CoRA: A Scalable Collective Remote Attestation Protocol for Sensor

Networks

ıda Diop

, Maryline Laurent

, Jean Leneutre

and Jacques Traor

ecom SudParis, T

ecom ParisTech, Orange Labs, Caen, France

SAMOVAR, CNRS, T

ecom SudParis, Institut Polytechnique de Paris, France

LTCI, T

ecom ParisTech, Universit

e Paris-Saclay, France

Orange Labs, Caen, France

jacques.traore@orange.com

Keywords:

Security, Remote Attestation, Collective Attestation.

Abstract:

Embedded Internet of Things (IoT) devices are deployed in the functioning of a number of applications such

as industrial control, building automation, and the smart grid. The lack of robustness of IoT devices has

however rendered such systems vulnerable to a number of remote cyber-attacks. Remote attestation is a

security mechanism which enables to remotely verify the integrity of the software running on IoT devices.

Similarly, collective remote attestation protocols are designed to efﬁciently verify the integrity of a group

of devices. Existing collective attestation protocols do not provide an efﬁcient and secure mechanism to

detect compromised devices. In particular, it is not possible to efﬁciently trace the origin of an erroneous

attestation response back to the concerned node. In this paper, we introduce CoRA, a highly scalable collective

attestation protocol, which leverages the aggregating property of the underlying cryptographic scheme during

the attestation process. CoRA is the ﬁrst collective attestation protocol to also provide sequential detection,

where the identity of the compromised node is revealed. We provide rigorous security proofs for our protocol

and its underlying cryptographic primitive, and demonstrate its efﬁciency in highly scalable networks.

1 INTRODUCTION

Typically, connected Internet of Things (IoT) devices

are deployed in data-sensitive and safety-critical ap-

plications, spanning a number of IoT systems. The

safety of these systems is hindered by the lack of se-

curity and robustness of low-cost devices, resulting in

a number of remote cyber-attacks (Mansﬁeld-Devine,

2016; Falliere et al., 2010). Remote attestation is a

security process which allows a trusted party, called

veriﬁer, to verify the integrity of the software running

on each device. Traditionally, the attestation process

runs between a single device (the prover), and the ver-

iﬁer. However, many IoT applications rely on self-

organizing device mesh networks, also called swarms,

to perform a given task. The concept of collective

(or swarm) attestation, has been developped to pro-

vide scalable attestation protocols tailored for such

networks (Ambrosin et al., 2016; Carpent et al., 2017;

Ibrahim et al., 2016; Ibrahim et al., 2017; Kohnh

auser

et al., 2017; Kohnh

auser et al., 2018). The general

model of a collective attestation protocol, as illus-

trated in Figure 1, is comprised of the network op-

erator, who deploys devices in the ﬁeld, the group

of devices performing a speciﬁc task, and the veri-

ﬁer. Nodes in the swarm generate their individual

attestation responses, which are in turn accumulated

into a single attestation response. The topology of

the mesh network plays a crucial role in the effective-

ness of the attestation protocol. Notably, during the

attestation process, a spanning tree is generated over

the network, allowing each node to propagate their re-

sponse in the tree via their parent node. The root of

the spanning tree is directly linked to the veriﬁer, who

collects a single aggregated report at the end of each

execution (Chan et al., 2006). The successful veriﬁ-

cation of the ﬁnal attestation response guarantees the

integrity of the entire network. Initially, collective

attestation protocols only mitigated against software

attacks (Asokan et al., 2015). The majority of IoT

applications we consider however require deploying

devices in the ﬁeld, thus rendering them vulnerable to

physical attacks. Recent collective attestation propo-

sitions leverage the security provided by trusted com-

Diop, A., Laurent, M., Leneutre, J. and Traoré, J.

CoRA: A Scalable Collective Remote Attestation Protocol for Sensor Networks.

DOI: 10.5220/0008962700840095

In Proceedings of the 6th International Conference on Information Systems Security and Privacy (ICISSP 2020), pages 84-95

ISBN: 978-989-758-399-5; ISSN: 2184-4356

Figure 1: Overview of the collective attestation process.

puting by requiring each node to authenticate their at-

testation report with a cryptographic key (Ambrosin

et al., 2016; Ibrahim et al., 2016; Kohnh

auser et al.,

2017). The key is stored in a hardware module, hence,

an adversary who attempts to forge an attestation is

compelled to physically tamper with the devices.

Existing collective attestation protocols produce a

binary response, stating whether or not the attestation

process was successful, thus proving the integrity, or

lack thereof, of the entire network. The nature of sen-

sor networks, which consists of multihop networks of

constrained and potentially remote devices, renders

the attestation process vulnerable to injection attacks.

In such attacks, the adversary is able to aggregate er-

roneous data in the ﬁnal attestation response, without

physically compromising a given node. Notably, he is

able to remove the target node from the network, and

aggregate a random value in lieu of the expected at-

testation response from said node. Upon receiving the

aggregate response, the veriﬁer has no way of tracing

the origin of the erroneous attestation back to the con-

cerned node. Indeed, existing aggregation schemes

based on signatures or MACs, do not allow the ex-

traction of an individual signature (or MAC) from the

aggregated result. Such attacks may therefore trigger

the veriﬁcation process indeﬁnitely, inducing a Denial

of Service (DoS) attack on the veriﬁer. A detection

mechanism capable of tracing the origin and position

in the network of similar attacks is therefore crucial

to the overall security of the protocol. Indeed, the

network administrator will thus be able to take fur-

ther actions, which may consist in declaring the target

device as compromised, and induce further ramiﬁca-

tions which are out of scope for this paper.

Contributions. We present CoRA, a collective at-

testation protocol for wireless networks, composed of

large numbers of low-cost and computationally con-

strained devices. CoRA is a secure and highly scal-

able attestation protocol, which efﬁciently veriﬁes the

integrity of a large number of devices in sensor net-

works. Indeed, the protocol is based on aggregate al-

gebraic MACs, which guarantees the unforgeability

of individual attestation responses, even in the pres-

ence of adversaries in the network tampering with

the attestation process. The use of algebraic MACs,

as opposed to signatures, in the aggregation process

guarantees a more efﬁcient veriﬁcation step. In addi-

tion, we leverage the properties of algebraic MACs,

notably the secret key embedded in each device, to

provide a sequential detection mechanism. CoRA

thus enforces device accountability, and enables trac-

ing the origin of compromised nodes that attempt to

inject erroneous data during the attestation process.

