A User Centric Security Model for Tamper-Resistant Devices

7.6 Application Binding Protocol Distributed
ABPL uses symmetric cryptography to establish the keying material whereas the ABPD
uses asymmetric cryptography.
7.6.1 Protocol Prerequisite
The protocol prerequisite for the ABPD is an extension to the prerequisites of the ABPL
that are PPR-14 to PPR-16. The extension of the protocol prerequisite is listed below:
PPR-18 Platform Binding: A platform binding is established between the smart cards,
whose applications want to establish an application binding. This means that
both smart cards have executed the PBP, described in the previous section.
7.6.2 Protocol Description
The ABPD is executed between two applications that have an application sharing engagement.
The protocol listed in this section accommodates the ABP when the two applications
are installed on two distinct devices. In the protocol discussed below, the CL resides on
the SCA and SE on SCB.
ABPD-1. CL : au = f KSE→CL (CL i ||SE i ||SPi
CL ||SPi SE ||g r CL||N CL )
CL → SE : g r CL||N CL ||au||DH Group
SE : K DH = (g r CL) r SE
mod n
SE : K SE−CL = f KDH (N SC a||N SC b||1)
SE : mK SE−CL = f KDH (N SC a||N SC b||2)
The protocol is initiated by the CL, which generates a Die-Hellman exponential (g r CL )
and a random number. In addition, the application CL also generates a keyed hash of
identities of the participating applications, and their respective SPs along with g r CL and
N CL . The rationale behind the generation of the keyed hash value is to avoid a man-inthe-middle
attack on the rst message. To mount this attack, a malicious user has to gain
knowledge of identities of individual applications and associated SPs, and the secret key
(K SE→CL ). This message cannot prevent replay attacks, which we deal with in subsequent
messages. The message is then appended with the DH Group , which details the supported
Die-Hellman group used to generate the g r CL .
On receipt of message one, the SE will verify the authentication credentials (i.e. keyed
hash) and on a successful outcome, it will continue with the protocol. The application
SE will generate a Die-Hellman exponential and a random number. The application SE
179