FAST: Fast and Accurate Security Testing of HRP UWB Chips
Abstract
High-Rate Pulse (HRP) Ultra-Wide Band (UWB) technology is used for secure distance measurement and was standardized by IEEE 802.15.4z in 2020. This standard is currently implemented in chips deployed in consumer devices such as Apple iPhones and Samsung smartphones. However, due to the use of proprietary algorithms and closed implementation, evaluating the security of such chips analytically is challenging. In this work, we therefore investigate how to evaluate the security of HRP UWB chips empirically. We propose FAST, a generic and efficient testing methodology that we use to accurately characterize the security of HRP UWB chips against distance reduction attacks. FAST relies on importance sampling and can accurately estimate very low success rates, for example, much smaller than 2^-10, using a small and practical number of tests. Using FAST, we characterize the security of a Qorvo DWM3000EVB chip across different settings and attack conditions. FAST revealed that different chip configurations affect the success rates (2^-10 to 2^-128) and that a well-designed attack signal can bypass the additional consistency checks offered by the chip.
People
BibTex
@UNPUBLISHED{aad2024accurate,
copyright = {In Copyright - Non-Commercial Use Permitted},
year = {2024-10-18},
type = {Working Paper},
institution = {SNF},
author = {Aad, Graciana and Camurati, Giovanni and Dell’Amico, Matteo and Capkun, Srdjan},
size = {25 p.},
abstract = {High-Rate Pulse (HRP) Ultra-Wide Band (UWB) technology is used for secure distance measurement and was standardized by IEEE 802.15.4z in 2020. This standard is currently implemented in chips deployed in consumer devices such as Apple iPhones and Samsung smartphones. However, due to the use of proprietary algorithms and closed implementation, evaluating the security of such chips analytically is challenging. In this work, we therefore investigate how to evaluate the security of HRP UWB chips empirically. We propose FAST, a generic and efficient testing methodology that we use to accurately characterize the security of HRP UWB chips against distance reduction attacks. FAST relies on importance sampling and can accurately estimate very low success rates, for example, much smaller than 2^-10, using a small and practical number of tests. Using FAST, we characterize the security of a Qorvo DWM3000EVB chip across different settings and attack conditions. FAST revealed that different chip configurations affect the success rates (2^-10 to 2^-128) and that a well-designed attack signal can bypass the additional consistency checks offered by the chip.},
keywords = {ultra-wideband (UWB) ranging; Secure ranging; Ghost peak},
language = {en},
address = {Zurich},
publisher = {ETH Zurich},
DOI = {10.3929/ethz-b-000700680},
title = {FAST: Fast and Accurate Security Testing of HRP UWB Chips}
}Research Collection: 20.500.11850/700680