We provide rigorous security proofs for CoRA and

its underlying cryptographic construction, namely ag-

gregate algebraic MACs. We then prove the efﬁciency

of the protocol, and its application in large wireless

networks of heterogeneous devices.

Outline. We present in Section 2 the related work

on collective attestation, and their limitations. Section

3 illustrates the system model, device requirements,

and threat model. In Section 4, we present the un-

derlying cryptographic scheme, used for secure and

scalable attestation generation and aggregation. The

CoRA protocol is introduced in Section 5, including

the attestation and detection processes. We evaluate

the efﬁciency of CoRA in Section 6, and prove the

security of the protocol in Section 7. Section 8 con-

cludes the paper.

CoRA: A Scalable Collective Remote Attestation Protocol for Sensor Networks

2 RELATED WORK

In this section, we present the system and threat

model of a collective attestation protocol, and analyse

existing solutions and their shortcomings.

2.1 Collective Attestation

Remote attestation is a security mechanism which

enables a trusted third party, namely the veriﬁer, to

remotely check the integrity of a device called the

prover. The process is initiated by the veriﬁer, who

issues a challenge to the prover. The prover in turn

generates an attestation report on its current software

state, which the veriﬁer is able to correctly verify.

Collective attestation protocols have been proposed

to efﬁciently attest large networks of interconnected

devices. In this scenario, the veriﬁer issues the chal-

lenge to a network of devices via an entry node A

which is chosen based on its geographic proximity to

the veriﬁer. The entry node propagates the challenge

to its children in a process that results in nodes be-

ing classiﬁed in a spanning tree rooted at A

. This

topology allows the efﬁcient aggregation of attesta-

tion reports, and reduces communication overhead.

The concept of collective attestation was introduced

in SEDA (Asokan et al., 2015). Subsequently, a

number of solutions targeting the security and efﬁ-

ciency shortcomings of SEDA were proposed. SANA

(Ambrosin et al., 2016) leverages the structure of ag-

gregate and multi-signature schemes, in order to ob-

tain a highly scalable attestation protocol. The so-

lution provides public veriﬁability, and limits phys-

ical attacks by authenticating reports within secure

hardware.Their solution however offers scalability at

the cost of efﬁciency, since the veriﬁcation step re-

quires a number of costly pairing computations, that

are in addition linear in the number of devices in the

group. DoS attacks are mitigated in SeED (Ibrahim

et al., 2017) through the use of a secure clock, which

enables provers to periodically forward their attes-

tation reports in a non-interactive protocol. LISA

and LISA

(Carpent et al., 2017) provide more prac-

tial alternatives to SEDA by proposing a qualitative

classiﬁcation of attestation protocols, each tailored

to speciﬁc security needs. DARPA (Ibrahim et al.,

2016) and SCAPI (Kohnh

auser et al., 2017) provide

mitigation against physical attacks, while SALAD

(Kohnh

auser et al., 2018) is a colletive attestation pro-

tocol suitable for dynamic and disruptive networks.

However, no solution provides the individual de-

tection of nodes responsible for a false attestation re-

sponse in the network. Indeed, the nature of wire-

less communication in mesh networks facilitates the

injection of a false attestation report (i.e. which has

not been authenticated by a valid key). In existing at-

testation protocols, the veriﬁcation step of the result-

ing attestation report fails when such falsiﬁcations are

performed, however no further information on the ori-

gin of the injection is provided. Indeed, the underly-

ing model of secure in-network aggregation schemes

(Chan et al., 2006) does not allow report manipula-

tion detection. The result only stating retrospectively

that the aggregate message was manipulated. Existing

collective attestation protocols relying on aggregate

cryptographic authentication schemes, namely aggre-

gate MACs (Katz and Lindell, 2008; Eikemeier et al.,

2010) and aggregate signatures (Boneh et al., 2003;

Lu et al., 2006; Boldyreva et al., 2007), do not allow

a veriﬁer to check the origin of an erroneous report

which has been aggregated into the ﬁnal response.

Furthermore, the veriﬁcation step in aggregate sig-

nature schemes requires a number of pairing compu-

tations linear in the number of nodes, which is pro-

hibitively expensive in sensor networks.

2.2 Efﬁcient in-network aggregation

Large networks of embedded devices require highly

scalable data collection solutions in order to forward

individually collected data to a central base station.

In sensor networks, the base station in the attestation

process is the veriﬁer. Aggregation methods allow a

collection of sensors to securely and collaboratively

compute an aggregation function on their respective

reports. The result of said function is thus forwarded

to the veriﬁer, generating extremely low communica-

tion overhead in the process. This concept, known as

in-network aggregation (Chan et al., 2006), consider-

ably reduces communication overhead, and provides

a highly scalable data collection mechanism. Exist-

ing aggregation methods that are linear in the num-

ber of nodes, and that can be executed in a single

round (Ambrosin et al., 2016), are based on aggregate

digital signatures (Boneh et al., 2003). However as

discussed in Section 2.1, such constructions are ex-

tremely costly due to the use of pairing-based cryp-

tography.

In sensor networks, and more generally dis-

tributed networks of embedded devices, it is mostly

the case that the network administrator plays the role

of both the operator and the veriﬁer (or both are op-

erated by the same entity, i.e. the owner). For ex-

ample, in the Smart grid, electrical companies issue

smart meters with a valid key, and periodically ver-

ify their proper operation. Thus the efﬁciency issues

in aggregate signatures, can be avoided by the use of

algebraic MAC schemes.

ICISSP 2020 - 6th International Conference on Information Systems Security and Privacy

3 SYSTEM MODEL AND

ASSUMPTIONS

3.1 Background

Collective Attestation Architecture. In the archi-

tecture presented in Figure 1, a collective attestation

protocol is divided into two main phases, namely the

deployment phase and the attestation phase. During

the former, the operator O deploys devices in the ﬁeld

with a unique identiﬁer ID

for device D

, and a secret

key sk

. The veriﬁer V initiates the attestation phase

by generating a challenge Ch, as part of the attestation

request for a device A

in the network. The attestation

process will create a spanning tree rooted at A

, thus

enabling an efﬁcient and scalable aggregation of the

individual attestation reports. A

then propagates the

request down the spanning tree. Upon each node gen-

erating, authenticating, and aggregating their attesta-

tion reports, the ﬁnal aggregated response reaches A

who aggregates its own response, before forwarding

the result to V . The veriﬁer, who is in possession of

the expected internal state of each device, is thus able

to verify the integrity of the entire network. For sim-

plicity, we assume in the remaining of the paper that

V and O are either the same entity, or are managed

by the same entity.

