Mutual authentication in RFID

Abstract

In RFID protocols, tags identify and authenticate themselves to readers. At Asiacrypt 2007, Vaudenay studied security and privacy models for these protocols. We extend this model to protocols which offer reader authentication to tags. Whenever corruption is allowed, we prove that secure protocols cannot protect privacy unless we assume tags have a temporary memory which vanishes by itself. Under this assumption, we study several protocols. We enrich a few basic protocols to get secure mutual authentication RFID protocols which achieve weak privacy based on pseudorandom functions only, narrow-destructive privacy based on random oracles, and narrow-strong and forward privacy based on public-key cryptography.

ROTIV: RFID Ownership Transfer with Issuer Verification

“…These requirements are along the same lines as recent research on RFID security such as [8,18,15]. Now, we present ROTIV in §4, followed by our privacy and security models in §5.…”

“…Note that protocols presented above [12,6,17] are designed to be forward privacy preserving against a strong adversary that continuously monitors tags [8,18,15]. However, in order to achieve both constant time authentication and denial of service resistance while the tag only computes hash functions, ROTIV must consider a more realistic adversary model.…”

“…Backward unlinkability Note that in scenarios where mutual authentication is required, the notion of backward unlinkability has been proven to be unachievable without tag performing public key cryptography operations, see Paise and Vaudenay [15]. In order to achieve at least a slightly weaker notion of backward unlinkability, we add the assumption that a previous owner O (T,k) of tag T cannot continuously monitor T after releasing T 's ownership.…”

“…The adversary A in this section is a direct adaptation of the non-narrow destructive adversary by Vaudenay [18] and Paise and Vaudenay [15] to tag ownership transfer in supply chains.…”

Privacy of Recent RFID Authentication Protocols

“…Our attacks do not even need the strong requirement of corrupting tags [26,13,27,17,16,28,22]. To the best of our knowledge, attacks presented here are the first known analyses of ProbIP [8], MARP [14], Auth2 [24], YA-TRAP+ [4], O-TRAP [4] and RIPP-FS [9].…”