2.5 Authentication

Authentication is the ability to identify the source of the communication, both for the communicating parties and for the information itself. In other words, authentication refers to a cryptographic mechanism ensuring that the identity of communicating entities can be verified and that the source of a received message can be verified. Any two parties entering into a secure communication should authenticate each other and the data received with respect to their origin. This hints at the fact that there are actually two kinds of authentication: one to verify identities (entity authentication) and another to verify data origin (message authentication).

Authentication is one of the most important security goals in cryptography. After hash functions and digital signatures were discovered, authentication and confidentiality were classified as independent information security objectives [117]. Without authentication, however, there can be no genuine confidentiality because you can never be sure who you are talking to, even if the communication is in encrypted form. Today, confidentiality and authentication are often combined in authenticated encryption schemes (see Chapter 15, Authenticated Encryption).

It might even seem superfluous to differentiate between authentication and confidentiality. In practice, however, implementing one or the other can have fundamental implications on legal matters.

As an example, export control (legislation regulating the export of goods, software, and technology) restricts the export of items considered potentially harmful to the interest of the exporting country. Such items include arms, so-called dual-use goods with military potential, radioactive materials such as uranium, and cryptography.

In the case of cryptography, it is prohibited to export hardware or software that can be used for strong encryption to export controlled or sanctioned countries, entities, and persons. Strong encryption refers to encryption algorithms (see Chapter 4, Encryption and Decryption) deemed to be secure by national agencies and standardization bodies such as GCHQ or NIST. If the actual goal of a security system is to authenticate individual entities, such as a sensor in a car and an electronic control unit that uses the measurement data from that sensor, it might be more practical to use a cryptographic mechanism for authentication rather than encryption.

Another example where the separation of confidentiality and authentication makes sense is provided by two communicating parties located in different countries where one or both of the countries do not permit confidentiality in order to monitor all communications. While the legitimate parties are not allowed to use encryption, a mechanism for achieving confidentiality, they can still use a cryptographic algorithm to ensure the identity of each party as well as the origin of the information both parties receive.

2.5.1 Message authentication

Message authentication is the ability of the communicating party that receives a message to verify – through corroborative evidence – the identity of the party that originated the message [117]. This form of authentication is also referred to as data origin authentication.

Message authentication can be achieved by providing additional information together with the message. This information can be used by the receiving party to verify the identity of the party who sent the message – at least, this is true for asymmetric authentication protocols. In symmetric message authentication, we can only verify that a message was sent by someone in possession of the shared key (see also Chapter 5, Entity Authentication).

Figure 2.5: Message authentication allows Bob to verify that the message m_A he receives has indeed originated from Alice, despite malicious Mallory having the ability to read Alice’s messages and write arbitrary messages to the unsecured channel

While message authentication ensures the origin of the message, it typically provides no guarantee of freshness. That is, with message authentication alone, it is not possible to say when the message was sent, only to verify its origin. As an example, imagine that Alice sends a message m_A to Bob today, but Mallory intercepts that message and deletes it from the unsecured channel. Mallory could then re-send m_A to Bob any time later, yet Bob would not be able to recognize that the message is delayed and is actually coming from Mallory rather than Alice.

The inability to determine whether a message is delayed or received out of order enables so-called replay attack, in which an authenticated message is sent a second time to the receiver, or reflection attacks, where an authenticated message is sent back to the sender. More details are given in Chapter 19, Attacks on Cryptography.

The lack of proper message authentication is the main cause for the notorious false base station attacks, which could originally be launched against 2G mobile networks and, because of the need for backward compatibility, also against 3G and 4G networks [143]. In these attacks, Mallory sets up a False Base Station (FBS), basically an antenna sending out a strong signal designed to lure mobile phones to connect to the FBS. The FBS then sends a standardized message to the phone to the effect that it does not support encryption. Therefore, the phone resorts to sending its speech data in plaintext to the FBS. If the phone is able to verify if the NullEncryption message is really coming from a legitimate network operator, the attack becomes infeasible.

