FAST: Fast and Accurate Security Testing of HRP UWB Chips

High-Rate Pulse (HRP) Ultra-Wide Band (UWB) technology is used for secure distance measurement. It was standardized by IEEE 802.15.4z in 2020 and is implemented in chips widely deployed in consumer devices. However, due to the use of proprietary signal processing algorithms, complex implementations, and subtle physical layer considerations, evaluating the security of such chips against distance-reduction attacks analytically is challenging. In this work, we investigate how to empirically evaluate the security of HRP UWB chips against random-guess attacks that were recently proven practical on real-world chips (GhostPeak). We propose FAST, a generic and efficient testing methodology that we use to accurately characterize the security of HRP UWB chips against random-guess distance reduction attacks. FAST relies on importance sampling and can accurately estimate very low success rates using a small and practical number of tests. Using FAST, we characterize the security of four HRP UWB receivers having different levels of obscurity (Qorvo DWM3000EVB, PURE, NXP SR040, and NXP SR150) across different chip configurations and attack conditions. FAST revealed success rates ranging from 2^−10 to as low as 2^−128 using only tens of thousands of test samples.