July 2004 15 04 0245 01 004 b

July, 2004 15 -04 -0245 -01 -004 b Project: IEEE P 802. 15 Working Group for Wireless Personal Area Networks (WPANs) Submission Title: [Suggestions for Improvement of the IEEE 802. 15. 4 -2003 WPAN Standard] Date Submitted: [July 15, 2004] Source: [René Struik] Company [Certicom Corp. ] Address [5520 Explorer Drive, 4 th Floor, Mississauga, ON Canada L 4 W 5 L 1] Voice: [+1 (905) 501 -6083], FAX: [+1 (905) 507 -4230], E-Mail: [rstruik@certicom. com] Re: [Current IEEE 802. 15. 4 -2003 Low-Rate WPAN standard. ] Abstract: [This document gives some recommendations to assist in improving the security and flexibility of the IEEE 802. 15. 4 -2003 Low-Rate WPAN standard. ] Purpose: [Assist in improving the IEEE 802. 15. 4 -2003 WPAN standard. ] Notice: This document has been prepared to assist the IEEE P 802. 15. It is offered as a basis for discussion and is not binding on the contributing individual(s) or organization(s). The material in this document is subject to change in form and content after further study. The contributor(s) reserve(s) the right to add, amend or withdraw material contained herein. Release: The contributor acknowledges and accepts that this contribution becomes the property of IEEE and may be made publicly available by P 802. 15. Submission 1 Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b Suggestions for Improvement of the IEEE 802. 15. 4 -2003 WPAN Standard René Struik, Certicom Research Submission 2 Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b MAC Security vs. Security Architectural Framework CA key initialization ACL ACL Maintenance Wrapped public key info Certificate maintenance Public key verification Upper layers Data key maintenance A Extracted public key info Authentication, key establishment B Extracted public key info Encryptor/ decryptor Submission Data key Certificate maintenance Public key verification (Link key, A, B) Wrapped data key info Data key repository CA key initialization Wrapped public key info (Link key, A, B) Key info data ACL Maintenance A key distribution B A data transfer 3 Wrapped data B Data key maintenance Data key repository Network and down Data key Network and down Wrapped data key info Upper layers Key info Encryptor/ decryptor data Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b MAC Security (1) Security objectives • Confidentiality (Encryption: ON/OFF) • Data authenticity (Integrity: No/Low/Medium/High {i. e. , 0, 32, 64, 128 -bit}) • Weak freshness (Relative ordering in time: Enabled/disabled {via Frame. Counter}) Security non-objectives • Strong freshness (Absolute ordering in time: not provided) Required info • Algorithm Id: specifies the particular crypto primitive used • Key Id: prevents use of improper data keys • Sequence number: prevents undetected reordering (or replay) of message frames Data key repository Key info data Encryptor/ decryptor Submission Data key repository Data key Wrapped data A data transfer 4 Wrapped data B Key info Encryptor/ decryptor data Rene Struik, Certicom Corp.

July, 2004 MAC Security (2) 15 -04 -0245 -01 -004 b Variations (1) A B: : [x]SECk, NA {k= f(A, B)} {unicast message} (2) A G: : [x]SECk, NA {k= f(A, G)} {multicast with multicast key} (3) A G: Id. G’ : [x]SECk, NA {k=k. G’, G G’}{multicast with key of bigger group} (4) Sender A: (5) Determine adequate security level: SEC 0(A, G, x) (6) Determine key Key to be used for A G (7) Determine frame counter NA (8) Perform crypto operations using (k, NA) and protection level SEC (9) Update info Recipient B (B G): (1) Check adequacy of purported security level: SEC 0(A, G, x) (2) Retrieve key Key that was purportedly used (3) Retrieve frame counter NA that was purportedly used (4) Check freshness: NA N 0 A {NA {used nonces}} (5) Determine long address Address. A of sending device (6) Perform crypto operations using (k, NA) and protection level SEC (7) Update info Submission 5 Rene Struik, Certicom Corp.

July, 2004 MAC Security (3) 15 -04 -0245 -01 -004 b Adequate security level SEC 0(A, G, x) Frame/Command Type Ordinary data Beacon Acknowledgement Command Associate Command Disassociate Special data Submission SEC 0 ENC-MIC-64 None 6 Rene Struik, Certicom Corp.

