras, and P. March, “Stability of Binary Exponential Backoff,” Journal of the ACM (JACM), vol. 35, no. 3, pp. 579–602, 1988.
- Prentice Hall, 2002.