Deﬁnition and Security Model. We use the for-

mal remote attestation protocol deﬁnition and security

model of Francillon et al. (Francillon et al., 2012).

Let t

exp

be the upper-bound on the execution time of

the attestation procedure. The value t

exp

is deﬁned

as a function of the total number of nodes in the net-

work, the time complexity of an individual attestation

computation, intermediary transmission time, and the

aggregation time. Francillon et al. (Francillon et al.,

2014) deﬁne the security of a remote attestation proto-

col, to be resistance against forgery. The security no-

tion of resistance against forgery considers the case

where an adversary has oracle access to the attesta-

tion generation function. Considering such adversary

A, that is thus able to request n − 1 attestations, A

should still be unable to produce a new valid attesta-

tion on a message he has not previously queried to the

attestation oracle.

3.2 Overview

We consider a network of low-end, heterogeneous,

embedded devices, communicating over a wireless

mesh network. Devices in the network have limited

computational power and storage capacity. In the in-

frastructure of the collective attestation protocol, we

assume the operator O to be the network administra-

tor, who initially deploys devices in the ﬁeld. The

deployment phase is only executed once, and consists

in each device D

being initialized with a secret sym-

metric key sk

shared with O (and the veriﬁer V ), as

well as a unique identiﬁer ID

, which can be the IP ad-

dress of wireless devices for example. In order to ver-

ify the integrity of the internal software state of every

device in the network, the trusted veriﬁer V periodi-

cally engages in the attestation protocol with the de-

vice swarm. At the beginning of the attestation phase,

a spanning tree of all nodes is formed, thus facilitating

the aggregation process. At the end of the attestation

phase, V collects a single attestation report, which

guarantees the integrity (or lack thereof) of the en-

tire swarm. The veriﬁer possesses the list of expected

software state, hence allowing him to verify the valid-

ity of the ﬁnal attestation response in correlation with

the expected values. Each device is equipped with the

minimal hardware requirements for a collective attes-

tation protocol, namely a Read-Only Memory (ROM)

to store the protocol code and cryptographic keys, as

well as a Memory Protection Unit (MPU). The MPU

controls access to the ROM, and ensure that only pro-

tocol code can access the secret keys. Each device

can compute a collision-resistant hash function,

as well as multiplications in elliptic curve groups.

Furthermore, we assume that initialized counters are

stored in the ROM and are only accessible by the

MPU, thus preventing any desynchronization attempt.

3.3 Threat Model

Adversary Model. We consider an adversary A ,

who has full access to the communication channel

(Dolev-Yao model). As such, A can eavesdrop, mod-

ify, insert, and drop messages exchanged between de-

vices. A can also capture nodes and access and mod-

ify their software state. Security against physical ad-

versaries (who are able to extract cryptographic keys),

cannot however be guaranteed (Ibrahim et al., 2016).

In contrast, we consider the following threat model:

an adversary A who has compromised the networks,

and potentially captured a number of devices (up to

n − 1 devices in a network comprising n devices),

should still be unable to forge a valid aggregate attes-

tation for the remaining nodes. With regards to Denial

of Service (DoS) attacks, existing attestation proto-

cols consider attacks where devices are rendered un-

available in the network, thus preventing the success-

ful completion of the process. Such attacks cannot

be prevented, as it is indeed impossible to guarantee

availability for an adversary A capable of dropping all

messages. In this paper, we also consider DoS attacks

CoRA: A Scalable Collective Remote Attestation Protocol for Sensor Networks

against the veriﬁer. Indeed, A is able to continuously

aggregate an erroneous message in the ﬁnal response,

triggering a failed veriﬁcation process each time. We

mitigate against such attacks by providing an efﬁcient

detection mechanism in CoRA.

Security Objectives. As deﬁned in Section 3.1, an

attestation protocol is secure if no adversary is able to

forge an attestation report, thus faking a healthy state

for a compromised device. In Section 7, we prove the

security of CoRA against such adversaries, based on

the security of the underlying cryptographic scheme.

4 MAC

BLS

AGGREGATION

SCHEME

We present in this section a hybrid cryptographic

scheme introduced by Dodis et.al. (Dodis et al.,

2012), namely algebraic MACs. Algebraic MACs

provide the best of both worlds, i.e. the algebraic

properties inherent to signature schemes, while avoid-

ing the costly public veriﬁcation step. This is possi-

ble considering the fact that in sensor networks, the

same entity manages both the operator and the ver-

iﬁer. We later provide an aggregate algebraic MAC

scheme, which is subsequently used as the underly-

ing scheme for CoRA to authenticate individual at-

testation reports, and perform detection.

4.1 Notations

We introduce in this section the mathematical and

cryptographic notations used in the remaining of the

paper.

We deﬁne the sampling of a random element x from

a set X using the following notation: x

←− X. Pr[A]

denotes the probability of an event A. The notation G

denotes an algebraic group, while g ∈ G represents an

element g in group G. M = {m

,..., m

} denotes a set

M, comprised of n elements m

,..., m

4.2 Algebraic MACs

Algebraic MACs are MAC schemes based on group

operations, as opposed to block ciphers or hash func-

tions. Their primary goal is to take advantage of the

symmetry between the signer and the veriﬁer in ap-

plications where the signer and veriﬁer are the same

entity, in order to provide a more efﬁcient veriﬁca-

tion step. Algebraic MACs are used in CoRA to ﬁrst

generate unforgeable attestations, while also allowing

the construction of an efﬁcient and secure detection

mechanism based on each device’s knowledge of their

secret keys.

