![](bg2.png)
phase of the protocol but can relay the messages
of the fast-phase.
(A6) Terrorist-Fraud (Desmedt, 1988); this is a col-
luding attack by a dishonest far-away prover
and a close-by helper. The prover tries to suc-
ceed in the protocol with the requirement that
their secret key will not be leaked to the helper.
DB protocols are commonly shown to be secure
against a subset of these attacks. Shared-key DB pro-
tocols have application in the authentication of small
devices such as RFID tags, while public-key DB pro-
tocols are used when more computation is affordable
and one needs to protect the privacy of users against
the verifier. In public-key DB model, a prover has a
unique secret-key and the verifier has all the public-
keys. Public-key DB protocols have the convenience
of not needing to share a secret key but are signifi-
cantly slower than shared-key DB protocols, and need
more complex design to deal with individual bits of
the private-key.
Related Works. The main models and construc-
tions of public-key DB protocols are in (Hermans
et al., 2013), (Ahmadi and Safavi-Naini, 2014),
(Gambs et al., 2014), and (Vaudenay, 2014). In the
following, we discuss and contrast the security model
of these works to be able to put our new work in con-
text.
(Hermans et al., 2013) presented an informal
model for Distance-Fraud, Mafia-Fraud and Imper-
sonation attack as defined above, and provided a
secure protocol according to the model. (Ahmadi
and Safavi-Naini, 2014) formally defined Distance-
Fraud, Mafia-Fraud, Impersonation, Terrorist-Fraud
and Distance-Hijacking attack. The Distance-Fraud
adversary has a learning phase before the attack ses-
sion and is therefore stronger than the definition in
A2. During the learning phase, the adversary has ac-
cess to the communications of the honest provers that
are close-by. The security proofs of the proposed pro-
tocol have been deferred to the full version, which is
not available yet.
(Gambs et al., 2014) uses an informal model
that captures Distance-Fraud, Mafia-Fraud, Imper-
sonation, Terrorist-Fraud, Distance-Hijacking and a
new type of attack called Slow-Impersonation that
is defined in A5. In their model, the definition of
Terrorist-Fraud is slightly different from A6: a TF at-
tack is successful if it allows the adversary to succeed
in future Mafia-Fraud attacks.
For the first time in distance-bounding literature,
(D
¨
urholz et al., 2011) considered normal MiM attack-
ing scenario where both the honest prover and the ad-
versary are close to the verifier. The adversary inter-
acts with the prover in order to succeed in a separate
protocol session with the verifier. The adversary has
to change some of the received messages in the slow
phases of protocol in order to be considered success-
ful. The attack is called Slow-Impersonation (A5) and
is inspired by the basic MiM attack in authentication
protocols. Although the basic MiM attack is proper
for DB models, it may not be strictly possible in one
phase of the protocol as their action could influence
or be influenced by other phases of the protocol.
A MiM adversary may, during the learning phase,
only relay the slow-phase messages but, by manipu-
lating the messages of the fast phase, learn the key
information and later succeed in impersonation. Ac-
cording to the definitions in (Gambs et al., 2014) and
(D
¨
urholz et al., 2011), the protocol is secure against
Slow-Impersonation, however it is not secure againt
Strong-Impersonation (A4). This scenario shows that
Slow-Impersonation does not necessarily capture Im-
personation attacks in general. Moreover, it’s hard to
distinguish the success in slow phases of a protocol
without considering the fast phase, as those phases
have mutual influences on each other.
As an alternative definition, we propose Strong-
Impersonation (A4), in which the MiM adversary has
an active learning phase that allows them to change
the messages. Strong-Impersonation captures the
MiM attack without the need to define success in
the slow rounds. One of the incentives of Strong-
Impersonation is capturing the case when the prover
is close to the verifier, but is not participating in any
instance of the protocol. In this case, any acceptance
by the verifier means that the adversary has succeeded
in impersonating an inactive prover.
In (Vaudenay, 2014) an elegant formal model
for public-key distance-bounding protocols in terms
of proof of proximity of knowledge has been
proposed. The model captures Distance-Fraud,
Distance-Hijacking, Mafia-Fraud, Impersonation and
Terrorist-Fraud. In this approach, a public-key DB
protocol is a special type of proof of knowledge
(proximity of knowledge): a protocol is considered
sound if the acceptance of the verifier implies exis-
tence of an extractor algorithm that takes the view
of all close-by participants and returns the prover’s
private-key. This captures security against Terrorist-
Fraud where a dishonest far-away prover must suc-
ceed without sharing their key with the close-by
helper.
According to the soundness definition in (Vaude-
nay, 2014) however, if the adversary succeeds while
there is an inactive close-by prover, the protocol is
sound because the verifier accepts, and there is an ex-
tractor for the key simply because there is an inactive
Distance-bounding Identification
203