{'fraction_non_alphanumeric': 0.029411764705882353, 'fraction_numerical': 0.0, 'mean_word_length': 5.2172413793103445, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
The Bussard-Bagga and Other Distance Bounding Protocols under Man-inthe-Middle Attacks

The communication between an honest prover and an honest verifier can be intercepted by a malicious man-in-the-middle (MiM), without the legitimate interlocutors noticing the intrusion. The attacker can simply relay messages from one party to another, eventually impersonating the prover to the verifier and possibly gaining the privileges of the former. This sort of simple relay attacks are prevalent in wireless communications (e.g., RFID-based protocols) and can affect several infrastructures from contactless payments to remote car-locking systems and access-control verification in high-security areas. As the RFID/NFC technology prevails, a practical and increasingly popular countermeasure to these attacks is given by distance bounding protocols. Yet, the security of these protocols is still not mature. Importantly, the return channel (i.e., knowing whether the protocol finished successfully or not) has partially un-assessed implications in the security assessments of some class of distance bounding protocols. In this paper, we demonstrate this by a series of theoretical and practical attacks. We show how to mount three concrete MiM attacks against the respective proposed instantiations of the Bussard-Bagga protocol. We present the descriptions of these attacks (i.e., the necessary theoretical and statistical analyses behind them), as well as the implementation and evaluation of the most general of them. All three attacks follow one major idea, exploiting the return channel and a certain design pattern used in distance-bounding. This type of security flaw extends to various distance bounding protocols; for instance, we show in passing its explicit form against the Reid et al. protocol.