Secure Communication between Settop Box and Smart Card

Secure Communication between Set-top Box and Smart Card in DTV Broadcasting Authors: T. Jiang, Y. Hou and S. Zheng Source: IEEE Transactions on Consumer Eletronics, 50(3), pp. 882 -886, 2004. Reporter: Chun-Ta Li (李俊達)

Outline o o Introduction Schnorr’s identification scheme The proposed scheme Comments 2

Introduction o Digital television (DTV) broadcasting service n n n This work was developed by China Roles: broadcasters (head-end system) and subscribers (terminal device) Terminal device: set-top box (STB) and smart card Head-end system device scrambled message (unidirectional) Set-top Box descrambled Broadcaster issue Smart Card 3

Introduction (cont. ) o The structure of conditional access system Head-end TS TS: transport stream AK: authorization key CW: control word MPK: master private key ECM: entitlement control message EMM: entitlement management message PRG: pseudo random sequence generator SMS: subscriber management system channel Scrambler Receiver Descrambler TS ECM CWs PRG EMM PRG Encrypt 1 Decrypt 1 AK Entitlement Encrypt 2 Decrypt 2 MPK SMS 4

Introduction (cont. ) o The cooperation of STB and smart card RF: radio frequency signal 5

Introduction (cont. ) o Problem statement n No authentication between the head-end and the subscriber on line (DTV broadcasting is unidirectional) o n Without mutual authentication between STB and smart card o o n Solution: Utilize authentication between STB and smart card Attacks: Mc. Cormac Hack and smart card cloning problems Solution: Secure key exchange with mutual authentication A common session key and heavy computation load o Solution: Establishing a dynamic session key and low power wireless communications 6

Schnorr’s identification scheme o Three phases: n Initiation of the trusted authority o TA chooses n n n p and q that q|p-1, q > 2140, p > 2512 α with order q, αq = 1 mod p public key pk. A and private key sk. A one-way hash function h(. ) and a secure parameter t = 72 Registration of the user o Every user chooses n n n A random number s as his private key, s The public key is v = α-s mod p TA verifies its identity I, signs the pair (I, v) and issues the signature to the user 7

Schnorr’s identification scheme (cont. ) n Identity authentication o The prover P needs to prove its identity to the verifier V Prover Verifier 1. Sends I, v and TA’s signature on (I, v) 2. Checks the validity of the received message by verifying TA’s signature 3. Chooses a random number r and computes x = αr mod p 4. Sends x 5. Sends a random number e 6. Computes y = (r+se) mod q 7. Sends y 8. Checks x ? = αyve mod p 8

The proposed scheme o Notations n n n n h(. ): secure one-way hash function : exclusion operation IDc: smart card’s identity // STB only stores SC’s identity // IDs: STB’s identity : only known to the both entities PW: password : secret parameters xs: secret key of the STB : public parameters p and q: two public primes E(. ): symmetrical encryption algorithm 9

The proposed scheme (cont. ) o Five phases n Registration phase: SMS Subscriber 1. Smart card identity IDc and password PW 2. Computes R = h (IDc ⊕ xs) ⊕ h(PW) // xs is a secret key of the STB // 3. Chooses two public primes p and q, then computes yc = g -xc mod p // xc and yc are the private key and the pubic key of smart card 4. Stores {R, g, IDc, IDs, h(. ), E(. )} in smart card 5. Issues the smart card to the subscriber 10

The proposed scheme (cont. ) n Subscriber Login phase Smart card STB 1. Attach smart card to the STB and inputs the IDc and PW 2. The smart card generates two random number t and r in Zq and computes T = gt mod p and Y = h(T, IDc, IDs) Pre-computed 3. Computes X = R ⊕ h(PW) = h (IDc ⊕ xs) 4. Sends login request message {X, Y, r, IDc}to the STB 11

