118
G. Avoine et al.
Fig. 7.2 Early send and late commit can make a Prover P appear closer than it really is. In the
figure, one challenge round is relayed, with the dotted lines indicating the propagation time (the
line stops and starts at transmission and reception). If the proxy-prover P guesses C i early, and
the proxy-verifier V commits late then the response R i is received by the Verifier V at the same
time as expected for a prover located at ˜
P even though the Prover P is much further away [149]
that the prover sends to the verifier, and will therefore appear to be closer to the
verifier than the true distance of the prover.
7.2.2.2 Speeding Up the Prover’s Response
If the attacker can get the prover to provide the response earlier than expected by
the verifier, then the relay delay could remain hidden, with the round-trip time of
the message remaining within the bound. There are two approaches to making the
prover process the challenge faster [255]. Smart tokens receive their system clock
from the reader, with contact-based cards having a clock line and contactless cards
recovering a clock from the received radio carrier. This allows the proxy-verifier
to overclock the token, which causes the response to be calculated and transmitted
earlier. If the token has its own, independent clock, then the attacker can also gain
some time by exploiting data clock recovery from the data coding. For example,
for Manchester coding (‘1’ is high to low,‘0’ is low to high) each bit period has
an edge transition to which the receiver can synchronize its decoding data clock.
If the transition is moved slightly ahead in each bit, as shown in Fig. 7.1b, then
the receiver will sample earlier as the message is received and the message is
decoded T A faster than normal. This approach can also effect distance fraud if
a dishonest prover is able to speed up its own response, either by calculating a
G. Avoine et al.
Fig. 7.2 Early send and late commit can make a Prover P appear closer than it really is. In the
figure, one challenge round is relayed, with the dotted lines indicating the propagation time (the
line stops and starts at transmission and reception). If the proxy-prover P guesses C i early, and
the proxy-verifier V commits late then the response R i is received by the Verifier V at the same
time as expected for a prover located at ˜
P even though the Prover P is much further away [149]
that the prover sends to the verifier, and will therefore appear to be closer to the
verifier than the true distance of the prover.
7.2.2.2 Speeding Up the Prover’s Response
If the attacker can get the prover to provide the response earlier than expected by
the verifier, then the relay delay could remain hidden, with the round-trip time of
the message remaining within the bound. There are two approaches to making the
prover process the challenge faster [255]. Smart tokens receive their system clock
from the reader, with contact-based cards having a clock line and contactless cards
recovering a clock from the received radio carrier. This allows the proxy-verifier
to overclock the token, which causes the response to be calculated and transmitted
earlier. If the token has its own, independent clock, then the attacker can also gain
some time by exploiting data clock recovery from the data coding. For example,
for Manchester coding (‘1’ is high to low,‘0’ is low to high) each bit period has
an edge transition to which the receiver can synchronize its decoding data clock.
If the transition is moved slightly ahead in each bit, as shown in Fig. 7.1b, then
the receiver will sample earlier as the message is received and the message is
decoded T A faster than normal. This approach can also effect distance fraud if
a dishonest prover is able to speed up its own response, either by calculating a