FAST: Fast and Accurate Security Testing of HRP UWB Chips
OPEN ACCESS
Loading...
Author / Producer
Date
2024-10-18
Publication Type
Working Paper
ETH Bibliography
yes
Citations
Altmetric
OPEN ACCESS
Data
Rights / License
Abstract
High-Rate Pulse (HRP) Ultra-Wide Band (UWB) technology is used for secure distance measurement and was standardized by IEEE 802.15.4z in 2020. This standard is currently implemented in chips deployed in consumer devices such as Apple iPhones and Samsung smartphones. However, due to the use of proprietary algorithms and closed implementation, evaluating the security of such chips analytically is challenging. In this work, we therefore investigate how to evaluate the security of HRP UWB chips empirically. We propose FAST, a generic and efficient testing methodology that we use to accurately characterize the security of HRP UWB chips against distance reduction attacks. FAST relies on importance sampling and can accurately estimate very low success rates, for example, much smaller than 2^-10, using a small and practical number of tests. Using FAST, we characterize the security of a Qorvo DWM3000EVB chip across different settings and attack conditions. FAST revealed that different chip configurations affect the success rates (2^-10 to 2^-128) and that a well-designed attack signal can bypass the additional consistency checks offered by the chip.
Permanent link
Publication status
published
External links
Editor
Book title
Journal / series
Volume
Pages / Article No.
Publisher
ETH Zurich
Event
Edition / version
Methods
Software
Geographic location
Date collected
Date created
Subject
ultra-wideband (UWB) ranging; Secure ranging; Ghost peak
Organisational unit
03755 - Capkun, Srdan / Capkun, Srdan
Notes
Funding
180545 - NCCR Automation (phase I) (SNF)