1
$\begingroup$

I have multiple RFID tags which I want the data stored on them to only be read by certain users when scanned. What I did was basically to encrypt the data with a key using CBC mode, take the encrypted hex data and append it with the IV, and then put this whole string into the tag.

So, each tag will have a different IV but their data is encrypted by the same key.

Basically, Tag A is assigned with $IV_A$ and Tag B is assigned with $IV_B$, same for Tag C, D and so on. I would pre-encrypt the data on my computer, append the IV to the back of the encrypted data, and then transfer the whole string into the tags. The different data for each of the tags will all be encrypted with the same key. So, the data in Tag A would contain $EncryptedMsg_A+IV_A$. In Tag B, the data in it would look like $EncryptedMsg_B+IV_B$.

The IVs are appended in clear text behind the encrypted data. $IV_A$ will remain unchange as the IV of Tag A for as long as it is around. And $IV_B$ will remain unchange as the IV of Tag B too.

The users wouldn't be writing to the tag. They will only be reading from the tag.

However, the part where IV remain unchanged on each scan and exposed makes me feel uneasy about this method.

Will this method be sustainable to attackers? Should I have another key to encrypt the IV before appending to the encrypted data? Would it be stronger this way?

Improve this question
$\endgroup$
0

2 Answers 2

Reset to default
1
$\begingroup$

To use CBC mode, you'll want to get a new, randomly-generated IV before each message encryption. As long as you do this, you shouldn't have to worry about issues like how many times the same ciphertext is read with the same IV.

Improve this answer
$\endgroup$
11
  • $\begingroup$ But in my case, since the tags are passive, they can't generate random IV on their own. What else can I do? $\endgroup$
    – xenon
    May 8, 2017 at 1:15
  • $\begingroup$ @xenon Since the tags are passive, what's performing the encryption operation? I'd have guessed that something able to encrypt could also generate a random value. $\endgroup$
    – Nat
    May 8, 2017 at 1:19
  • $\begingroup$ @xenon Overall, the gist is to break the correlation between identical plaintext blocks to ciphertext blocks by XOR'ing the plaintext blocks with something. CBC calls for doing this with random IV for the first block then using its results from later blocks, but you should be able to get this same basic effect other ways. For example, CTR mode uses a nonce (which is constant, like you have) plus a counter value that just iterates each time, ensuring that the effective-IV (nonce + counter) changes each time. If you can't get random IV but can use a counter, CTR might work for you. $\endgroup$
    – Nat
    May 8, 2017 at 1:25
  • $\begingroup$ Basically, I'm "pre-encrypting" the data and storing the encrypted data onto the passive tags. So, the IV in the case of CBC or counter in the case of CTR would have been fixed. But this looks like a bad idea because after reading your answer, I figured the IV and counter should really be random or at least different each time. However, the tags are passive and they can't generate random numbers on their own. What else can I try for this problem? $\endgroup$
    – xenon
    May 8, 2017 at 1:28
  • $\begingroup$ @xenon I'm not sure if I'm following the situation. So, hypothetically, say that you: (1) Have a secret you want to store on a tag. (2) Use a computer to encrypt the secret using CBC and random IV the computer creates. (3) Store the encrypted data + IV on the tag. [end] Are you able to do that, or if not, what's the barrier? $\endgroup$
    – Nat
    May 8, 2017 at 1:32
0
$\begingroup$

You seem to be describing a scenario where each tag has a constant message In order to answer the question about security we need to understand what are you afraid of? If all you want is to prevnet the attacker from decrypting the data or retriving the key what you are saying sounds secure. As you do not seem to be reusing the same IV to encrypt multiple messages but rather sending the same encrypted message with same IV multiple times. This does not give an attacker any more information then encrypting once. It you add an HMAC could also get gurantees the encrypted content wasn't altered. Whar you can not get in this sort of setup is protection against cloning or replay attacks which remain very possible. A different way of achieving same requirements which may work for you is not have data on the tag at all, just have a random unique ID and keep dictionary on the scanning side, in many cases this is simpler and obviously provides the security gurantees above.

If you would keep the same key and IV but replace the message that would be a security issue which can be severe in some cases or mild in others. For example it allows trivially detecting messages with a shared prefix.

If you want to prevent replay attacks or cloning a different IV won't suffice you will need some sort of challenge response or a time based key or something.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.