A valid identity is not a valid situation
Summary: A protocol can correctly authenticate legitimate participants while being wrong about the physical relationship between them.
Digital security is largely built around identity.
Certificates, cryptographic keys, passwords, hardware authenticators and biometrics all attempt, in different ways, to establish that a participant is who it claims to be or controls an expected authenticator.
But some security decisions contain an additional, sometimes implicit assumption:
the legitimate participant is expected to be in a particular physical situation.
This is where identity and situation diverge.
A protocol can succeed in the wrong situation
Consider two devices, A and B.
A cryptographically recognizes B.
B correctly answers A's challenges.
The keys are valid.
The messages are not modified.
From an identity perspective, everything may be correct.
Yet if an intermediary transports messages between A and B while they are physically far apart, the protocol can observe a logically valid interaction while incorrectly attributing a physical property to it.
This is what makes relay attacks conceptually important.
The cryptography can be correct while the situation is false.
An attack that does not necessarily steal identity
In conventional credential theft, an adversary attempts to impersonate someone else.
A relay attack can follow a different logic.
It can allow the genuine devices to perform authentication while transporting their exchanges between two locations.
Francillon, Danev and Čapkun provided a particularly clear demonstration with automotive PKES systems: legitimate devices could be made to interact through a relay despite significant physical separation, independently of strong authentication or encryption.
The attacker does not necessarily need the system to accept a false identity.
The objective can be to make it accept a false physical relationship between genuine identities.
What the system knows --- and what it assumes
This distinction separates two classes of information.
A system may know, to a defined assurance level, that a private key signed a challenge, that an authenticator produced a valid response, or that two authentication factors were presented.
But it may only assume that the equipment producing that evidence is beside the terminal, inside a room, in front of a door or within a vehicle --- unless that physical property is itself verified by an appropriate mechanism.
The boundary between knowledge and assumption is fundamental to threat modeling.
Location is not the same as co-presence
Adding location information does not automatically solve the problem.
A GPS coordinate, IP address or network geolocation describes information about a device or connection. Co-presence is a relationship between multiple participants and their shared environment.
Two devices can have compatible estimated locations without the protocol having established that they actually share the same physical context at the same time.
Conversely, some scenarios may require local physical evidence without needing an absolute geographic position at all.
The relevant question is therefore not only:
"Where is this device?"
but:
"What physical relationship between these participants can the system actually establish?"
Physical context as evidence
Research on contextual co-presence explores this problem directly.
Conti et al. describe Contextual Co-presence protocols as approaches that collect and use contextual information to improve proximity verification in zero-interaction co-presence detection and authentication systems.
Truong et al. investigated Wi-Fi, Bluetooth, GPS and audio modalities, as well as their fusion, for relay-attack resistance. Their findings also illustrate why caution is necessary: security depends on the adversary model, and an individual contextual modality can offer weak protection against an attacker capable of manipulating sensed context.
Context is not magic.
It becomes useful when it is transformed into evidence defined against an explicit threat model.
From identity to situation
This is the research question Keypulse explores.
The objective is not to oppose digital identity and the physical world. They describe different properties.
A security architecture may need to establish:
- who is participating;
- what that participant controls;
- and, in some cases, what physical situation actually relates the participants.
The first two questions sit at the core of conventional authentication.
The third introduces the co-presence problem.
An additional property, not a replacement
Discussing situation does not make identity secondary.
Physical evidence without identity may be insufficient. Strong identity without physical evidence may also be insufficient when a decision explicitly depends on local presence.
The appropriate model depends on the use case.
A remote web service generally has no reason to require the client and server to be physically co-present.
An access-control system, contactless device, industrial system or local device-to-device interaction may make decisions precisely because two elements are assumed to be together.
In those cases, the physical property is part of the security policy.
It therefore deserves to be verified as such.
A valid identity does not guarantee a valid situation.
This is not a criticism of cryptography. It is a basic security-engineering principle:
a mechanism can only prove the properties it was designed to establish.
References
- Aurélien Francillon, Boris Danev, Srdjan Čapkun, Relay Attacks on Passive Keyless Entry and Start Systems in Modern Cars, NDSS, 2011. https://eprint.iacr.org/2010/332
- Mauro Conti et al., Context-based Co-presence Detection Techniques: A Survey, Computers & Security, 2019, DOI: 10.1016/j.cose.2019.101652. https://www.sciencedirect.com/science/article/pii/S0167404819301968
- Hien Thi Thu Truong et al., Comparing and fusing different sensor modalities for relay attack resistance in Zero-Interaction Authentication, IEEE PerCom, 2014, DOI: 10.1109/PerCom.2014.6813957. https://research.aalto.fi/en/publications/comparing-and-fusing-different-sensor-modalities-for-relay-attack/
- NIST, SP 800-63B --- Digital Identity Guidelines: Authentication and Authenticator Management. https://pages.nist.gov/800-63-4/sp800-63b/authenticators/