Many other examples of attacks resulting from a lack of or faulty implementation of message authentication could be given. For example, email-based phishing attacks are only possible because email messages are not authenticated in most cases.

Message authentication is strongly related to integrity protection. After all, if Mallory modifies a message m_A coming from Alice to some m_A, thus breaking integrity, one might also argue that m_A really is a new message coming from Mallory, but pretending to come from Alice. Therefore, one can say that message authenticity implies integrity.

2.5.2 Entity authentication

Entity authentication is the ability to assure one communicating party – using corroborative evidence – of both the identity of a second communicating party involved, and that the second party was actually active at the time the evidence was created or acquired [117]. This authentication type is also referred to as identification.

To achieve entity authentication, Alice and Bob typically engage in some kind of authentication protocol, which is a cryptographic protocol designed to achieve entity authentication.

Figure 2.6: Entity authentication allows Bob to verify that the identity of the party he is communicating with is indeed Alice and that Alice is active during the identification. Malicious Mallory has the ability to read Alice’s and Bob’s messages and write arbitrary messages to the unsecured channel

In a typical example, Alice sends Bob a random, freshly generated challenge (for example, a random number) to which only Bob can respond correctly because Alice and Bob know a shared secret. After Bob has replied to Alice, he sends Alice a fresh, random challenge of his own and waits for the correct reply. If both replies from Alice and Bob are correct, the entity authentication is successful.

To prevent Mallory from compromising entity authentication by simply eavesdropping and replaying old messages, Alice and Bob need to verify each other’s authenticity in real time, with non-repeating challenges. This is referred to as timeliness or freshness. Hence, both parties must be active in the communication.

This protocol is an instance of mutual authentication because Alice and Bob authenticate each other. If only Alice or only Bob needs to provide the correct answer to a random challenge, then this would be an example of unilateral authentication.

The hack of remote keyless entry systems deployed in VW Group vehicles built between 1995 and 2016 and the attack on the Hitag2 rolling code scheme, are prominent examples of attacks due to insufficient entity authentication [71].

A Remote Keyless Entry (RKE) system is used to lock and unlock a car without having to insert a physical key. To do this, RKE systems transmit data from the remote control embedded in the car key to the vehicle.

After a button is pressed, a radio transmitter in the car key generates a signal in a public radio frequency band (for example, the 315 MHz band in North America and the 433 MHz or 868 MHz band in Europe).

The first generation of RKEs was based on a constant secret code and is therefore an instance of security by obscurity, a very dangerous anti-pattern in system design where the security of a system depends solely on the secrecy of its design. When the constant code is leaked once, the security of all vehicles relying on such an RKE is instantaneously broken.

The second generation of RKE systems relies on so-called rolling codes. In rolling codes, a counter value is increased upon each button press. The counter value – together with some additional input – is used to compute the next valid rolling code message, which is encrypted in the car key and sent to the vehicle.

The vehicle decrypts the rolling code message and compares the result to the last stored counter value. The counter value is accepted and the car is locked or unlocked if the received value is larger than the stored one. If the received counter value is smaller than the stored one, the attempt to lock or unlock the car is rejected.

However, researchers [71] discovered that RKE systems designed by VW Group are based on a worldwide master key. Because the key is identical for all affected cars, it can be extracted by inspecting the firmware of a single vehicle (which is exactly what the researchers did). Knowing that key allows an attacker to lock and unlock a car after eavesdropping on a single rolling code message.

Hitag2 is another widely deployed RKE that is not specific to a single car manufacturer. The counter in the Hitag2 rolling code is not a step-wise increasing value as it is based on the output of a stream cipher (see Chapter 4, Encryption and Decryption). An attack reported in [71] requires Eve to eavesdrop on merely four to eight Hitag2 rolling codes and allows her to recover the cryptographic key in approximately one minute. With that, the attacker can create a clone of the original remote control.

These attacks work because the RKE systems lack a cryptographically secure entity authentication. When the car receives a rolling code, it has no means to verify that it is indeed communicating with the right car key and that the car key is active during the communication.