July, 2004 MAC Security (4) 15 -04 -0245 -01 -004 b Some areas where changes would be beneficial: 1. Crypto primitives: Add CCM* mode (lower implementation cost, re-use key for different protection levels) 2. Protection levels: - Differentiate applied protection level: include dynamic SEC field in MAC frames - Differentiate expected minimum protection level (e. g. , to facilitate key agreement authentication with ‘unsecured’ SEC 0 field) 3. Bastardized key usage: - Facilitate use of group key for peer-to-peer traffic (save storage) - Remove ambiguities in key identification 5. Group keying: Facilitate secure broadcast, secure multicast (would necessitate group addressing as well) 4. Clean up useless stuff: Remove key sequence counter (bandwidth reduction) 6. Security overhead: Allow compression of frame counter (bandwidth reduction) 7. Other (not necessarily security-related): Allow 1 -octet short addresses (bandwidth reduction for small networks) Submission 7 Rene Struik, Certicom Corp.

July, 2004 MAC Security (5) 15 -04 -0245 -01 -004 b … or, according to Robert Poor’s summary (see 04/0272 r 0): 1. There's no way for a node to join a secured network unless it a-priori holds a key. 2. A node cannot broadcast a secured packet (since sender ID needs to be part of a secured packet, and broadcast packets don't include sender ID) 3. There's no mechanism to notify a receiving node that a sending node has changed its key. 4. Different keys are required for different levels of security - CCM and CBC-MAC can be folded into one (both addressed by CCM* proposal) 5. Any packet that includes security incurs a 5 -byte overhead. This can be compresse down to approximately one byte. 6. Security suite (a. k. a. level of security) must agree exactly in sender and receiver – when sending to multiple recipients, optimizations are possible by allowing a sende to ‘meet or exceed’ the security level required of the recipients. - Security is static, contained in the MIB of the sender and receiver. 7. The ‘key sequence counter’ is a vestige of an unused designed and can be eliminate to shorten packet overhead. Submission 8 Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b Some backup slides… Submission 9 Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b Fine-Grained Security Support – Description Grammar Security fields: <SEC> : : = <encryption flag> <authentication flag> <encryption flag>: = On, OFF <authentication flag> : : = none, low, medium, high {i. e. , 0, 4, 8, 16 bytes} {options indicated by 3 -bit protection level indicator} <Key Id> : : = <Impl. Key. Id> | <Expl. Key. Id> {option indicated by 1 -bit ‘bastardized’ use of group key indicator} <Impl. Key. Id> : : = emptyset <Expl. Key. Id> : : = <key source><Key Id> <Key. Source> : : = <physical address> <Key Id> : : = <group counter> Freshness fields (in-order receipt indicator) <Frame. Counter> : : = <compressed counter> | <long frame counter> {option indicated by 1 -bit reduced nonce indicator} “Atoms” (end symbols in grammar): <compressed counter> : : = 1 -octet field <long frame counter> : : = 4 -octet field <group counter> : : = 1 -octet field {this allows 256 groups with same group source} Submission 10 Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b Security Suite Specification (1) Current draft specification distinguishes 8 security suites, depending on combination of encryption and data authentication used: • Encryption: ON/OFF • Data authentication/integrity: #integrity bits {L 0, L 1, L 2, L 3}= {0, 32, 64, 128} Current security suite specifications are based on 3 security mechanisms: 1. CBC-MAC mode, to provide for data authentication only; 2. AES-CTR mode, to provide data confidentiality only; 3. AES-CCM mode, to provide both data confidentiality and data authenticity. 4. Problems: - Different security suites have to use different keys (see § 7. 6. 1. 8), for security concerns - The AES-CBC-MAC specification (§ 7. 6. 4) is vulnerable to replay attacks, since it does not provide for ‘freshness’ guarantees Consequences: - Need to implement 3 security mechanisms, to allow for flexibility (thus, impact on code size) - Higher layer mechanisms cannot re-use MAC keying material, because of security concerns (thus, impact on key storage size) Submission 11 Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b Security Suite Specification (2) Proposed security suite specification - secure Specification of security suites is based on 1 security mechanism: • AES-CCM* mode, to provide data confidentiality only, data authenticity only, or both data confidentiality and data authenticity/integrity Consequences: - AES-CCM* mode has same security properties as the AES-CCM mode specification in Annex B - AES-CCM* mode allows secure re-use of same key, both in MAC and higher layers - AES-CCM* mode has same format as AES-CCM mode specification for NIST - Data authenticity-only mode (‘CBC-MAC’) not vulnerable to replay attack any more - Need to implement only 1 security mechanism (thus, favorable for code size) CCM* vs. CCM: - CCM* allows the length M of the authentication field to be zero (‘encryption-only’); - CCM* imposes restriction on nonce if different authentication tag lengths used (this prevents attack on CCM with variable tags [Rogaway, David Wagner, 2003]) For details, see http: //csrc. nist. gov/Crypto. Toolkit/modes/comments/index. html Submission 12 Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b Reducing Security Status Information Overhead (1) Current draft specification adds 5 bytes of security status info overhead to protected frames providing confidentiality (see § 7. 