Mind your nonces : cryptanalysis of a privacy-preserving distance bounding protocol

Distance bounding protocols enable a device to establish an upper bound on the physical distance to a communication partner so as to prevent location spoofing, as exploited by relay attacks. Recently, Rasmussen and Čapkun (ACM-CCS’08) observed that these protocols leak information on the location of the parties to external observers, which is undesirable in a number of applications—for example if the leaked information leads to the identification of the parties among a group of devices. To remedy this problem, these authors proposed a “privacypreserving” distance bounding protocol, i.e. that leaks no information on the location of the parties. The present paper reports results from an in-depth security analysis of that new protocol. The main result is an attack that recovers the ephemeral secrets as well as the location information of the two parties. The efficiency of the attack depends on the parameters of the protocol, and we provide realistic examples of parameters that make the attack practical. Although the attack exploits collisions of (unpredictable) challenge numbers, we show that the protocol would be less secure with unique and partially predictable challenges. We present simple, cost-efficient, modifications to the protocol to thwart our attack for all choices of parameters and to enhance its overall security. We also evaluate the security of the Rasmussen-Čapkun protocol against distance, mafia, and terrorist frauds, showing that the latter attack is efficiently applicable. Overall, our results do not contradict the preliminary security analysis by the designers, but rather extends it to other parts of the attack surface.