Practical Attacks on HB and HB+ Protocols

HB and HB+ are a shared secret-key authentication protocols designed for low-cost devices such as RFID tags. HB+ was proposed by Juels and Weis at Crypto 2005. The security of the protocols relies on the learning parity with noise (LPN) problem, which was proven to be NP-hard. The best known attack on LPN by Levieil and Fouque [13] requires subexponential number of samples and sub-exponential number of operations, which makes that attack impractical for the RFID scenario (one cannot assume to collect exponentially-many observations of the protocol execution). We present a passive attack on HB protocol in detection-based model which requires only linear (in the length of a secret key) number of samples. Number of performed operations is exponential, but attack is e cient for some real-life values of the parameters, i. e. noise 1 8 and key length 152-bits. Passive attack on HB can be transformed into active one on HB+.