1 / 22

Funkspiel Schemes: An Alternative to Conventional Tamper Resistance

Funkspiel Schemes: An Alternative to Conventional Tamper Resistance. Royal Inst. of Technology, Stockholm RSA Laboratories RSA Laboratories Certco. J. Håstad J. Jakobsson A. Juels M. Yung. Lauwers. Lauwers worked as radio operator for SOE, British underground during WW II.

alaula
Télécharger la présentation

Funkspiel Schemes: An Alternative to Conventional Tamper Resistance

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Funkspiel Schemes:An Alternative to Conventional Tamper Resistance Royal Inst. of Technology, Stockholm RSA Laboratories RSA Laboratories Certco J. Håstad J. Jakobsson A. Juels M. Yung

  2. Lauwers Lauwers worked as radio operator for SOE, British underground during WW II Captured by Germans, along with radio and three message/ciphertext pairs Germans sought to mount “Funkspiel”, i.e., pass false messages to SOE SOE made use of a kind of MAC

  3. 16th letter o u o e Subverting the Funkspiel • Germans demanded to know “MAC” • Lauwers had been instructed to introduce an error into 16th letter of every message as “MAC” • Lauwers made clever observation about his three messages: Message 1: …………....stop….. …………....stop….. Message 2: ………….……..….. Message 3: • Claimed that “MAC” involved corruption of ‘o’ in stop

  4. Subverting the Funkspiel • Germans were deceived • Allies were deceived

  5. Alice Bob Eve (Enemy) Modern cryptographer’s view

  6. Alice Bob Eve Funkspiel scheme

  7. message1, message2, message3, MAC (message1) MAC (message2) MAC (message3) Alice Bob Eve Step 1: Alice sends messages to Bob

  8. Alice Step 2: Alice changes key (maybe)

  9. Alice Step 3: Eve steals Alice’s key

  10. “I love you”, MAC (“I love you”) Bob Eve Step 4: Eve impersonates Alice

  11. She loves me? She loves me not? MAC (“I love you”) Step 5: Bob determines whether Alice changed key

  12. What do we want? • Eve can’t tell whether Alice changed key • Even though Eve has seen MAC(message1), MAC(message2),... • Bob can tell whether Alice changed key

  13. Related work • Forward-secure signature schemes • Attacker knows that key evolves • Distress PIN • No security against eavesdropper • Deniable encryption

  14. ??? 1 1 0 0 1 1 1 0 0 1 1 A funkspiel scheme MAC key 0: 0 1 1 0 1 0 1 0 0 0 1 1 1 0 MAC key 1: Problems: We need one bit for every MAC; Eve can cheat with small probability

  15. h h ??? ?? Another funkspiel scheme (simplified) Problem: What if Eve sees Bob’s keying material? She can forge a MAC

  16. EPK_B(SigSK_A[message]) PKA PKB PKA SKA SKB SKA ??? Asymmetric funkspiel scheme

  17. Asymmetric funkspiel scheme • Semantically secure encryption (e.g., El Gamal) ensures that Eve can’t test signature against SK • Key swap for Alice under El Gamal is efficient, e.g., she can randomize last 100 bits • If Eve sees Bob’s keys, she still can’t forge MAC • Scheme is less efficient than symmetric ones

  18. Real-world funkspiel • Alice changes key when she senses Eve is attempting to break in (no coin flipping) • Bob tries to determine whether Alice sent “distress signal”, i.e., changed key

  19. What this good for? • Tamper resistant hardware • Currently uses “zeroization” • Funkspiel schemes permit detection and tracing • Funkspiel schemes can give false sense of security or success to attacker • E.g., cash card

  20. Honeypot What this good for? • A honeypot with more sting

  21. Open issues • Power consumption • Many devices have only external power • What about DPA attacks? • How about, e.g., firewalls?

  22. She loves me? She loves me not? Questions?

More Related