4.3 Aggregate Algebraic MACs

The underlying scheme for CoRA is an aggregate al-

gebraic MAC, named aggregate MAC

BLS

, and de-

rived from the Boneh, Lynn, Shacham (BLS) signa-

ture scheme (Boneh et al., 2001). Aggregate MAC

schemes, introduced by Katz and Lindell (Katz and

Lindell, 2008), allow a set of n users to generate n

tags on n potentially different messages, and aggre-

gate the result into a single tag of the same size as an

individual tag. The veriﬁcation process, which is lin-

ear in the number of users, attests of the validity of

all tags in the ﬁnal aggregate. We deﬁne an aggre-

gate algebraic MAC, where tags are group elements

as opposed to block ciphers or hash functions. Tags

are single group elements of size 256-bit (for exam-

ple elliptic curve group elements). The output size of

secure hash functions being comparable to such out-

put sizes, the use of algebraic MACs does not induce

additional space complexity.

The security of the aggregate MAC

BLS

scheme is

based on a standard discrete logarithm-based secu-

rity assumption, namely the Computational Difﬁe-

Hellman (CDH) assumption, deﬁned as follows:

Computational Difﬁe-Hellman Problem (CDH).

Given g,g

∈ G for a, b ∈ Z

, compute g

∈ G.

The CDH assumption stipulates that any algo-

rithm A that runs in polynomial time has negligible

advantage in solving the CDH problem in G.

MAC

BLS

Construction. We ﬁrst give the construc-

tion of an individual algebraic MAC scheme MAC

BLS

The MAC

BLS

scheme comprises the following algo-

rithms:

Setup(1

). Create the public parameters

params = (G, q,g,H ) where G is a group of

prime order q of size λ, where CDH is hard. g

←− G is

a random generator of G. H

: {0,1}

∗

→ G is a hash

function, modeled as a random oracle in the security

analysis.

KeyGen(1

). Select a random element x

←− Z

and sets the secret key sk

= x

. The algorithm also

outputs the public parameter iparams = X

, where

= g

ICISSP 2020 - 6th International Conference on Information Systems Security and Privacy

Mac(params,sk

). Compute h

← H

), and

compute the tag τ

= h

Verify(params,sk

, pk

,τ

). Compute h

= H

and accept if τ

= h

Theorem 1 A probabilistic polynomial-time adver-

sary against MAC

BLS

succeeds in returning a valid

forgery with only negligible probability under the

CDH assumption.

The proof for Theorem 1 is provided in appendix A.1.

Aggregate MAC

BLS

Construction. Based on the

MAC

BLS

scheme construction introduced above, we

deﬁne the aggregate MAC scheme in groups of prime

order. The aggregation function AggMac is public

and unkeyed, namely any node is able to aggregate its

own tag without a secret key (as opposed to the MAC

computation step). The aggregate MAC

BLS

scheme

is the MAC

BLS

scheme with the following additional

algorithms:

AggMac({τ

}

i=1

). Given a set of tags {τ

}

i=1

output the aggregate tag τ =

∏

i=1

AggVerify(params, {(sk

, pk

)}

i=1

,{m

}

i=1

,τ).

For 1 ≤ i ≤ n, compute h

= H

). Check if

τ =

∏

i=1

. Return accept if true, and reject

otherwise.

Theorem 2 Aggregate MAC

BLS

is unforgeable pro-

vided that the underlying MAC

BLS

scheme is unforge-

able.

The security deﬁnition of unforgeability for aggregate

algebraic MACs is that of existential unforgeability

under chosen message attack. This deﬁnition illus-

trates the fact that an adversary who has access to at

most n −1 secret keys, is still unable to output a valid

aggregate tag by n users (Boneh et al., 2003). We

prove Theorem 2 in appendix A.2.

5 CoRA

CoRA is a secure and scalable collective attestation

protocol, which consists of two phases, namely the

deployment phase presented in Section 5.2 and the

attestation phase in Section 5.3. The protocol also

comprises an optional detection phase, presented in

Section 5.4. The deployment phase is executed only

once by the operator O, who initializes the network.

Following deployment, the veriﬁer V can periodi-

cally verify the software integrity of all devices in

the network by initiating the attestation phase. In the

case where veriﬁcation fails, V initiates the detection

phase, in order to identify the origin of the failure. We

demonstrate the security of CoRA in Section 7, based

on the security of its underlying aggregation mecha-

nism.

5.1 Preliminaries

In the construction of CoRA, we use anonymous au-

thentication schemes, namely non-interactive zero-

knowledge proofs of knowledge (also known as sig-

natures of knowledge (Schnorr, 1991)). Signatures

of knowledge are highly efﬁcient signature schemes,

that leverage the knowledge of a cryptographic secret,

in order to authenticate a given user. They are the

building block of numerous authentication schemes

such as group signatures or anonymous credentials.

In CoRA, signatures of knowledge are used in the at-

testation and detection phases to prove that a given

node has generated a given tag during the aggregation

process. To deﬁne our signatures of knowledge, we

use the Camenisch and Stadler notation (Camenisch

and Stadler, 1997), whereby π(m) = SoK{sk

: y =

}(m) denotes a signature of knowledge on mes-

sage m. A device D

with secret key sk

signs message

m by proving that he knows the secret sk

, correspond-

ing to a discrete logarithm in base g.

Theorem 3 CoRA is secure against forgery attacks,

under the assumption that aggregate MAC

BLS

is un-

forgeable.

The proof for Theorem 3 is provided in Section 7.

5.2 Deployment Phase

In the deployment phase, the network operaror O

runs the Setup and KeyGen of the aggregate MAC

BLS

scheme, and obtains the public parameters params,

and the secret keys sk

for every device D

. Prior to

deployment, O initializes each device with a MAC

BLS

secret key sk

for i ∈ {1,...,n}, and its own MAC

BLS

public value pk

= X

. The secret keys are used by

devices to generate MAC

BLS

tags τ

on their internal

state S

. The tags will later be aggregated and for-

warded to V . The attestation and aggregation steps

are developped in Section 5.3. In addition, each D

is initialized with a counter value cnt

, which corre-

sponds to the attestation sequence k. cnt

is initial-

ized to 0, and incremented by the veriﬁer V and each

node after each attestation process. The counters are

used to monitor the attestation sequence number, thus

preventing replay attacks. Indeed, upon receiving the

attestation request, node D

veriﬁes that the value of

the associated counter is greater than or equal to the

CoRA: A Scalable Collective Remote Attestation Protocol for Sensor Networks

Table 1: CoRA parameters notation.

