Cryptanalysis of Some RFID Authentication Protocols

Abstract

<p class="MsoNormal" style="text-align: left; margin: 0cm 0cm 0pt; layout-grid-mode: char;" align="left"><span class="text"><span style="font-family: ";Arial";,";sans-serif";; font-size: 9pt;">Two effective attacks, namely de-synchronization attack and impersonation attack, against Ha et al.’s LCSS RFID authentication protocol, Song and Mitchell’s protocol are identified. The former attack can break the synchronization between the RFID reader and the tag in a single protocol run so that they can not authenticate each other in any following protocol run. The latter can impersonate a legal tag to spoof the RFID reader by extracting the ID of a specific tag during the authentication process. An impersonation attack against Chen et al.’s RFID authentication scheme is also identified. By sending malicious queries to the tag and collecting the response messages emitted by the tag, the attack allows an adversary to extract the secret information from the tag and further to impersonate the legal tag.</span></span><span style="font-family: ";Arial";,";sans-serif";; font-size: 9pt;"></span></p&gt

A Location-Privacy-Protected RFID Authentication Scheme

“…Later, Cao and Shen indicated that Chen et al's scheme cannot resist impersonation attack [15]. Yeh et al further found that Chen et al's scheme cannot protect location privacy and proposed an improvement [14].…”

Improvement of the RFID authentication scheme based on quadratic residues

“…Cao and Shen [16] found that Chen et al's RFID authentication scheme is vulnerable to impersonation attacks. This study further demonstrates that their scheme does not provide location privacy and suffers from replay attacks.…”

“…Attackers can record R and h(r) in Step 2 of a legal reading, send malicious queries to cheat the tag out of the responses three times, and then derive the secret value h(TID) È r. After that, attackers can impersonate the tag by using the secret value h(TID) È r and the recorded R and h(r). The detailed attacking steps refer to [16]. Location privacy: If the data transmitted in Step 5 is intercepted or modified, r and r old stored in the server will have been updated while the tag's resident r will not.…”

A Novel Hash-based RFID Mutual Authentication Protocol

“…Currently, secure solutions of the RFID system include: (1) the protocol based on the hash function [2,4,5,6,10,11]; (2) the protocol based on the TEA algorithm [7]; (3) the protocol based on EPC Class 1 Generation 2 standards [1,3,8,13]. The hash-based solutions have become a research hotspot for its simple implementation and stability.…”