Practical attacks on HB and HB+ protocols

  • Authors:
  • Zbigniew Gołebiewski;Krzysztof Majcher;Filip Zagórski;Marcin Zawada

  • Affiliations:
  • Institute of Mathematics and Computer Science, Wroclaw University of Technology;Institute of Mathematics and Computer Science, Wroclaw University of Technology;Institute of Mathematics and Computer Science, Wroclaw University of Technology;Institute of Mathematics and Computer Science, Wroclaw University of Technology

  • Venue:
  • WISTP'11 Proceedings of the 5th IFIP WG 11.2 international conference on Information security theory and practice: security and privacy of mobile devices in wireless communication
  • Year:
  • 2011

Quantified Score

Hi-index 0.00

Visualization

Abstract

HB and HB+ are a shared secret-key authentication protocols designed for low-cost devices such as RFID tags. HB+ was proposed by Juels and Weis at Crypto 2005. The security of the protocols relies on the "learning parity with noise,,(LPN) problem, which was proven to be NP-hard. The best known attack on LPN by Levieil and Fouque [13] requires sub-exponential number of samples and sub-exponential number of operations, which makes that attack impractical for the RFID scenario (one cannot assume to collect exponentially-many observations of the protocol execution). We present a passive attack on HB protocol in detection-based model which requires only linear (in the length of a secret key) number of samples. Number of performed operations is exponential, but attack is efficient for some real-life values of the parameters, i. e. noise 1/8 and key length 152-bits. Passive attack on HB can be transformed into active one on HB+.