Acronyms Description

O Network opera-

tor

V Network veriﬁer

, pk

O’s MAC

BLS

key

pair

Device i with

identiﬁer ID

root device

, pk

’s MAC

BLS

key

pair

attestation report

MAC tag on

message s

attReq attestation re-

quest

GenAtt(key,s

) generates and au-

thenticates attes-

tation report

AggAtt(τ

,...,τ

) aggregates attes-

tation reports

VrfAggAtt({s

}

i=1

,τ) veriﬁes aggre-

gated report

counter value stored locally. Each device in the net-

work possesses a unique identiﬁer ID

, which can for

example, be derived from its IP address. O is able

to deploy new devices in the swarm at any time, by

executing the initialization process described above.

5.3 Attestation Phase

The attestation phase allows the network operator O

and the veriﬁer V , to verify the integrity of every de-

vice in the swarm.

Overview. The goal of the attestation phase is to it-

eratively authenticate each device D

’s internal soft-

ware state S

, and propagate said attestation proofs

up the attestation tree until it reaches the veriﬁer V .

The attestation phase of CoRA (Figure 2), is divided

in three sub-phases, namely request dissemination,

attestation, and veriﬁcation. V initiates the request

dissemination phase by sending an attestation request

attReq to the closest device in his communication

range A

. Upon receiving attReq, A

veriﬁes that it

is indeed a valid request from V , and forwards to its

children down the attestation tree. Each device in the

tree receiving the request, veriﬁes its authenticity and

freshness. This initial step securely communicates to

each device that a new attestation process has been

initiated. Upon authenticating the request, leaf nodes

generate the attestation report on their internal soft-

ware state and send it to their parents. Intermediary

nodes authenticate said reports, generate their own

attestation, and in turn send the aggregated result to

their parents. V receives the ﬁnal report from A

. He

then veriﬁes the validity of the aggregate report, hence

conﬁrming the integrity (or lack thereof) of every de-

vice in the network.

(1) Request Dissemination. V initiates the attesta-

tion phase by disseminating an attestation request

to the nearest device in its communication range

. The request attReq is generated as follows:

– Generate a random nonce N

←− {0, 1}

for the

current attestation process, where l

is the size

of the nonce.

– Update cnt

← cnt

+ 1

– Choose a random collision-resistant hash func-

tion H

– Generate a signature of knowledge on message

m = N

as π

= SoK{x

: X

= g

}(m).

– Deﬁne challenge c

← {n, X

,Cert

,π

where X

is the MAC

BLS

public key for O and

Cert

a valid certiﬁcate on X

. n is the size of

the swarm.

– attReq ← c

Upon receiving attReq, A

authenticates V by

verifying π

. It then propagates the request

down the attestation tree. Intermediary nodes

authenticate the request before forwarding it to

their children. This authentication step mitigates

against distributed DoS attacks, whereby an at-

tacker might render devices unavailable by send-

ing them false attestation requests.

(2) Attestation. Upon checking the authenticity and

freshness of attReq, each leaf node D

proceeds

to measuring its internal software software state

. It then runs the attestation generation function

GenAtt(sk

) deﬁned as follows:

GenAtt: (sk

1: Generate τ

← MAC

BLS

(sk

), where m

||cnt

||S

). Including N

and cnt

in the mes-

sage ensures the freshness of the tag.

2: Generate a signature of knowledge π

, of the se-

cret key on the tag τ

, where π

= SoK{x

: τ

∧ X

= g

}(τ

3: Deﬁne an empty list C

4: Return report a

← (ID

,H (N

||cnt

),τ

,π

)

ICISSP 2020 - 6th International Conference on Information Systems Security and Privacy

Level 1 Level 2 Level 3 & 4

• [τ

] =Mac

) • [τ

] = AggMac({τ

,τ

}) • [τ

] = AggMac({τ

,τ

})

• [τ

] =Mac

) • [τ

] = AggMac({τ

,τ

,}) • [τ

] = AggMac({τ

,τ

})

• [τ

] =Mac

) • [τ

] = AggMac({τ

,τ

}) • [τ

] = AggMac({τ

,τ

})

Figure 2: Aggregation tree containing nodes {A

,...,D

Upon receiving the attestation reports a

and a

from its children, intermediary node D

runs the

attestation aggregation function AggAtt(τ

,τ

AggAtt: (τ

,τ

1: Verify π

and π

. If the veriﬁcation succeeds, pro-

ceed to step 2. Else, set C

= {ID

}

k∈{i, j}

, where

the identiﬁer(s) in C

corresponds to those whose

signature of knowledge veriﬁcation failed.

2: Generate τ

← MAC

BLS

(sk

), where message

= (N

||cnt

||S

)

3: Compute τ ← AggMAC

BLS

(τ

,τ

)

4: Generate π

= SoK{x

: τ

= h

∧ X

= g

}(τ)

5: Return a

← (ID

,H (N

||cnt

),τ, π

)

At the end of the attestation generation, aggrega-

tion, and propagation phase, V receives the ﬁnal

attestation report a

from A

, and proceeds to ver-

ifying its validity.

(3) Veriﬁcation. Upon receiving the ﬁnal re-

port in time t ≤ t

exp

, V runs the aggre-

gated attestation veriﬁcation function VrfAg-

gAtt(sk

,..., sk

,τ

,..., τ

,{S

,..., S

}) on the list

of expected healthy states {S

,..., S

} it possesses.

The time t

exp

is deﬁned through prior real-world

experiments, in order to estimate an upper-bound

of the overall attestation time. Such experiments

must include network delays, transmission times,

and individual attestation generation and aggrega-

tion times.

VrfAggAtt : ({sk

}

i=1

,{τ

}

i=1

,{S

}

i=1

1: b ← AggVerifyMAC

BLS

({sk

}

i=1

,τ,{S

}

i=1

)

2: If b = 1 and C

0, return 1

3: Otherwise return 0

If the function returns 1, V concludes that the net-

work is in a trustworthy state. Otherwise, he con-

cludes that at least one device is compromised and

proceeds to the detection phase.