6. 2 for AES-CTR and § 7. 6. 3 for AES-CCM) Consequences: - Large fixed overhead of 5 bytes per secured frame, whether security status info is already reliably available at recipient’s side or not Proposed encoding of security status information: - Security status information is represented more efficiently, exploiting side information - Sending device may decide for itself whether to send all security status info completely (uncompressed) or only partially (compressed) - Sending device has way of determining whether receiving device might have lost synchronization of security status info (e. g. , via slightly modified ACK mechanism) Consequences: - Security status info only sent when required, due to loss of synchronization - Expected bandwidth saving per protected frame: (almost) 4 bytes - Bandwidth saving range per protected frame: from 1 byte (uncompressed) to 4 bytes (compressed) Submission 13 Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b Reducing Security Status Information Overhead (2) I. Reduction of security status info overhead by 1 byte per protected frame MAC Header Frame Control Sequence Counter MAC Payload MAC Footer Frame Payload Frame Control Sequence Addressing Fields Security Status Info Key Counter Frame Counter New Frame Counter Seq. No. Submission Secured Data Existing protected frame format Illustration of how to save 1 byte security status information overhead, by exploiting side information on the sequence counter Sequence Counter New Security Status Info New Frame Counter Data Sequence Counter Key Counter 14 Data Secured Data Proposed uncompressed protected frame format (note the removal of the duplicate string) Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b Reducing Security Status Information Overhead (3) I. Reduction of security status info overhead by 1 byte per protected frame (cont’d) - Frame Counter N: 32 -bit non-repeating value, used for providing security - Sequence Counter DSN: 8 -bit integer value, used for loose synchronization between sent messages and ACK hereon. Incremented by 1 (mod 256) per sent frame Proposed method (lazy updates by sender) • Frame counter N: initialized at any value; when used, updated from N to value N 0 N such that N 0 : =min{N’ N | N’ DSN (mod 256)}. (Here, DSN is current value of Sequence Counter in frame to be sent) • Outgoing frames that require ACK are re-encrypted in exactly the same way till ACK received or till retries exhausted Corollary: • The property N DSN (mod 256) is invariant at each time instance N is used Note: It is easy to compute N 0 from N (hint: compare N (mod 256) and DSN). Submission 15 Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b Reducing Security Status Information Overhead (4) II. Removing security status info overhead per protected frame altogether† MAC Header Frame Control Sequence Counter Addressing Fields MAC Payload MAC Footer Frame Payload Frame Control Sequence New Security Status Info New Frame Counter Sequence Counter Key Counter Secured Data Proposed uncompressed protected frame format Illustration of how to save 3 bytes security status information overhead, by exploiting the re-synch capabilities of the sequence counter New Frame Counter Compr. Security Status Info New Frame Counter Data Sequence Counter Key Counter Data Proposed compressed protected frame format Secured Data †: the Key. Seq. Ctr is always sent for robustness reasons: it allows smooth Zig. Bee key updates and facilitates easy future extensions of the 802. 15. 4 standard using multicasting, whether secured or not. Submission 16 Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b Reducing Security Status Information Overhead (5) II. Removing of security status info overhead per protected frame altogether (cont’d) - Frame Counter N: 32 -bit non-repeating value, used for providing security - Sequence Counter DSN: 8 -bit integer value, used for loose synchronization between sent messages and ACK hereon. Incremented by 1 (mod 256) per sent frame Proposed method (lazy updates by recipient) • Frame counter N: initialized at value 0; when used, updated from N to value N 0 N such that N 0 : =min{N’ N | N’ DSN (mod 256)}. (Here, DSN is current value of Sequence Counter in received frame) Corollary: Let NA be the value of the frame counter used by sender. • If the recipient’s value of N satisfies N NA N+256, then N 0 = NA and decryption proceeds exactly the same as in the current D 17 draft. • If the recipient’s value of N 0 satisfies NA N or NA NA+256, then N 0 