Attribute-Based Access Control Architectures with the eIDAS Protocols

Abstract

The extended access control protocol has been used for the German identity card since November 2010, primarily to establish a cryptographic key between a card and a service provider and to authenticate the partners. The protocol is also referenced by the International Civil Aviation Organization for machine readable travel documents (Document 9303) as an option, and it is a candidate for the future European eIDAS identity system. Here we show that the system can be used to build a secure access system which operates in various settings (e.g., integrated, distributed, or authentication-service based architectures), and where access can be granted based on card’s attributes. In particular we prove the protocols to provide strong cryptographic guarantees, including privacy of the attributes against outsiders.

A Security Notions of Cryptographic Primitives

This part of the paper here is almost verbatim from the full version of [9].

Message Authentication Codes. A message authentication code $\mathcal {M}$ consists of three efficient algorithms $(\textsf {MKGen},\textsf {MAC},\textsf {MVf})$ where $\textsf {MAC}(k,m)$ maps any key k generated by key generation algorithm $\textsf {MKGen}$ and any message m to a MAC (resp. tag) T which is verifiable with the help of $\textsf {MVf}(k,m,T)$ with binary output. Completeness demands again that for any valid key k and any message m the value $T\leftarrow \textsf {MAC}(k,m)$ makes $\textsf {MVf}(k,m,T)$ return 1.

We require that the message authentication code $\mathcal {M}$ is unforgeable under adaptively chosen-message attacks. That is, the adversary is granted oracle access to $\textsf {MAC}(k,\cdot )$ and $\textsf {MVf}(k,\cdot ,\cdot )$ for random key k generated by $\textsf {MKGen}$ and wins if it, at some point, makes a verification query (m, T) about a message m which has not been sent previously to $\textsf {MAC}$, and such that $\textsf {MVf}$ returns 1 for this message. We denote by ${\mathbf {Adv}}^{\text {forge}}_{\mathcal {M}}(t,q_m,q_v)$ a (bound on the) value $\epsilon$ for which no attacker in time t can win (making at most $q_m$ MACs queries and $q_v$ verification queries) with probability more than $\epsilon$. For a concrete attacker $\mathcal {A}$ we write ${\mathbf {Adv}}^{\text {forge}}_{\mathcal {A},\mathcal {M}}(n)$ to denote the fact that $\mathcal {A}$ attacks the scheme in the above sense (for security parameter n).

Signatures and Certificates. A signature scheme $\mathcal {S}=(\textsf {SKGen},\textsf {Sig},\textsf {SVf})$ consists of efficient algorithms for creating key pairs $(\textit{sk},\textit{pk})$, signing messages $s\leftarrow \textsf {Sig}(\textit{sk},m)$, and verifying signatures, $d\leftarrow \textsf {SVf}(\textit{pk},m,s)$ with $d\in \{0,1\}$. It must be that for signatures created under valid key pairs $\textsf {SVf}$ always returns 1 (correctness). Unforgeability says that no algorithm should be able to forge the signer’s signature. That is, a signature scheme $\mathcal {S}=(\textsf {SKGen},\textsf {Sig},\textsf {SVf})$ is $(t,q_s,\epsilon )$-unforgeable if for any algorithm $\mathcal {A}$ running in time t the probability that $\mathcal {A}$ outputs a signature to a fresh message under a public key is ${\mathbf {Adv}}^{\text {forge}}_{\mathcal {S}}(t,q_s)$ (which should be negligible small) while $\mathcal {A}$ has access (at most $q_s$ times) to a singing oracle. As before, for a concrete attacker $\mathcal {A}$ we write ${\mathbf {Adv}}^{\text {forge}}_{\mathcal {A},\mathcal {S}}(n)$ to denote the fact that $\mathcal {A}$ attacks the scheme in the above sense (for security parameter n).

We also assume a certification authority $\text {CA}$, modeled like the signature scheme through algorithms $\mathcal {CA}=(\textsf {CKGen},\textsf {Certify},\textsf {CVf})$, but where we call the “signing” algorithm $\textsf {Certify}$. This is in order to indicate that certification may be done by other means than signatures. We assume that the keys $(\textit{sk}_\text {CA},\textit{pk}_\text {CA})$ of the $\text {CA}$ are generated at the outset and that $\textit{pk}_\text {CA}$ is distributed securely to all parties (including the adversary). We also often assume that the certified data is part of the certificate. We define unforgeability for a certification scheme $\mathcal {CA}$ analogously to signatures, and denote the advantage bound of outputting a certificate of a new value in time t after seeing $q_c$ certificates by ${\mathbf {Adv}}^{\text {forge}}_{\mathcal {CA}}(t,q_c)$. We assume that the certification authority only issues unique certificates in the sense that for distinct parties the certificates are also distinct; we besides assume that the authority checks whether the keys are well-formed group elements. For a concrete attacker $\mathcal {A}$ we again write ${\mathbf {Adv}}^{\text {forge}}_{\mathcal {A},\mathcal {CA}}(n)$ to denote the fact that $\mathcal {A}$ attacks the scheme in the above sense (for security parameter n).

Second Preimage Resistance. We say that the compression function $\text {Compr}$ is $(t,\epsilon )$-second preimage resistant if the probability ${\mathbf {Adv}}^{\text {SecPre}}_{\text {Compr}}(t)$ of finding to a random ephemeral public key $\textit{epk}_T$ another key $\textit{epk}_T^*$ with the same compressed value is bounded by $\epsilon$. For a concrete attacker $\mathcal {A}$ we again write ${\mathbf {Adv}}^{\text {SecPre}}_{\text {Compr}}(t)$ to denote the fact that $\mathcal {A}$ finds a second preimage in the above sense (for security parameter n).

Gap Diffie-Hellman Problem. We need the following gap Diffie-Hellman problem [4]. For a group $\mathcal {G}$ generated by $g$ let $\text {DH}(X,Y)$ be the Diffie-Hellman value $X^y$ for $y=\log _gY$ (with $g$ being an implicit parameter for the function). Then the gap Diffie-Hellman assumption says that solving the computational DH problem for $(g^a,g^b)$, i.e., computing $\text {DH}(g^a,g^b)$ given only the random elements $(g^a,g^b)$ and $\mathcal {G},g$, is still hard, even when one has access to a decisional oracle $\text {DDH}(X,Y,Z)$ which returns 1 iff $\text {DH}(X,Y)={Z}$, and 0 otherwise. We say that the GDH problem is $(t,q_\text {DDH},\epsilon )$-hard if no algorithm can in time t compute the DH value with probability larger than $\epsilon$, if making at most $q_\text {DDH}$ queries. We let ${\mathbf {Adv}}^{\text {GDH}}_{\mathcal {G}}(t,q_\text {DDH})$ denote (a bound on) the value $\epsilon$ for which the GDH problem is $(t,q_{DDH},\epsilon )$-hard. For a concrete attacker $\mathcal {A}$ we write ${\mathbf {Adv}}^{\text {GDH}}_{\mathcal {A},\mathcal {G}}(n)$ to denote the fact that $\mathcal {A}$ attacks the problem in the above sense (for security parameter n).