5.4 Detection Phase

An attacker A who performed a mismatch attack, by

aggregating an erroneous attestation report, will be

identiﬁed in the detection phase. Let D

be the target

device in such attacks. Upon the function VrfAggAtt

returning 0, V proceeds as follows:

1. V requests the signatures of knowledge {π

}

i=1

for every node in the network.

CoRA: A Scalable Collective Remote Attestation Protocol for Sensor Networks

2. V veriﬁes the corresponding tags τ

i=1

3. V proceeds iteratively down the attestation tree

until it reaches the node D

which did not aggre-

gate the valid tag/SoK pair.

The signature of knowledge ensures that each node

remains accountable for the value it has previously

aggregated during the attestation phase. Consider-

ing the assumption that no adversary can easily per-

form physical attacks, and generate a valid MAC

BLS

tag without a valid secret key sk

, this ensures that V

is able to identify each node that aggregates an erro-

neous report.

6 PERFORMANCE EVALUATION

We implemented CoRA on a Teensy 3.2 micro-

controller. The Teensy 3.2 board is an Arduino-

compatible microcontroller, featuring a 32 bit ARM

processor with a 72 MHz Cortex-M4 core. It also fea-

tures 256 kB Flash and 64 kB RAM memory. The

board provides the minimal hardware requirements

for remote attestation as stated in Section 3.2. Cryp-

tographic algorithms are implemented based on the

micro-ecc(MacKay, 2017) library. As presented in

Table 2, we use a SHA-256 hash function.

Table 2: Performance of cryptographic algorithms on

Teensy 3.2.

Algorithm Run-time (ms)

SHA-256 0.244

SHA-256

HMAC

0.809

Table 3: Performance of MAC

BLS

functions.

Mac

Run-

time

(s)

Number

of de-

vices

AggMac

Run-

time

(s)

0.047

100 5.55

500 27.8

1000 56.1

1500 84.3

Table 3 shows the runtime performance of

MAC

BLS

. The choice of algebraic MACs (in elliptic

curve groups) provides a more efﬁcient veriﬁcation

step, considering that computing AggVer is the same

as computing AggMac. The implementation makes

use of secp160r1 curves (Research, 2000).

7 SECURITY ANALYSIS

In this section, we provide a proof of security of

CoRA, as stated by Theorem 3. As speciﬁed in

Section 3.1, a swarm attestation scheme is secure

against forgery if no adversary is able to produce a

forgery for an uncompromised device (for which he

doesn’t know the secret key), even after accessing at

most n − 1 attestation results. We derive the security

of our swarm attestation protocol by drawing the

parallel between the security deﬁnition for swarm

attestation forgery (Francillon et al., 2014), and the

security of the aggregate MAC

BLS

scheme.

In formal swarm attestation deﬁnition, the veriﬁer V

returns 1 if AggVerify(params,{sk

}

i=1

,{m

}

i=1

,τ) =

1, i.e. if τ is a valid aggregate tag on the set of

expected valid states {S

}

i=1

, and the incorporated

nonce N

is the session nonce provided by V . Let

A be an attacker on the network whose goal is to

produce a valid forgery of the attestation response. A

has compromised prover D

. We consider two types

of adversaries:

Type 1: A

does not alter the attestation of D

to be included in the aggregate response.

Type 2: A

modiﬁes the internal state of D

, and

generates an attestation τ

on (ID

||N

||cnt

In the ﬁrst case, according to our assumptions,

cannot physically compromise D

and retrieve its

secret key x

. A

’s only strategy is to use an attes-

tation response of a previously generated attestation

, on the same software conﬁguration S

and

an old nonce N

. Let N

curr

be the random nonce

generated by V in the current round of attestation.

The probability that N

= N

curr

is equal to 2

−l

which is negligible for a sufﬁciently large nonce. A

will therefore output a valid attestation response only

with negligible probability.

In the second case, we observe the following

analogy: the security deﬁnition of resistance against

forgery for a remote attestation protocol, is exactly

the security deﬁnition of unforgeability of the

aggregate MAC

BLS

scheme, namely forgery for an

adversary who had access to up to n − 1 tags. A

’s

advantage in successfully producing a forgery is

therefore the same as A

’s advantage in producing a

valid aggregate MAC

BLS

forgery, which is negligible

under the CDH assumption in the random oracle

ICISSP 2020 - 6th International Conference on Information Systems Security and Privacy

model (see proof in Appendix A.1). Indeed, in

order for A

to generate a valid attestation on a

modiﬁed state without physically compromising D

he needs to forge an aggregate MAC

BLS

scheme on

all aggregated tags, assuming that at least one device

in the network is honest. According to Theorem 2,

aggregate MAC

BLS

is unforgeable provided that

MAC

BLS

is unforgeable (see proof in Appendix A.2).

The probability of A

generating said valid attestation

is therefore negligible.

8 CONCLUSION

In this work we introduced CoRA, the ﬁrst collective

attestation protocol with veriﬁer detection for sensor

networks. Collective (or swarm) attestation is a se-

curity mechanism which efﬁciently veriﬁes the in-

tegrity of large numbers of devices in wireless multi-

hop networks. CoRA leverages the aggregating prop-

erty of its underlying in-network aggregation mecha-

nism, namely aggregate MAC

BLS

, to provide a highly

scalable swarm attestation protocol with efﬁcient ver-

iﬁcation. In order to detect the malicious injection of

erroneous attestation, CoRA comprises a scalable de-

tection algorithm, which leverages the algebraic prop-

erty of algebraic MACs to generate proofs of knowl-

edge, on a device’s secret key. The detection method

allows the identiﬁcation of a compromised node in the

network, thus preventing DoS attacks on the veriﬁer.

We provide a rigorous proof for the underlying cryp-

tographic construction, as well as the CoRA protocol.

Finally, we prove the efﬁciency of our scheme, based

on a prototype implementation on a standard micro-

controller.

REFERENCES

Ambrosin, M., Conti, M., Ibrahim, A., Neven, G., Sadeghi,

A., and Schunter, M. (2016). SANA: secure and scal-

able aggregate network attestation. In Proceedings of

the 2016 ACM SIGSAC Conference on Computer and

Communications Security, Vienna, Austria, October

24-28, 2016, pages 731–742.

Asokan, N., Brasser, F. F., Ibrahim, A., Sadeghi, A.,

Schunter, M., Tsudik, G., and Wachsmann, C. (2015).

