Distance Bounding

The core of distance bounding is a fast bit-exchange phase where the verifier sends a single-bit challenge and immediately starts a timer. The prover must respond with a single-bit answer with minimal processing delay, ideally within a few nanoseconds. This tight timing constraint ensures that the measured round-trip time is dominated by the speed-of-light propagation delay, not by computational latency. Any processing delay introduced by the prover directly adds to the distance measurement, so protocols are designed to require only trivial, pre-computed operations during this critical phase.

A relay attack, or mafia fraud, occurs when an adversary simply forwards signals between a legitimate prover and verifier over a greater distance, tricking the verifier into believing the prover is physically close. Distance bounding defeats this by enforcing a strict upper bound on distance derived from the signal's round-trip time. Since electromagnetic waves travel at the speed of light (approximately 3.3 µs per kilometer), an adversary cannot reduce the physical propagation delay. If the measured RTT exceeds the expected threshold for the claimed proximity, the verifier rejects the session, even if all cryptographic credentials are valid.

Most distance bounding protocols operate in three distinct phases to prevent the prover from gaining an unfair timing advantage:

• Slow Initialization Phase: The verifier and prover exchange nonces and establish a shared secret session key using standard cryptographic primitives.
• Fast Bit-Exchange Phase: The verifier sends a rapid stream of single-bit challenges. The prover responds instantly to each. The verifier records the round-trip time for every exchange.
• Final Verification Phase: The prover signs the entire transcript of the rapid exchange and sends it to the verifier, proving that the correct secret was used to generate the responses and preventing post-hoc manipulation.

Protocols are formally analyzed against a hierarchy of adversary capabilities:

• Mafia Fraud: An external adversary relays messages between an honest, distant prover and an honest verifier.
• Terrorist Fraud: A dishonest prover colludes with an external adversary to help them pass a distance check, but without revealing the long-term secret key.
• Distance Fraud: A dishonest prover, without any external help, attempts to make itself appear closer to the verifier than it actually is, often by transmitting response bits before receiving the challenge.
• Distance Hijacking: An adversary uses a combination of honest, distant provers to make a dishonest prover appear close to the verifier.

Modern distance bounding implementations often combine round-trip time measurements with channel state information (CSI) or channel reciprocity checks. The verifier can measure the physical properties of the wireless channel during the fast bit-exchange. Because the channel between two antennas is identical in both directions at a given instant, any discrepancy in the channel profile between the forward and return path indicates a potential relay. This adds a second, independent physical-layer constraint that an adversary must forge, significantly raising the bar for successful attacks.

Distance bounding is foundational to secure ranging standards used in:

• Ultra-Wideband (UWB): The IEEE 802.15.4z standard incorporates scrambled timestamp sequences (STS) to prevent preamble injection and early-detect attacks during precise ranging.
• Contactless Payments: EMVCo's contactless specifications explore distance bounding to prevent relay attacks against card-present transactions.
• Passive Keyless Entry: Automotive systems use distance bounding to ensure a key fob is physically inside or immediately adjacent to the vehicle, preventing relay-based theft.
• Wireless Sensor Networks: Secure localization protocols use distance bounding to verify node positions in hostile environments.

The physical principle that the electromagnetic channel characteristics between two antennas are identical in both directions at a given instant. In distance bounding, this property ensures that an adversary cannot gain a timing advantage by using a faster forward channel and a slower reverse channel. The verifier measures the round-trip time (RTT) of a challenge-response exchange, relying on reciprocity to guarantee that the signal propagation delay is symmetric. Any asymmetry introduced by a relay attack—where the adversary forwards signals over a longer path—violates this assumption and is detectable as an anomalous delay.

• Key metric: Channel coherence time must exceed the challenge-response interval
• Used in: MAD protocols (Mutual Authentication with Distance Bounding)
• Violation indicates: Mafia fraud or terrorist fraud attacks

A physical-layer attack where an adversary captures a legitimate signal and transparently forwards it between a genuine prover and verifier who are not in physical proximity. The attacker does not need to decrypt or modify the signal—they simply extend its range using a wormhole or grandmaster relay setup. Distance bounding protocols defeat this by measuring the time-of-flight of rapid bit exchanges, establishing a cryptographic upper bound on distance.

• Variants: Mafia fraud (attacker relays between honest parties), Terrorist fraud (prover colludes with attacker)
• Countermeasure: Rapid bit exchange with single-bit challenge-response latency
• Critical in: Passive keyless entry systems, contactless payments

The core physical mechanism underlying distance bounding, measuring the precise elapsed time between transmitting a challenge bit and receiving the corresponding response bit. The verifier calculates distance as d = c × (RTT - processing_delay) / 2, where c is the speed of light. To prevent cheating, the prover's processing delay must be negligible and deterministic.

• Precision requirement: Nanosecond-level timing resolution for meter-level accuracy
• Hardware implementation: Dedicated FPGA or ASIC logic to eliminate software jitter
• Attack surface: Early detect / late commit bit manipulation by malicious provers

A hardware security primitive that exploits inherent manufacturing variations in silicon to generate a unique, unclonable device identity. When integrated with distance bounding, a PUF provides the tamper-resistant secret storage needed for challenge-response authentication. The PUF's response is generated on-the-fly and never stored in non-volatile memory, making it resistant to invasive physical attacks.

• Types: SRAM PUF, Arbiter PUF, Ring Oscillator PUF
• Advantage: No key storage required—the secret is the physical structure itself
• Integration: PUF response used as the signing key in distance-bounding protocols

Fine-grained physical layer data describing how a signal propagates from transmitter to receiver, including amplitude attenuation, phase shift, and multipath effects across subcarriers. CSI serves as a location-bound fingerprint that complements distance bounding: even if an attacker precisely mimics the round-trip time, the CSI pattern of a relayed signal will differ from that of a legitimate proximate device.

• Extracted from: OFDM subcarriers in Wi-Fi (802.11n/ac/ax) and LTE
• Temporal stability: CSI patterns are quasi-static in indoor environments
• Combined defense: Distance bounding + CSI correlation defeats sophisticated relay attacks

The critical timing-critical phase of a distance-bounding protocol where the verifier sends single-bit challenges and the prover responds with single-bit answers at the physical layer with minimal latency. Each bit exchange must complete within a few nanoseconds to prevent an adversary from gaining a timing advantage. This phase eliminates the variable delays introduced by higher-layer protocol stacks.

• Implementation: Dedicated hardware state machine on FPGA or ASIC
• Timing budget: Typically < 1 nanosecond processing delay per bit
• Security property: Bit commitment prevents the prover from computing responses in advance
• Error correction: Error-correcting codes applied after the rapid exchange phase