Cryptology ePrint Archive: Report 2019/479
Extended 3-Party ACCE and Application to LoRaWAN 1.1
Sébastien Canard and Loïc Ferreira
Abstract: LoRaWAN is an IoT protocol deployed worldwide. Whereas the first version 1.0 has been shown to be weak against several types of attacks, the new version 1.1 has been recently released, and aims, in particular, at providing corrections to the previous release. It introduces also a third entity, turning the original 2-party protocol into a 3-party protocol. In this paper, we provide the first security analysis of LoRaWAN 1.1 in its 3-party setting using a provable approach, and show that it suffers from several flaws. Based on the 3(S)ACCE model of Bhargavan et al., we then propose an extended framework that we use to analyse the security of LoRaWAN-like 3-party protocols, and describe a generic 3-party protocol provably secure in this extended model. We use this provable security approach to propose a slightly modified version of LoRaWAN 1.1. We show how to concretely instantiate this alternative, and formally prove its security in our extended model.
Category / Keywords: cryptographic protocols / Security protocols, Security model, Internet of Things, LoRaWAN
Original Publication (with major differences): Africacrypt 2019
Date: received 10 May 2019, last revised 25 Jun 2019
Contact author: loic ferreira at orange com
Available format(s): PDF | BibTeX Citation
Note: To appear at Africacrypt 2019.
Version: 20190625:155211 (All versions of this report)
Short URL: ia.cr/2019/479
[ Cryptology ePrint archive ]