SEDA: scalable embedded device attestation. In Pro-

ceedings of the 22nd ACM SIGSAC Conference on

Computer and Communications Security, Denver, CO,

USA, October 12-16, 2015, pages 964–975.

Boldyreva, A., Gentry, C., O’Neill, A., and Yum, D. H.

(2007). Ordered multisignatures and identity-based

sequential aggregate signatures, with applications to

secure routing. In Proceedings of the 2007 ACM Con-

ference on Computer and Communications Security,

CCS 2007, Alexandria, Virginia, USA, October 28-31,

2007, pages 276–285.

Boneh, D., Gentry, C., Lynn, B., and Shacham, H. (2003).

Aggregate and veriﬁably encrypted signatures from

bilinear maps. In Advances in Cryptology - EURO-

CRYPT 2003, International Conference on the Theory

and Applications of Cryptographic Techniques, War-

saw, Poland, May 4-8, 2003, Proceedings, pages 416–

432.

Boneh, D., Lynn, B., and Shacham, H. (2001). Short signa-

tures from the weil pairing. In Advances in Cryptol-

ogy - ASIACRYPT 2001, 7th International Conference

on the Theory and Application of Cryptology and In-

formation Security, Gold Coast, Australia, December

9-13, 2001, Proceedings, pages 514–532.

Camenisch, J. and Stadler, M. (1997). Proof systems for

general statements about discrete logarithms. Techni-

cal report.

Carpent, X., Defrawy, K. E., Rattanavipanon, N., and

Tsudik, G. (2017). Lightweight swarm attestation:

A tale of two lisa-s. In Proceedings of the 2017

ACM on Asia Conference on Computer and Commu-

nications Security, AsiaCCS 2017, Abu Dhabi, United

Arab Emirates, April 2-6, 2017, pages 86–100.

Chan, H., Perrig, A., and Song, D. X. (2006). Secure

hierarchical in-network aggregation in sensor net-

works. In Proceedings of the 13th ACM Conference on

Computer and Communications Security, CCS 2006,

Alexandria, VA, USA, Ioctober 30 - November 3,

2006, pages 278–287.

Dodis, Y., Kiltz, E., Pietrzak, K., and Wichs, D. (2012).

Message authentication, revisited. In Advances in

Cryptology - EUROCRYPT 2012 - 31st Annual Inter-

national Conference on the Theory and Applications

of Cryptographic Techniques, Cambridge, UK, April

15-19, 2012. Proceedings.

Eikemeier, O., Fischlin, M., G

otzmann, J., Lehmann, A.,

Schr

oder, D., Schr

oder, P., and Wagner, D. (2010).

History-free aggregate message authentication codes.

In Security and Cryptography for Networks, 7th In-

ternational Conference, SCN 2010, Amalﬁ, Italy,

September 13-15, 2010. Proceedings, pages 309–328.

Falliere, N., Murchu, L. O., and Chien, E. (2010).

W32.stuxnet dossier. Symantec.

Francillon, A., Nguyen, Q., Rasmussen, K. B., and Tsudik,

G. (2012). Systematic treatment of remote attestation.

IACR Cryptology ePrint Archive.

Francillon, A., Nguyen, Q., Rasmussen, K. B., and Tsudik,

G. (2014). A minimalist approach to remote attesta-

tion. In 2014 Design, Automation & Test in Europe

Conference & Exhibition (DATE), pages 1–6. IEEE.

Ibrahim, A., Sadeghi, A., Tsudik, G., and Zeitouni, S.

(2016). DARPA: device attestation resilient to phys-

ical attacks. In Proceedings of the 9th ACM Confer-

ence on Security & Privacy in Wireless and Mobile

Networks, WISEC 2016, Darmstadt, Germany, July

18-22, 2016, pages 171–182.

Ibrahim, A., Sadeghi, A., and Zeitouni, S. (2017). Seed:

secure non-interactive attestation for embedded de-

vices. In Proceedings of the 10th ACM Conference

CoRA: A Scalable Collective Remote Attestation Protocol for Sensor Networks

on Security and Privacy in Wireless and Mobile Net-

works, WiSec 2017, Boston, MA, USA, July 18-20,

2017, pages 64–74.

Katz, J. and Lindell, A. Y. (2008). Aggregate message au-

thentication codes. In Topics in Cryptology - CT-RSA

2008, The Cryptographers’ Track at the RSA Confer-

ence 2008, San Francisco, CA, USA, April 8-11, 2008.

Proceedings, pages 155–169.

Kohnh

auser, F., B

uscher, N., Gabmeyer, S., and Katzen-

beisser, S. (2017). SCAPI: a scalable attestation pro-

tocol to detect software and physical attacks. In Pro-

ceedings of the 10th ACM Conference on Security

and Privacy in Wireless and Mobile Networks, WiSec

2017, Boston, MA, USA, July 18-20, 2017, pages 75–

86.

Kohnh

auser, F., B

uscher, N., and Katzenbeisser, S. (2018).

SALAD: secure and lightweight attestation of highly

dynamic and disruptive networks. In Proceedings of

the 2018 on Asia Conference on Computer and Com-

munications Security, AsiaCCS 2018, Incheon, Re-

public of Korea, June 04-08, 2018, pages 329–342.

Lu, S., Ostrovsky, R., Sahai, A., Shacham, H., and Waters,

B. (2006). Sequential aggregate signatures and mul-

tisignatures without random oracles. In Advances in

Cryptology - EUROCRYPT 2006, 25th Annual Inter-

national Conference on the Theory and Applications

of Cryptographic Techniques, St. Petersburg, Russia,

May 28 - June 1, 2006, Proceedings, pages 465–485.

MacKay, K. (2017). micro-ecc library.

Mansﬁeld-Devine, S. (2016). Ddos goes mainstream: how

headline-grabbing attacks could make this threat an

organisation’s biggest nightmare. Network Security.

Research, C. (2000). Sec 2: Recommended elliptic curve

domain parameters.

Schnorr, C. (1991). Efﬁcient signature generation by smart

cards. J. Cryptology, 4(3):161–174.

A Security Analysis of MAC

BLS

and

Aggregate MAC

BLS

A.1 MAC

BLS

Security

In this section, we prove Theorem 1, which states that

MAC

BLS

is UF-CMVA in the random oracle model.