NA and decryption proceeds incorrectly* (same effect as active change of Frame Counter in uncompressed scenario). This is so-called loss of synchronization. *: of course, this can only be detected if the protected frame provides for authenticity (as an encryption-only mechanism does not provide for authenticity) Submission 17 Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b Reducing Security Status Information Overhead (6) Security fields (in-order receipt indicator): <Frame. Counter> : : = <compressed counter> | <long frame counter> {option indicated by 1 -bit reduced nonce indicator} “Atoms” (end symbols in grammar): <compressed counter> : : = 1 -octet field <long frame counter> : : = 4 -octet field Submission 18 Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b Reducing Security Status Information Overhead (7) III. Reduction of security status info overhead – what if re-synchronization needed? Proposed error-handling (3 cases): • Feedback channel always on (always ACKs): Rules: Frame transmitted in uncompressed format, if no ACK received (and in compressed format otherwise) {Note: no change to ACK necessary} Loss-of-synchronization NEVER occurs, so behavior exactly as in current draft. • Feedback channel never on (no ACKs at all): Rules: Avoid error-handling altogether by sending uncompressed frames regularly This always works if receiving device is awake at least once in every 256 -frame counter interval; in that case, exactly the same behavior as in draft • Feedback channel sometimes on (ACKs sometimes): Rules: - Recipient: If decryption on compressed frame rejected, do not send ACK next time - Sender: If no ACK received, next frame sent in uncompressed form (this makes sure that re-synch is achieved with a delay of 1 ACK’ed frame only) Submission 19 Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b Reducing Security Status Information Overhead (7 a) III. Reduction of security status info overhead – re-synchronization examples • Feedback channel always on (always ACKs): Frame Counter Message flow 7 msg 1 258 msg 2 289 msg 3 290 msg 4 7 7 7 ACK 2 2 uncompressed 258 ACK 33 258 NAK 289 33 ACK 34 290 Loss-of-synchronization NEVER occurs, so behavior exactly as in current draft (including number of retries afforded) – Remark: if decryption fails long enough, [hacker] recipient runs out-of-synch still (Note: this can be fixed as on next slide (6 b)) Submission 20 Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b Reducing Security Status Information Overhead (7 b) III. Reduction of security status info overhead – re-synchronization examples • Feedback channel sometimes on (ACKs sometimes): Frame Counter 7 msg 1 258 msg 2 288 msg 3 289 msg 4 290 msg 5 290 Frame Counter 7 Message flow msg 5 7 7 2 ACK loss 32 32 33 34 290 uncompressed ACK 7 reject (due to error-flag) NAK (due to error-flag) 290 ACK Enable error-flag: decryption error Message sent with ACK request Disable error-flag: frame counter OK Loss-of-synchronization might occur, but is solved with a delay of 1 ACK’ed frame Submission 21 Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b Reducing Security Status Information Overhead (7 c) III. Reduction of security status info overhead – re-synchronization examples • Feedback channel never on (no ACKs at all): Frame Counter Message flow 7 msg 1 258 msg 2 288 msg 3 289 msg 4 547 msg 5 601 msg 6 805 msg 7 7 2 Frame Counter 7 loss 288 33 289 547 89 805 uncompressed loss 289 805 Loss-of-synchronization might occur, but is solved with next received uncompressed frame Submission 22 Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b Reducing Security Status Information Overhead (8) IV. Reduction of security status info overhead – distinguishing (un)compressed formats Proposed encoding of compressed vs. uncompressed protected frame formats: Indicate compressed/uncompressed mode option in Frame Control Field. (This does not cost anything, since one can simply use 1 of the 6 reserved bits for this). Other potential options: - Indicate compressed/uncompressed mode option in Frame Field (This does cost 8 bits, since there are currently no reserved bits available to encode this information. ) - Do not indicate compressed/uncompressed mode option (This is instable (!!!), since it causes instability of the system and might necessitate 2 decryption executions, to determine which one of the compressed or uncompressed modes was actually used) Submission 23 Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b Reducing Security Status Information Overhead (9) Impact of change on draft (cont’d): • Changes to Clause 7. 6: - (Re)construct Full Frame Counter from Sequence Counter and stored Frame Counter - Add to the acceptance rules for incoming frames (in § 7. 5. 6. 2) the following text: ‘If the Compression Error Flag is set, the received frame shall be in uncompressed format, i. e, the Compression Enabled field in the Frame Control Field shall be disabled’. - During the secure processing of incoming frames (in § 7. 5. 9. 4, § 7. 6. 