The Community for Technology Leaders
RSS Icon
Subscribe
Issue No.07 - July (2009 vol.8)
pp: 968-974
Benjamin Arazi , Ben Gurion University, Beer Sheva
ABSTRACT
RFID and Wireless Sensor Networks exemplify computationally constrained environments, where the compact nature of the components cannot support complex computations or high communication overhead. On the other hand, such components should support security applications such as message integrity, authentication, and time stamping. The latter are efficiently implemented by Hash Message Authentication Codes (HMAC). As clearly stated in the literature, current approved implementations of HMAC require resources that cannot be supported in constrained components. An approach to implement a compact HMAC by the use of stream ciphering is presented in this paper.
INDEX TERMS
Secured communications, HMAC, constrained environments, challenge response, stream ciphers.
CITATION
Benjamin Arazi, "Message Authentication in Computationally Constrained Environments", IEEE Transactions on Mobile Computing, vol.8, no. 7, pp. 968-974, July 2009, doi:10.1109/TMC.2009.40
REFERENCES
[1] M. Bellare, R. Canetti, and H. Krawczyk, “Keying Hash Functions for Message Authentication,” Proc. Ann. Int'l Cryptology Conf. (CRYPTO '96), pp.1-15, 1996.
[2] H. Krawczyk, M. Bellare, and R. Canetti, “HMAC: Keyed-Hashing for Message Authentication,” IETF RFC 2104, 1997.
[3] ANS Institution, “Keyed Hash Message Authentication Code,” ANSI X9.71, 2000.
[4] National Institute of Standards and Tech nology, “The Keyed-Hash Message Authentication Code (HMAC),” FIPS PUB 198, Information Technology Laboratory, 2002.
[5] J. Kim, A. Biryukov, B. Preneel, and S. Hong, “On the Security of HMAC and NMAC Based on HAVALl, MD4, MD5, SHA-0 and SHA-1,” Proc. Conf. Security and Cryptography for Networks (SCN'06), pp.242-256, 2006.
[6] National Institute of Standards and Tech nology, “Secure Hash Standard,” FIPS PUB 180-1, Information Technology Laboratory, 1995.
[7] GAO, “GAO-05-551 Radio Frequency Identification Technology,” www.gao.gov/new.itemsd05551.pdf, May 2005.
[8] European Commission, “Draft Recommendation on RFID Privacy and Security,“ http://www.edri.org/edrigram/number6.4ec-recommandation-rfid , Feb. 2008.
[9] G. Avoine, “RFID Security & Privacy Lounge,” www.avoine.netrfid/, 2009.
[10] P. Siekerman and M. van der Schee, “Security Evaluation of the Disposable OV-chipkaart v1.7,” System and Network Eng. Dept., Univ. of Amsterdam, Apr. 2008.
[11] PCWorld, “E-Passports Can be Cloned in Minutes, Claims Researcher,” pcworld.about.com/od/dataprotectionE-Passports- Can-Be-Cloned-in-M.htm , Aug. 2008.
[12] K.J. Higgins, “RFID under Attack Again,” www.darkreading.com, Apr. 2007.
[13] Drugresearcher, “Breaking News on Drug Discovery—RFID Can Prevent Drug Deaths,” www.drugresearcher.com/Research-management RFID-can-prevent-drug-deaths, Aug. 2004.
[14] J. Antokol, “RFID and Healthcare: Privacy and Security Considerations,” http://www.rfidconsultation.eu/docs/ficheiros antokol.pdf, May 2006.
[15] S. Sarma, S. Weis, and D. Engels, “RFID Systems and Security and Privacy Implications. Cryptographic Hardware and Embedded Systems,” Proc. Workshop Cryptographic Hardware and Embedded Systems (CHES '02), vol. 2523, pp.454-469, 2002.
[16] M. Ohkubo, K. Suzuki, and S. Kinoshita, “Cryptographic Approach to ‘Privacy-Friendly’ Tags,” Proc. RFID Privacy Workshop, Nov. 2003.
[17] I. Vajda and L. Buttyan, “Lightweight Authentication Protocols for Low-Cost RFID Tags,” Proc. Second Workshop Security Ubiquitous Computing (Ubicomp '03), Oct. 2003.