The proposed scheme (cont. ) n Mutual authentication phase STB Smart card 1. Checks the validity of IDc 2. Checks X ? = h(IDc ⊕ xs) 3. Chooses a random number e, 0<e<2 k and computes M = h(IDs, r) // k is 72 bits suggested by Schnorr // 4. Sends {M, e} to smart card 5. Checks M ? = h(IDs, r) 6. Computes d = t + exc mod q and sends it to STB 7. Checks Y ? = h(gdyce, IDc, IDs) 8. If it holds, STB accepts the smart card; otherwise STB rejects it 12

The proposed scheme (cont. ) n Key agreement phase (if mutual authentication is passed successfully for both STB and smart card) STB Smart card They agree a common session key SK = h(r, e, IDc, IDs) n CW transmission phase Smart card STB 1. After decrypting out CW, smart card computes CWe = ESK(CW) 2. Sends CWe to STB for descrambling the program 3. Decrypt out the CW 13

Comments o Some deficiencies on Jiang’s protocol (Liu et al. ) n n n The certificate verification required in Schnorr’s scheme was missed in the protocol (allows any SC with a fake certificate) The protocol doesn’t provide any key confirmation The security of the protocol based on the privacy of the hash algorithm is suspicious The run of the protocol should be initiated by STB rather than by SC It seems that both xc and yc should be stored in SC in registration phase How STB obtains the value yc and g in the mutual authentication phase 14

Comments (cont. ) o Ours n Because STB only stores SC’s identity o o The relation between SC and STB is 1 -to-1 mapping Improvement: extend the relation with n-to-n mapping n n n Any legal SC can be used in any STB can communicate with any legal SC Some party compromise attacks on Jiang et al. ’s scheme o o Assume these parameters {IDc, IDs, h(. )} are given to an adversary Improvement: let these parameters public and the scheme is still secure to prevent attacks 15

Comments (cont. ) o Our scheme n Registration phase SMS Subscriber 1. Offers IDi and PW Secure channel 2. Computes V = h(IDi ⊕ xs ⊕ expiration date) 3. Computes R = h(IDi ⊕ xs ⊕ expiration date) ⊕ h(PW) 4. Stores IDi, h(. ), E(. ), V, R and expiration date in smart card 5. Stores IDi, h(. ), E(. ), xs in set-top box 6. Issues smart card and set-top box Secure channel 16

Comments (cont. ) n Login phase Smart card STB 1. When power on, STB will request user to insert smart card and provide IDi and PW 2. Computes V’ = R ⊕ h(PW) 3. Verifies V’ ? = V 4. Generates a random number r 1 and computes Y = V’ ⊕ r 1 5. Computes C 1 = EV’[r 1] and C 2 = h(Y ⊕ N 1) 6. Sends C 1, C 2, expiration date and N 1 17

Comments (cont. ) n Mutual authentication and key agreement phase Smart card STB 1. Checks the validity of IDi and expiration date 5. Sends C 4 2. Computes V’ = h(IDi ⊕ xs ⊕ expiration date) and C 3 = D [EV’[r 1]]h(V’ ⊕ C 3 ⊕ N 1) ? = C 2 3. V’Verifies 4. Computes Y = V’ ⊕ r 1 and C 4 = EY[r 2, N 1+1, N 2] 6. Computes DY[C 4] and check the nonce N 1+1 7. Computes session key SK = h(r 1, r 2, V’) 8. Sends C 5 = ESK[N 2+1] 9. Computes DSK[C 5] and check the 18 nonce N 2+1

Comments (cont. ) n Change password phase o o n Inputs old password PW and computes V” = R ⊕ h(PW) Verifies V” ? = V If above holds, user inputs new password PW” and computes R” = V” ⊕ h(PW”) Finally, replace R with R” on the smart card Continue a contract o SMS and subscriber use the above processes including mutual authentication and key agreement to replace the V, R and expiration date with new V, new R and new expiration date on the smart card 19