Usability and Security of Out-Of-Band Channels in Secure Device Pairing Protocols

July 17, 2009 by Richard Conlan

http://cups.cs.cmu.edu/soups/2009/proceedings/a11-kainda.pdf
Ronald Kainda, Ivan Flechais and Andrew William Roscoe

Out-of-band device pairing refers to pairing devices using a channel external to the devices themselves, such as through user interactions.  Technical security is achieved by using protocols based on formal proofs and are governed by the quality of the secrets involved.  However, the security achieved in practice must account for user behavior and responses to protocol failures and the like.  Some common OOB methods are the users comparing fingerprints on the two devices and confirming they match, users manually copying the fingerprint from one device to the other, using auxiliary capabilities such as a camera on one device capturing the screen of the other device or sharing a secret via a memory card, and pairing using short-range channels such as infrared exchange.

The study compared the compare & confirm method, the copy & enter method, and a method where one device read a barcode from the other device.  For the first two methods they considered both textual and numeric strings.  They used the Nokia N95 and N73 with a custom P2P payment system.  Participants were presented with written directions and surveyed on their impressions.  The participants consistently preferred the numeric compare & confirm method, while pairing via images, barcode scanning or melodies were ranked last.  Security failures are defined as subjects either indicating devices matched when the did not, or did not match when they in fact did.  As measured by security, copy & enter and barcode scanning were rated as most secure.  Combining these measures of usability and security, copy & enter was found to achieve the best balance.