126
G. Avoine et al.
Fig. 7.5 Sketch of the patented NXP DB Protocol [303, 553]
the literature, this NXP DB protocol is byte-oriented, meaning that the messages of
the fast phase contain one or several bytes instead of a single bit. The byte-length
x of the random values is not enforced in the patents, but suggested only. They
can typically be 7 or 8 bytes. The fast phase is followed by a verification phase
where MACs are exchanged. The MACs are computed “over the complete 7-byte
random numbers and some information about the speed at which the [reader] and
[transponder] operate”. Note that “the random number ordering for the MAC input
reflects the same split as during the sending of the proximity check commands.”
Obviously, the two final MACs must contain the message direction to avoid a trivial
reflection attack. The NXP DB protocol is unlikely to be resistant to purpose-built
relays—because the measurement resolution is probably not high enough to detect
fast relays—but it might resist off-the-shelf relays.
G. Avoine et al.
Fig. 7.5 Sketch of the patented NXP DB Protocol [303, 553]
the literature, this NXP DB protocol is byte-oriented, meaning that the messages of
the fast phase contain one or several bytes instead of a single bit. The byte-length
x of the random values is not enforced in the patents, but suggested only. They
can typically be 7 or 8 bytes. The fast phase is followed by a verification phase
where MACs are exchanged. The MACs are computed “over the complete 7-byte
random numbers and some information about the speed at which the [reader] and
[transponder] operate”. Note that “the random number ordering for the MAC input
reflects the same split as during the sending of the proximity check commands.”
Obviously, the two final MACs must contain the message direction to avoid a trivial
reflection attack. The NXP DB protocol is unlikely to be resistant to purpose-built
relays—because the measurement resolution is probably not high enough to detect
fast relays—but it might resist off-the-shelf relays.