[18] G. Avoine and P. Oechslin, “A Scalable and Provably Secure Hash-Based RFID Protocol,” Proc. Second IEEE Int'l Workshop Pervasive Computing and Comm. Security (PerSec '05), pp.110-114, 2005.
[19] K. Rhee, J. Kwak, S. Kim, and D. Won, “Challenge-Response Based RFID Authentication Protocol for Distributed Database Environment,” Proc. Int'l Conf. Security in Pervasive Computing (SPC '05), Apr. 2005.
[20] M. Feldhofer and C. Rechberge, “A Case against Currently Used Hash Functions in RFID Protocols,” RFID Security Workshop (RFIDSec '06), printed handout, July 2006.
[21] A. Bogdanov, G. Leander, C. Paar, A. Poschmann, M. Robshaw, and Y. Seurin, “Hash Functions and RFID Tags: Mind the Gap,” Proc. Workshop Cryptographic Hardware and Embedded Systems (CHES '08), 2008.
[22] S. Bono, M. Green, A. Stubblefield, A. Juels, A. Rubin, and M. Szydlo, “Security Analysis of a Cryptographically Enabled RFID Device,” Proc. USENIX Security Symp., pp.1-16, 2005.
[23] ECRYPT, “The Estream Project,” The eSTREAM Portfolio, revision1, Sept. 2008.
[24] H. Krawczyk, “LFSR-Based Hashing and Authentication,” Proc. Ann. Int'l Cryptology Conf. (CRYPTO 94), pp.129-139, 1994.
[25] B. Zoltak, “VMPC-MAC: A Stream Cipher Based Authenticated Encryption Scheme,” Cryptology ePrint Archive, Report 2004/301, 2004.
[26] D. Whiting, B. Schneier, S. Lucks, and F. Muller, “Phelix—Fast Encryption and Authentication in a Single Cryptographic Primitive,” Ecrypt Stream Cipher Project, Report 2005/020, 2005.
[27] K. Wirt, “ASC a Stream Cipher with Built in MAC Functionality,” Int'l J. Computer Science, vol. 2, pp.131-136, 2007.
[28] P. Hawkes, M. Paddon, and G.G. Rose, “The Mundja Streaming MAC,” Cryptology ePrint Archive, Report 2004/271, 2004.
[29] J. Kaps, K. Yuksel, and B. Sunar, “Energy Scalable Universal Hashing,” IEEE Trans. Computers, vol. 54, pp.1484-1495, 2005.
[30] J. Black, S. Halevi, H. Krawczyk, T. Krovetz, and P. Rogaway, “UMAC: Fast and Secure Message Authentication,” Proc. Ann. Int'l Cryptology Conf. (CRYPTO '99), pp.216-233, 1999.
[31] B. Schneier, “‘Schneier on Security’—SHA-1 Has Been Broken,” http://www.schneier.com/blog/archives/2005 02/, 2009.
[32] S. Fluhrer, I. Mantin, and A. Shamir, “Weaknesses in the KeyScheduling Algorithm of RC4,” Proc. Ann. Int'l Cryptology Conf. (CRYPTO '01), pp.1-24, 2001.
[33] O. Dunkelman and E. Biham, “A Framework for Iterative Hash Functions—HAIFA,” Proc. Second Cryptographic Hash Workshop, Aug. 2006.
[34] M. Bellare, “New Proofs for NMAC and HMAC: Security without Collision-Resistance,” Proc. Ann. Int'l Cryptology Conf. (CRYPTO '06), pp.602-619, 2006.
[35] C. Berbain, O. Billet, A. Canteaut, N. Courtois, B. Debraize, H. Gilbert, L. Goubin, A. Gouget, L. Granboulan, C. Lauradoux, M. Minier, T. Pornin, H. Sibert, and C. Berbain, “Ecrypt Phase 3 DECIM 2 2007,” http://www.ecrypt.eu.org/streamdecimp3.html , 2009.
23 ms
(Ver 2.0)

Marketing Automation Platform Marketing Automation Tool