Pitfalls in Ultralightweight RFID Authentication Protocol

Abstract

Radio frequency identification (RFID) is one of the most promising identification schemes in the field of pervasive systems. Non-line of sight capability makes RFID systems more protuberant than its contended systems. Since the RFID systems incorporate wireless medium, so there are some allied security threats and apprehensions from malicious adversaries. In order to make the system reliable and secure, numerous researchers have proposed ultralightweight mutual authentication protocols; which involve only simple bitwise logical operations (AND, XOR & OR etc.) to provide security. In this paper, we have analyzed the security vulnerabilities of state of the art ultralightweight RFID authentication protocol: RAPP. We have proposed three attacks (two DoS and one Desynchronization) in RAPP protocol and challenged its security claims. Moreover, we have also highlighted some common pitfalls in ultralightweight authentication protocol designs. This will help as a sanity check, improve and longevity of ultralightweight authentication protocol designs.

Toward Designing a Secure Authentication Protocol for IoT Environments

“…Most of the proposed authentication protocols can be categorized as ultralightweight, lightweight, or non-lightweight protocols from a high-level perspective regarding the components used. The foundation of ultralightweight protocols is bit-level operations such as Exclusive-or (XOR), Rotation, AND, and OR, for instance, SASI [4], RAPP [5], R 2 AP [6], RCIA [7], KMAP [8], SLAP [9], SecLAP [10], Eghdamian and Samsudin's protocol [11], David-Prasad ultralightweight authentication protocol [12], and UMAPSS [13]. However, due to a lack of sufficient confusion and diffusion, nearly all protocols in this class have been severely degraded up to this point [14][15][16][17][18][19][20][21].…”

“…Protocol Class [4][5][6][7][8][9][10][11][12][13] Ultralightweight [43][44][45][46][47][48] PUF based [52][53][54][55] Smartcard based [56][57][58][59] Biometric based [40][41][42] Blockchain based…”