Analysis of block cipher modes of operation for rfid devices

The RFID system consists of radio-tag and interrogator. The main purpose of devices is authentication with a transmission of small amount of data between tag and interrogator. We study modes that require only block encryption to be implemented in the tag (due to hardware limitations). CTR, OFB and modified CBC modes were analyzed. Modified CBC mode CBC[F] can be specified as follows: Co = IV, Ci = Fk (Ci-1 e Mi), where F_k denotes either encryption (F_k = E_k) or decryption (F_k = E-¹) of one block of data on the key k, M_i is the i-th block of plaintext, C_i is the i-th block of ciphertext, IV is an initialization vector. Assume that the length of the key is k bits, the length of the one block of data is n bits, and consider an adversary that runs time no more than t, makes no more than q oracle queries, each of length no more than m blocks. Then, given an oracle access to the CBC[E_k] and CbC = CBC[E-¹] modes, the maximal advantage in the LOR-experiment can be bounded from above by: LOR _LOR , 3q²m² t + q ^AdvCBC,CBC ^(t,^q,^m) ^ ₂n _ _qm + 2-1 •

Keywords

Authors

References