3), set the Compression Error Flag if the received frame was sent in compressed format and decryption fails; disable a set Compression Error Flag if the received frame was sent in uncompressed format and decryption succeeds. - If a message is sent with the ACK field set and no ACK is received, the message shall be resent in uncompressed format, i. e. , with the Compression Enabled field in the Frame Control Field enabled (in § 7. 5. 6. 5, § 7. 5. 9. 4, § 7. 6. 3). - Incoming and outgoing secured messages shall be processed as if these are in uncompressed format (thus, making re-encryption and retransmission unnecessary) Submission 24 Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b Security Suite Selection (1) Current specification distinguishes 8 security suites, depending on combination of encryption and data authentication used: • Encryption: ON/OFF • Data authentication/integrity: #integrity bits {L 0, L 1, L 2, L 3}= {0, 32, 64, 128} Existing security suite selection and usage (as in Draft D 18) • SEC field indicates whether data is secured or not • Security services (data encryption/authentication) statically depend on security suite negotiated between devices, irrespective of frame type • Mechanism for negotiation of security suite not defined in current standard Consequences: - Out-of-scope mechanism needed for authentic exchange of info on what security suite to use. Need to re-negotiate every time security properties communication change - Communication to multiple recipients with different security suites requires data protection using each of these mechanisms, thus causing extra bandwidth overhead and extra processing (up to 8 times as much) - Inflexible, since security services cannot be tailored towards protection requirements for individual frame types Submission 25 Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b Security Suite Selection (2) Current specification distinguishes 8 security suites, depending on combination of encryption and data authentication used: • Encryption: ON/OFF • Data authentication/integrity: #integrity bits {L 0, L 1, L 2, L 3}= {0, 32, 64, 128} Proposed security suite selection: - SEC field indicates the security services (data encryption/authenticity) that are provided over frame type (beacon, ACK, command, data frame). - Communicating device may decide for itself on how to protect frames it sends: SEC=Encr Auth, where Encr={ON, OFF} and where Auth={0, 32 -bit, 64 -bit, 128 -bit} Consequences: - Inside-scope mechanism for determining what security suite to use - Communication to multiple recipients requires protection using only 1 mechanism *, thus eliminating previously necessary extra bandwidth overhead and processing - Flexible, since security services can be tailored towards protection requirements for individual frame types (e. g. , authenticity for beacons, something else for others) - Allows reduction of #security suites, effectively from 8 to 1 (in § 7. 6) Submission 26 Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b Security Suite Selection (3) Security fields: <SEC> : : = <encryption flag> <authentication flag> <encryption flag>: = On, OFF <authentication flag> : : = none, low, medium, high {corresponds to 0, 4, 8, 16 bytes} {security options indicated by 3 -bit protection level indicator} Submission 27 Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b Other Remarks — Selection (1) Security concerns • Message protection is currently a function of the recipient, whereas it should be a function of the sender (for his information is at stake). This is extremely bad security practice • If devices do not yet share a key, they automatically use the default key. This creates a false sense of security. As a minimum, an attempt must be made to derive a shared key • The ACL mode is not defined if encryption is enabled (see § 7. 5. 9. 4) • Broadcast encryption (i. e. , use of the default key) is insecure, since it does not provide for freshness guarantees Efficiency • Each recipient can only share 1 key with each sender. This unnecessarily complicates secure communications (e. g. , it means that if A B, and A B, C, then the latter communications initiated by A towards B and C cannot use the same key for B and C). Submission 28 Rene Struik, Certicom Corp.

July, 2004 15 -04 -0245 -01 -004 b Other Remarks — Selection (2) Efficiency, Trade-offs IEEE 802. 15. 4/Zig. Bee • There is no mechanism that enables one to distinguish keys from one another. This is bad practice, since key updates might be necessary. Moreover, it makes the definition of Key Management at the Zig. Bee level unnecessarily hard Solution: Change the definition of the Key Sequence Counter (§ 7. 6. 1. 8) as follows: ‘The key sequence counter is a counter that is fixed by the higher layer. This value may be used by the higher layers to facilitate key management: the value of the key sequence counter identifies the key that is shared by devices that are engaged in a security relationship. -------------Submission 29 Rene Struik, Certicom Corp. I would be happy to work with the editors to get the comments incorporated in