Let q

be the maximum number of queries an algo-

rithm A can make to O

Hash

, q

the maximum num-

ber of queries to O

MAC

, and q

the maximum num-

ber of queries to O

Verify

. Assume an algorithm A

(t,q

,ε)−breaks the UF-CMVA security of

MAC

BLS

. We use A to construct an algorithm B

that (t

,ε)−breaks computational Difﬁe-Hellman on

the group G. Using a sequence of security experi-

ments, we use the forger A to build the algorithm B

that breaks CDH on G.

Setup. B is given the challenge (g,g

). G be-

ing a GDH group, B also has access to a DDH ora-

cle O

DDH

that outputs 1 if an argument of the form

(g,g

,h,h

) is a valid Difﬁe-Hellman tuple. B main-

tains a list (h

,τ

) for all hash and MAC queries. A

can request a hash on any message of its choice, to

which B responds with the corresponding h

. Simi-

larly, A can request a tag on any message of its choice,

and receives the corresponding τ

where i ∈ {1,...,l}

and l ≤ q

is the number of requests to O

MAC

. B sets

the operator’s parameters X = g

, thus implicitely set-

ting sk = a.

For 1 ≤ i ≤ q

, A picks a random i

∗

←− {1, ...,q

A then selects a random r

←− Z

∗

for 1 ≤ i ≤ q

, sets

← (g

∗

for i = i

∗

, and h

← g

otherwise. If

i 6= i

∗

, it sets τ

← (g

)

. If i = i

∗

, it sets τ

∗

= ? which

is a placeholder value.

Queries. When A requests a hash on m

, B outputs

. When A requests a tag on m

, if i 6= i

∗

B outputs τ

Otherwise if i = i

∗

, B declares failure and aborts. A

may also make veriﬁcation queries on input (m

,τ

B then uses its DDH oracle O

DDH

, and outputs the

result obtained from O

DDH

on the tuple (g,g

,τ

Response. At some point, A outputs a forgery

∗

,τ

∗

) such that m was never queried to O

MAC

, and

Verify(sk,m, τ) = 1.

• The probability that B aborts is equal to 1/q

which is inverse polynomial. We can reduce this

value by repeating the experiment a polynomial

number of times.

• The r

’s are selected at random, therefore h

’s are

uniformly distributed in G, making O

Hash

a ran-

dom oracle. Moreover, if i 6= i

∗

, the tags τ

are-

all valid.If B does not abort, the simulation for A

is indistinguishable from a real execution of the

MAC algorithms.

• If A successfully outputs a forgery (m

∗

,τ

∗

) and

B does not abort, h

∗

= h

∗

= (g

∗

. Therefore

∗

= (g

∗

). B retrieves g

∗

)

∗

. B out-

puts the valid answer to the CDH challenge.

• Adv

UF-CMVA

) = ε/q

. If we repeat the experi-

ment k times, the probability that algorithm B out-

puts a valid answer to the CDH challenge is equal

to (

)

which is non-negligible.

A.2 Aggregate MAC

BLS

Security

In this section, we give the prove by reduction of The-

orem 2 in the random oracle model. We consider the

ICISSP 2020 - 6th International Conference on Information Systems Security and Privacy

setting where the reduction maintains a list KeyList of

all public keys attached to each secret key sk

Let A be an adversary against the EUF-CMVA prop-

erty of aggregate MAC

BLS

. Using A as a subroutine,

we construct a reduction B against the UF-CMVA

property of the MAC

BLS

scheme run by a challenger

C . B receives the system public parameters params =

(G,q, g), and the public key pk

∗

for an unknown iden-

tity X

∗

= g

∗

where i

∗

∈ {1,...,l} and l = poly(λ).

B has access to two oracles: an oracle O

MAC

BLS

,sk

∗

(that we will refer to as O

Mac

to simplify notations)

for the unknown key x

∗

= x

∗

, and the oracle O

Verify

that checks the validity of any message/tag pair. C

initializes an empty list M that will store the subse-

quent messages from O

Mac

queries.

1. B chooses i

∗

←− {1,...,t};

2. For i = 1 to t:

• If i 6= i

∗

, select r

←− Z

∗

, and set h

← g

Choose x

←− Z

. Set X

= g

and add

(i, pk

= X

,sk

= x

) to KeyList. iparams =

{pk

,..., pk

• If i = i

∗

, do nothing but implicitely set sk

∗

(sk

∗

3. B runs A(params,iparams) answering the

queries as follows:

• Hash

∗

):B uses its MAC

BLS

hash oracle

Hash

to output the corresponding hash h

• AggMac

∗

({m

,..., m

}): B computes the ag-

gregate tag τ

using the known secret key sk

∗

. If

there is i ∈ {1,..., q} such that i = i

∗

, B queries

its own oracle O

Mac

on m

. Finally, B returns

the τ

4. At some point, A outputs M = {m

,..., m

)} and

an aggregate tag τ. Let j be the ﬁrst index such

that A has never queried m

to Mac

∗

, and pk

∗

. If j 6= i

∗

then B abort; Otherwise, proceed as

follows:

(a) We therefore consider the case where j = i

∗

B computes the tag τ

∗

from τ =

∏

i=1

the

following way: τ

∗

∏

l=1,l6=i

∗

(b) B has the secret keys corresponding to all iden-

tiﬁers that are not i

∗

, he is therefore able to

compute a valid τ

∗

. When j = i

∗

, B simply

queries Mac

∗

m to get the corresponding tag. Fi-

nally, B outputs (m

,τ

∗

) as a valid forgery of a

MAC

BLS

tag.

The proof of correctness follows from the follow-

ing observations:

• The probability that B aborts is equal to 1/t,

which is inverse polynomial. If B does not abort,

the simulation for A is indistinguishable from a

real execution of the aggregate MAC algorithms.

• If A successfully outputs a forgery for the aggre-

gate MAC scheme, and B does not abort, the as-

sumption stipulates that A has never queried B

on m

. Therefore B has never queried Mac

∗

The success of algorithm A means that τ =

∏

i=1

containing τ

∗

. The tag B outputs is therefore a

valid forgery of a MAC

BLS

tag.

CoRA: A Scalable Collective Remote Attestation Protocol for Sensor Networks